Matrix Synapse - Hardened Matrix Homeserver with PostgreSQL

What is Matrix Synapse

Synapse is the reference server implementation of Matrix, an open standard for secure, decentralised real-time communication. It gives you a homeserver that hosts your own accounts, rooms and message history, reachable from any standard Matrix client such as Element on desktop, web and mobile. Synapse supports end-to-end encrypted rooms, spaces, threads, read receipts, file and media sharing, and push notifications. Matrix is an open protocol, not a product, so you are never tied to one vendor's client.

Why self-host Matrix Synapse

Running your own homeserver keeps conversations, accounts and media on infrastructure you control, in a region you choose. That matters for GDPR and data-residency obligations, and for organisations that cannot route internal discussion through a third party. There are no per-seat licence fees: you pay for the VM and the software fee, and add users freely.

What this VM image adds

Security hardening:

• Registration closed by default - strangers cannot create accounts; an open homeserver on a public address becomes a spam relay
• Administrator created at first boot - a unique password generated on your instance, written to /root/synapse-credentials.txt, so the server is never briefly open to whoever arrives first
• Per-instance cryptographic identity - the homeserver signing key is generated on your VM at first boot, never shipped in the image, so no two deployments share an identity
• Federation not enabled - port 8448 is closed and no delegation is published, so the server does not talk to the wider Matrix network until you choose to enable it
• Telemetry disabled - usage statistics reporting is off, so nothing about your homeserver leaves the instance; URL previews and presence are off too
• HTTPS perimeter - nginx terminates TLS on 443 with a per-instance certificate; Synapse and PostgreSQL listen on loopback only
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - only 22, 80 and 443 reachable; 8008, 5432 and 8448 blocked externally
• fail2ban - SSH brute-force protection, and AppArmor mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR

Included components:

• PostgreSQL 17 - bundled and pre-configured with the UTF8/C collation Synapse requires; upstream's testing-only SQLite default is not used
• Certbot - installed with the nginx plugin, so a trusted certificate is one command away
• synapse-set-server-name - a guarded helper for moving the homeserver onto your own domain

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Licence and source offer - /usr/share/doc/lynxroute/LICENSES.txt, including the written offer for the AGPL-3.0 source code

Quick Start

1. Deploy the VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (default username: azureuser)
3. Read the generated administrator password: sudo cat /root/synapse-credentials.txt
4. Install a trusted certificate: sudo certbot --nginx -d yourdomain.com - most Matrix clients refuse an untrusted homeserver
5. Sign in from a Matrix client, pointing it at your server address
6. Add users: sudo register_new_matrix_user -c /etc/matrix-synapse/conf.d/10-lynxroute.yaml http://localhost:8008

Choose your server name before you create users. In Matrix it becomes part of every user ID and room ID, and the protocol offers no way to rename it later. The image derives it from the instance address on first boot; to use your own domain, run sudo synapse-set-server-name first. No mail server is included, so add users and reset passwords from the command line, or configure your own SMTP.