{
 "slug": "synapse",
 "name": "Matrix Synapse",
 "tagline": "Matrix homeserver for secure, decentralised team messaging",
 "category": "collaboration",
 "use_cases": [
  "team-chat",
  "matrix",
  "end-to-end-encryption"
 ],
 "aliases": [
  "matrix synapse",
  "matrix"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Element Creations Ltd.",
  "url": "https://element-hq.github.io/synapse/latest/",
  "license": "AGPL-3.0-or-later",
  "license_url": "https://github.com/element-hq/synapse/blob/develop/LICENSE-AGPL-3.0"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   22,
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "1.162.0",
   "last_build": "2026-10-02",
   "offer_id": "synapse",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:synapse:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.synapse?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/synapse/",
  "json": "https://lynxroute.com/products/synapse/product.json"
 },
 "release_notes": [
  {
   "version": "1.162.0",
   "title": "Matrix Synapse 1.162.0",
   "notes": "* Matrix Synapse updated 1.161.0 -> 1.162.0 on Ubuntu 24.04 LTS, with no database schema change; see the upstream changelog at https://github.com/element-hq/synapse/blob/release-v1.162/CHANGES.md\n* New rooms now default to room version 12\n* Adds a rate limit on profile lookups and caps stored end-to-end encryption one-time keys at 500 per device per algorithm\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Bundled PostgreSQL 17, created with the UTF8/C collation Synapse requires and bound to 127.0.0.1 only\n* Registration closed by default; the administrator account is created at first launch with a password unique to your instance\n* Homeserver signing key generated on your instance at first launch, never shipped inside the AMI\n* Federation not enabled: port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you enable it\n* Usage statistics reporting disabled; URL previews and presence off by default\n* Nginx HTTPS perimeter on 443 with a per-instance certificate; Synapse and PostgreSQL on loopback only\n* Certbot with the nginx plugin pre-installed for a trusted certificate in one command\n* Helper for moving the homeserver onto your own domain, because a Matrix server name is permanent and must be chosen before users are created\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n* AGPL-3.0-or-later, shipped unmodified from the vendor's own signed Debian package; written source offer included in the image\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-02"
   }
  },
  {
   "version": "1.161.0",
   "title": "Matrix Synapse 1.161.0",
   "notes": "* Matrix Synapse 1.161.0 on Ubuntu 24.04 LTS - minor update from 1.160.0; see the upstream changelog at https://github.com/element-hq/synapse/blob/release-v1.161/CHANGES.md\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Bundled PostgreSQL 17, created with the UTF8/C collation Synapse requires and bound to 127.0.0.1 only\n* Registration closed by default; the administrator account is created at first launch with a password unique to your instance\n* Homeserver signing key generated on your instance at first launch, never shipped inside the AMI\n* Federation not enabled: port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you enable it\n* Usage statistics reporting disabled; URL previews and presence off by default\n* Nginx HTTPS perimeter on 443 with a per-instance certificate; Synapse and PostgreSQL on loopback only\n* Certbot with the nginx plugin pre-installed for a trusted certificate in one command\n* Helper for moving the homeserver onto your own domain, because a Matrix server name is permanent and must be chosen before users are created\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n* AGPL-3.0-or-later, shipped unmodified from the vendor's own signed Debian package; written source offer included in the image\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-09-17"
   }
  },
  {
   "version": "1.158.0",
   "title": "Matrix Synapse 1.158.0",
   "notes": "* Matrix Synapse 1.158.0 on Ubuntu 24.04 LTS - minor update from 1.157.2; see the upstream changelog at https://github.com/element-hq/synapse/blob/release-v1.158/CHANGES.md\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Bundled PostgreSQL 17, created with the UTF8/C collation Synapse requires and bound to 127.0.0.1 only\n* Registration closed by default; the administrator account is created at first launch with a password unique to your instance\n* Homeserver signing key generated on your instance at first launch, never shipped inside the AMI\n* Federation not enabled: port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you enable it\n* Usage statistics reporting disabled; URL previews and presence off by default\n* Nginx HTTPS perimeter on 443 with a per-instance certificate; Synapse and PostgreSQL on loopback only\n* Certbot with the nginx plugin pre-installed for a trusted certificate in one command\n* Helper for moving the homeserver onto your own domain, because a Matrix server name is permanent and must be chosen before users are created\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n* AGPL-3.0-or-later, shipped unmodified from the vendor's own signed Debian package; written source offer included in the image\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-19"
