Welcome to the Deep Dive. Today we're diving into something pretty cool if you're
Download transcript (.srt)
0:00
0:04
0:04
0:09
0:09
0:13
0:13
0:19
0:20
0:23
0:24
0:28
0:29
0:34
0:35
0:39
0:40
0:45
0:46
0:49
0:50
0:53
0:54
1:00
1:01
1:05
1:06
1:10
1:11
1:16
1:16
1:20
1:21
1:25
1:27
1:30
1:32
1:37
1:37
1:43
1:44
1:49
1:50
1:57
1:58
2:03
2:04
2:10
2:11
2:16
2:17
2:21
2:21
2:26
2:27
2:32
2:33
2:38
2:38
2:43
2:43
2:47
2:48
2:52
2:53
2:58
2:59
3:04
3:04
3:10
3:11
3:17
3:18
3:23
3:23
3:29
3:30
3:35
3:36
3:40
3:41
3:45
3:45
3:49
3:50
3:53
3:54
3:56
3:57
4:02
4:03
4:07
4:08
4:13
4:14
4:18
4:18
4:23
4:24
4:29
4:33
4:37
4:42
4:45
4:49
4:50
4:56
4:56
5:00
5:01
5:04
5:08
5:15
5:22
5:27
5:28
5:32
5:33
5:37
5:37
5:38
5:40
5:44
5:45
5:48
5:50
5:53
5:54
5:56
5:57
6:00
6:04
6:10
6:14
6:20
6:21
6:23
6:26
6:30
6:32
6:35
6:38
6:41
6:45
6:46
6:51
6:51
6:55
6:55
7:00
7:03
7:07
7:08
7:11
7:12
7:16
7:19
7:23
7:24
7:28
7:33
7:33
7:35
7:40
7:44
7:46
7:50
7:51
7:59
8:03
8:07
8:12
8:14
8:19
8:23
8:29
8:35
8:36
8:41
8:41
8:45
8:49
8:49
8:53
8:53
8:56
9:00
9:02
9:05
9:08
9:12
9:14
9:14
9:19
9:21
9:25
9:26
9:27
9:33
9:36
9:40
9:41
9:43
9:45
9:49
9:53
9:57
10:01
10:05
10:06
10:10
10:11
10:13
10:17
10:21
10:22
10:23
10:26
10:29
10:32
10:35
10:35
interested in,
you know, taking back control of your digital communication. We're looking at Synapse.
It's
the main home server for the Matrix Network. Basically, we want to make this whole
complex
topic a bit more, well, accessible for beginners. How do you actually run your own
chat platform?
But before we really jump in, just want to give a quick shout out to our supporter
for this dive,
Safe Server. They focus on hosting exactly this kind of open source software and
helping with
your digital transformation. You can check them out at www.safeserver.de. Yeah, and
our goal here
is really to filter out the noise. What is Synapse fundamentally? Why are the
security rules so
specific? And how does it handle who you are in this whole decentralized Matrix
world? It's a
bit different. Okay, let's definitely unpack that. Starting simple, Synapse, M, and
Matrix, they get
mentioned together all the time. What's the actual difference for someone just
starting out? Okay,
think of Matrix as the blueprint. It's the open standard, the set of rules for
secure, real-time
chat that can talk to anything else following the same rules. Right, the protocol.
Exactly. Synapse
N is the most well-known engine built using that blueprint. It's the software you
actually install
and run. It's open source, mostly written in Python, with some rust creeping in now,
and it's where
your account lives, where your messages are stored. And Element are the main folks
behind Synapse,
right? I saw it's got this interesting dual license thing going on. It's primarily
AGPL 3.0,
which means you can grab it, run it, modify it, all for free. Perfect for
individuals or communities.
Which is what most beginners will care about. For sure. But Element also offers a
commercial
license. If you're a big company, you might want their Element Server Suite, or ESS.
