[argiad]

Problem

The all-in-one try-it image (matrixmedia-allinone:dev, from #152) ends its nginx config with location / { proxy_pass http://127.0.0.1:8009; }. Every path nginx doesn't route elsewhere goes to Synapse, /_synapse/admin/* included, on the published port 8008. /_synapse/admin/v1/server_version answers without a token. #160 closed the same hole in the Traefik stack and the Helm chart; this image has its own nginx, so #160 didn't cover it.

Change

• infra/docker/allinone/nginx.conf: location ^~ /_synapse/admin { return 404; }, next to the existing 404s for /_mm/switch/metrics and /_mm/. This follows Synapse's reverse-proxy guidance. /_matrix, /_synapse/client and /.well-known/matrix still reach Synapse.
• .github/workflows/allinone-image.yml smoke test: a small expect_status helper asserts these through :8008:
  • /_matrix/client/versions → 200
  • /_synapse/admin/v1/server_version → 404
  • /_synapse/%61dmin/v1/server_version → 404 (nginx matches the decoded path; this keeps it that way)
• CHANGELOG.md: [Unreleased] → Security entry. It goes at the end of the section, so it won't conflict with fix(deploy): keep Synapse's admin API off the internet #160's entry at the top.

Nothing in the image needs it through nginx

• mm-allinone.sh: SYNAPSE_URL=http://127.0.0.1:8009. mm-core gets MM_MATRIX_HOMESERVER_URL=$SYNAPSE_URL. The public URL (MM_MATRIX_PUBLIC_HOMESERVER_URL) is only handed back to clients after signup.
• Every Synapse admin call in mm-core uses matrix.homeserver_url: SynapseAdminClient (startup.rs), moderation, rooms, membership and the /_mm/admin/v1/synapse/* proxy.
• register_new_matrix_user and the init's admin login both use $SYNAPSE_URL.
• No code under web/ references _synapse.

Verification (local, Docker Desktop, arm64)

Ran the workflow's own "Smoke test" step, extracted from the YAML unchanged with only the image tag swapped:

• Before. The matrixmedia-allinone image built from development: its nginx.conf, supervisord.conf and mm-allinone.sh are byte-identical to development. The step fails: GET /_synapse/admin/v1/server_version through :8008 gave HTTP 200, want 404.
• After. The same image with the new nginx.conf. The step passes: both starts reach healthy, smoke test passed.

Extra probes on the fixed container:

Path through :8008	Result
/_synapse/admin, /_synapse/admin/, /_synapse/admin/v2/users	404 (nginx)
/_synapse/%61dmin/…, /_synapse%2Fadmin/…, //_synapse/admin/…, /_synapse/./admin/…, /_matrix/../_synapse/admin/… (--path-as-is)	404 (nginx)
/_SYNAPSE/admin/…, /_synapse/ADMIN/…	404 from Synapse (no admin servlet matches)
/_matrix/client/versions, /.well-known/matrix/client	200
/_synapse/client/…	reaches Synapse (JSON answer)
Inside the container: 127.0.0.1:8009/_synapse/admin/v1/server_version	200
/_mm/admin/v1/synapse/users (mm-core → Synapse admin on :8009)	200, user list

actionlint is clean. Test containers and volumes were removed afterwards.

After merge

The push to development republishes :dev and :sha-<short>. Anyone running the image should pull :dev again.

🤖 Generated with Claude Code