   }
  },
  {
   "version": "1.157.2",
   "title": "Matrix Synapse 1.157.2 - Initial release (July 2026)",
   "notes": "* Matrix Synapse 1.157.2 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Bundled PostgreSQL 17, created with the UTF8/C collation Synapse requires and bound to 127.0.0.1 only\n* Registration closed by default; the administrator account is created at first launch with a password unique to your instance\n* Homeserver signing key generated on your instance at first launch, never shipped inside the AMI\n* Federation not enabled: port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you enable it\n* Usage statistics reporting disabled; URL previews and presence off by default\n* Nginx HTTPS perimeter on 443 with a per-instance certificate; Synapse and PostgreSQL on loopback only\n* Certbot with the nginx plugin pre-installed for a trusted certificate in one command\n* Helper for moving the homeserver onto your own domain, because a Matrix server name is permanent and must be chosen before users are created\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n* AGPL-3.0-or-later, shipped unmodified from the vendor's own signed Debian package; written source offer included in the image\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-07-31"
   }
  }
 ],
 "release_history": [
  {
   "version": "1.162.0",
   "azure": "2026-10-02"
  },
  {
   "version": "1.161.0",
   "azure": "2026-09-17"
  },
  {
   "version": "1.160.0",
   "azure": "2026-09-06"
  },
  {
   "version": "1.158.0",
   "azure": "2026-08-19"
  },
  {
   "version": "1.157.2",
   "azure": "2026-07-31"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer synapse --plan payg-gen2\naz vm create -g my-rg -n synapse --size Standard_D2s_v3 \\\n  --image lynxroute:synapse:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Matrix Synapse is the reference server implementation of Matrix, an open standard for secure, decentralised real-time communication. It is a Python service built on Twisted with a Rust extension module, and it hosts your own user accounts, rooms and message history for any standard Matrix client such as Element on desktop, web and mobile. Synapse supports end-to-end encrypted rooms, spaces, threads, read receipts, file and media sharing, and push notifications. It persists accounts, rooms, events and media metadata in PostgreSQL, which this image bundles and pre-configures. Because Matrix is an open protocol rather than a product, you are never tied to one vendor's client, and the same account works across every conforming app. AGPL-3.0-or-later license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Registration closed by default - strangers cannot create accounts on your server\n* Administrator account created at first launch with a password unique to your instance, written to /root/synapse-credentials.txt\n* Homeserver signing key generated on your instance at first launch and never shipped inside the image, so no two deployments share a cryptographic identity\n* Federation not enabled - port 8448 closed and no delegation published, so the server does not join the wider Matrix network until you choose to enable it\n* Usage statistics reporting disabled; URL previews and presence off by default\n* Bundled PostgreSQL 17 bound to 127.0.0.1 only, with scram-sha-256 authentication and no trust entries\n* Synapse itself bound to 127.0.0.1 only; nginx terminates TLS on 443 as the sole public entry point\n* UFW firewall pre-configured - only ports 22, 80 and 443 reachable; 8008, 5432 and 8448 blocked\n* fail2ban and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nIncluded components:\n* PostgreSQL 17, created with the UTF8/C collation Synapse requires\n* Certbot with the nginx plugin, so a trusted certificate is one command away\n* A helper for moving the homeserver onto your own domain\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n* Written source offer for the AGPL-3.0 code at /usr/share/doc/lynxroute/LICENSES.txt\n\nIMPORTANT - CHOOSE YOUR SERVER NAME BEFORE CREATING USERS\n\nIn Matrix the server name becomes part of every user ID and room ID, and the protocol provides no way to rename it afterwards. This image derives it from the instance address at first launch; to use your own domain instead, set it before you create any users. No mail server is included, so create users and reset passwords from the command line, or configure your own SMTP."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}