Okay, so why
would a company pay if the core is free? What does ESS add? It's less about core
features and more
about operational guarantees. Think professional support contracts, SLAs, fancy
admin tools,
audit logs for compliance, maybe advanced ways to manage user identities that big
organizations need.
It's SAN apps, but sort of enterprise hardened. Gotcha. So support and specific
business tools on
top. But the key thing for our listeners maybe is that you can run this powerful
server yourself.
That's the real magic, isn't it? That digital autonomy. Absolutely. So someone's
convinced
they want to run it. What's the path of least resistance for getting it installed?
Like day one,
easiest method. Definitely the official Docker images or the Debian packages from
matrix.org.
The documentation points you straight there. Okay. Those options kind of bundle up
all the
tricky dependencies. Yeah. Gets you a running server much quicker than, you know,
compiling
everything from scratch. Right. Avoid the compiling nightmare first time around.
Please do. But just
having it running isn't quite enough if you want it to talk to the rest of the
world, right? Which
is kind of the point of major. So you absolutely need what's called a reverse proxy.
Think Jinx,
Caddy, Apache, something sitting in front of Synapse. Now, the docs are really
strong on
this. Is it just a nice to have or truly essential? Oh, it's essential. Seriously.
For security. For
practicality. Synapse listens on specific ports, like maybe 8448 or something. But
your users and
other servers, they expect to connect on the standard web port, 443 for HTTPS. Okay,
so the
proxy handles that connection. It handles mapping that clean port 443 traffic to
Synapse's internal
port. And here's the critical bit. It means you can expose port 443 without running
Synapse itself
as the root user, the super admin. Ah, the principle of least privilege. Big
security win.
If Synapse somehow gets compromised, the damage is more contained because it doesn't
have root
powers. Precisely. Keep Synapse's privileges as low as possible. And while we're on
setup,
just a quick heads up on maintenance, running your own server means you got to keep
it updated.
Right. And with Synapse, you really need to read the release notes before you
upgrade. Sometimes
it's just a simple update, but other times you might need to do manual database
stuff or update
Python or PostgreSQL first. You can just blindly update. Good warning. Okay.
Installation handled,
reverse proxy in place. Now, this security bit you mentioned, the docs have this
huge warning
about domains. This seems really important. It's probably the most critical
security
configuration detail. You absolutely, positively must not host your Synapse home
server on the
same base domain, the ETLD plus one, like example.com as other sensitive web apps.
Whoa. Okay. Like webmail or maybe even the element web client itself?
Exactly. Don't put your Synapse server on matrix.example.com if your webmail is on
mail.example.com or your element web is on app.example.com.
Why? What's the risk there? It boiled down to cross-site scripting,
XSS. Matrix handles tons of potentially untrusted content from users all over the
federation.
If, hypothetically, someone found an XSS bug in Synapse and your Synapse server
shared
that example.com base domain with your webmail, that attacker might be able to
leverage the
Synapse vulnerability to steal cookies or credentials from your WebL session
or other apps on that same domain. It breaks the security isolation between apps.
Oof. Okay, so that's a huge blast radius. So, ideally, if my web client is app.mydomain.com,
my Synapse should live on something totally separate, like my-matrix-server.net.
That's the gold standard. Using a different subdomain on the same base domain like
matrix.mydomain.com,
it offers some protection, but it's not as good as a completely separate registered
domain.
And this applies specifically to whatever domain you put in Synapse's public base
or all setting.
Get this wrong.
And you're undermining a key security layer.
Crystal clear. That's a non-negotiable, then. Now, let's switch gears slightly to
identity.
People often confuse the home server Synapse with the identity server.
What does the IS actually do?
Right. They're distinct. Synapse, your home server, hold your account, your
username,
your password hash, your chat history.
The core stuff.
Yeah. The identity server, or IS like the common one,
its only job is mapping things like your email address or phone number,
what we call third-party IDs or 3P IDs, your matrix ID, like at yourname.my.domain.name.
