Skip to content

Commit d6ebc9b

Browse files
authored
Propose CAP_NET_BIND_SERVICE instead running synapse with root
There are alternative ways to use low numbered ports besides root. Users might be misleaded thinking they should run synapse with root privileges. Thanks to discussion with @bones_was_here.
1 parent 740fc88 commit d6ebc9b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/reverse_proxy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ It is recommended to put a reverse proxy such as
88
[relayd](https://man.openbsd.org/relayd.8) in front of Synapse. One advantage
99
of doing so is that it means that you can expose the default https port
1010
(443) to Matrix clients without needing to run Synapse with root
11-
privileges.
11+
privileges or `CAP_NET_BIND_SERVICE` to bind such a low port number.
1212

1313
You should configure your reverse proxy to forward requests to `/_matrix` or
1414
`/_synapse/client` to Synapse, and have it set the `X-Forwarded-For` and

0 commit comments

Comments
 (0)