Matrix Synapse - Hardened Matrix Homeserver with PostgreSQL

This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.

WHAT IS MATRIX SYNAPSE

Matrix Synapse is the reference server implementation of Matrix, an open standard for secure, decentralised real-time communication. It is a Python service built on Twisted with a Rust extension module, and it hosts your own user accounts, rooms and message history for any standard Matrix client such as Element on desktop, web and mobile. Synapse supports end-to-end encrypted rooms, spaces, threads, read receipts, file and media sharing, and push notifications. It persists accounts, rooms, events and media metadata in PostgreSQL, which this AMI bundles and pre-configures. Because Matrix is an open protocol rather than a product, you are never tied to one vendor's client, and the same account works across every conforming app. AGPL-3.0-or-later license, no vendor lock-in.

WHAT THIS AMI ADDS

Security hardening:

• Registration closed by default - strangers cannot create accounts on your server
• Administrator account created at first launch with a password unique to your instance, written to /root/synapse-credentials.txt
• Homeserver signing key generated on your instance at first launch and never shipped inside the AMI, so no two deployments share a cryptographic identity
• Federation not enabled - port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you choose to enable it
• Usage statistics reporting disabled; URL previews and presence off by default
• Bundled PostgreSQL 17 bound to 127.0.0.1 only, with scram-sha-256 authentication and no trust entries
• Synapse itself bound to 127.0.0.1 only; nginx terminates TLS on 443 as the sole public entry point
• UFW firewall pre-configured - only ports 22, 80 and 443 reachable; 8008, 5432 and 8448 blocked
• fail2ban and AppArmor pre-configured
• CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
• auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Included components:

• PostgreSQL 17, created with the UTF8/C collation Synapse requires
• Certbot with the nginx plugin, so a trusted certificate is one command away
• A helper for moving the homeserver onto your own domain

Compliance artifacts:

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html
• CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Written source offer for the AGPL-3.0 code at /usr/share/doc/lynxroute/LICENSES.txt

IMPORTANT - CHOOSE YOUR SERVER NAME BEFORE CREATING USERS

In Matrix the server name becomes part of every user ID and room ID, and the protocol provides no way to rename it afterwards. This AMI derives it from the instance address at first launch; to use your own domain instead, set it before you create any users. No mail server is included, so create users and reset passwords from the command line, or configure your own SMTP.