And crucially, it verifies you actually own that email address or phone number.
It sends you a confirmation link or code, but it never sees or stores your matrix
password.
So it's just a look up and validation service. Got it.
But here's the kind of weird part.
We're building this decentralized thing, but the docs strongly suggest using a
centralized IS,
like the one run by matrix.org or vector.im.
Why? Why not run my own IS too?
It's about trust and network effects, really.
You can run your own IS, like Sident, and you can associate your email with your
matrix ID on your
server. But the problem is, nobody else on the matrix network trusts your little IS
to be telling
the truth about who owns what email address. If someone on a different server wants
to find
you by searching for your email, they'll query an IS they trust, like matrix.org,
and if your email isn't registered there, they won't find your matrix ID.
So for discoverability across the whole network right now, using one of the big
established IS
instances is kind of necessary if you want people to easily find you via email or
phone.
Ah, so it's a practical compromise. You trade a bit of pure decentralization
for actually being findable in the wider ecosystem.
Pretty much sums it up, yeah. It's a known limitation, and there's work towards
more
decentralized solutions, but for now, that's the reality for easy federation.
Makes sense. Okay, installed, secured the domain, understood identity. How do I
actually,
you know, use this thing, test it out?
Easiest way is probably a web client like Element Web. Just go to app.element.io in
your browser, and this trips people up. You can't just use the default login page.
Right, because that points to matrix.org's home server.
Exactly. You need to find the option to specify a custom home server. It might be
under advanced
or other. Then you put in your server's address, usually something like https.your.server.name.8448.
Got it. And then I try to sign up, but it won't let me by default, will it?
Correct. Default setting is enable registration.false. Safety first.
You have to go into your home server.yml configuration file and flip that to true.
Okay. Registration enabled. Now what?
Now you have a choice. Option one, strongly recommended if your server is reachable
from the internet. Set up a cappie TCHA. To stop the bots.
Absolutely. Option two is you can set enable registration without verification.
Good. But honestly, don't do that unless your server is purely internal and locked
down.
Why is the cappie TCHA so important, even for a small server, maybe just for
friends?
Because spam bots will find your open registration endpoint eventually.
And if they can create accounts without a cappie TCHA, they won't just spam your
users.
They'll use your server as a launchpad to spew spam across the entire Matrix
Federation.
Ah, so you become part of the problem. You really do.
Running a server comes with a bit of responsibility to the network's health.
Use a cappie TCHA if it's public, please.
Message received. Okay, so I registered successfully.
My Matrix ID will look like at my username.my.server.name.
Right, exactly that format. Username, colon, your server's domain name.
And if you hit snags, setting this all up.
Where do I go?
The main community support room is hashtag sendapps.matrix.org on Matrix itself.
Lots of helpful folks there.
Just remember, GitHub issues are really for actual bugs, not general how-do-I
questions.
Good distinction.
And if you're a developer looking to contribute, there's hashtag synapse-dev.matrix.org.
Okay, so wrapping this up, Synapse is powerful.
It gives you this amazing open source foundation for your own secure communication
platform.
But you have to nail the setup.
Get the reverse proxy right.
Absolutely follow that domain separation rule for security.
And understand the current trade-offs with identity servers for discoverability.
Yeah, and if you look at the bigger picture, reading between the lines in the docs,
The Matrix Project wants to solve that identity server centralization issue.
The long-term goal is clearly full decentralization, even for finding people via
email.
The current reliance on servers like matrix.org is pragmatic, but you can see they're
aiming beyond that.
That is definitely something interesting to think about.
What does truly decentralized identity actually look like?
And how does trust work in that kind of future network compared to today's hybrid
model?
Something for you to ponder.
And remember, this deep dive was supported by Safe Server.
They're there to help you manage hosting for software like Synapse
and support your digital transformation efforts.
Check them out at www.safeserver.de.
We'll catch you on the next one.
We'll catch you on the next one.