An open egress that nobody explains reads as neglect. These five are
decisions, so the reasons sit at the rule, where the next reader looks -
not in an issue and not in an ADR alone.
Synapse federates to arbitrary servers and previews addresses users pick;
there is no list to write, and the right control sits a level higher in
url_preview_ip_range_blacklist. Coturn and the SFU relay media to arbitrary
clients - that is the service. ClamAV pulls signatures from a CDN, and
pinning would break the update silently, which is the failure class this
project keeps finding.
MAS is now only there out of caution, and the comment says so. Read from
the running process today: its upstream is Authentik at its public name and
the homeserver at the internal service name. The public name resolves to
the node address, which the policy does not cover anyway - so MAS is
restrictable and only the sign-off is missing, because a mistake there hits
sign-in.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Thore CimbalandClaude Opus 5
c7fe0488e2