Catalog / Collaboration & files

Matrix Synapse

Matrix homeserver for secure, decentralised team messaging

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace1.162.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
1.162.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseAGPL-3.0-or-later
UpstreamElement Creations Ltd.
Machine-readableproduct.json · catalog.json
What is Matrix Synapse

Matrix Synapse is the reference server implementation of Matrix, an open standard for secure, decentralised real-time communication. It is a Python service built on Twisted with a Rust extension module, and it hosts your own user accounts, rooms and message history for any standard Matrix client such as Element on desktop, web and mobile. Synapse supports end-to-end encrypted rooms, spaces, threads, read receipts, file and media sharing, and push notifications. It persists accounts, rooms, events and media metadata in PostgreSQL, which this image bundles and pre-configures. Because Matrix is an open protocol rather than a product, you are never tied to one vendor's client, and the same account works across every conforming app. AGPL-3.0-or-later license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Registration closed by default - strangers cannot create accounts on your server
  • Administrator account created at first launch with a password unique to your instance, written to /root/synapse-credentials.txt
  • Homeserver signing key generated on your instance at first launch and never shipped inside the image, so no two deployments share a cryptographic identity
  • Federation not enabled - port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you choose to enable it
  • Usage statistics reporting disabled; URL previews and presence off by default
  • Bundled PostgreSQL 17 bound to 127.0.0.1 only, with scram-sha-256 authentication and no trust entries
  • Synapse itself bound to 127.0.0.1 only; nginx terminates TLS on 443 as the sole public entry point
  • UFW firewall pre-configured - only ports 22, 80 and 443 reachable; 8008, 5432 and 8448 blocked
  • fail2ban and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Included components:

  • PostgreSQL 17, created with the UTF8/C collation Synapse requires
  • Certbot with the nginx plugin, so a trusted certificate is one command away
  • A helper for moving the homeserver onto your own domain

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
  • Written source offer for the AGPL-3.0 code at /usr/share/doc/lynxroute/LICENSES.txt

IMPORTANT - CHOOSE YOUR SERVER NAME BEFORE CREATING USERS

In Matrix the server name becomes part of every user ID and room ID, and the protocol provides no way to rename it afterwards. This image derives it from the instance address at first launch; to use your own domain instead, set it before you create any users. No mail server is included, so create users and reset passwords from the command line, or configure your own SMTP.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/synapse-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer synapse --plan payg-gen2
az vm create -g my-rg -n synapse --size Standard_D2s_v3 \
  --image lynxroute:synapse:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Matrix Synapse 1.162.0

Azure · 2026-10-02
  • Matrix Synapse updated 1.161.0 -> 1.162.0 on Ubuntu 24.04 LTS, with no database schema change; see the upstream changelog at https://github.com/element-hq/synapse/blob/release-v1.162/CHANGES.md
  • New rooms now default to room version 12
  • Adds a rate limit on profile lookups and caps stored end-to-end encryption one-time keys at 500 per device per algorithm
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • Bundled PostgreSQL 17, created with the UTF8/C collation Synapse requires and bound to 127.0.0.1 only
  • Registration closed by default; the administrator account is created at first launch with a password unique to your instance
  • Homeserver signing key generated on your instance at first launch, never shipped inside the AMI
  • Federation not enabled: port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you enable it
  • Usage statistics reporting disabled; URL previews and presence off by default
  • Nginx HTTPS perimeter on 443 with a per-instance certificate; Synapse and PostgreSQL on loopback only
  • Certbot with the nginx plugin pre-installed for a trusted certificate in one command
  • Helper for moving the homeserver onto your own domain, because a Matrix server name is permanent and must be chosen before users are created
  • UFW firewall pre-configured (ports 22, 80, 443 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced
  • AGPL-3.0-or-later, shipped unmodified from the vendor's own signed Debian package; written source offer included in the image
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates