openclaw - ✅(Solved) Fix [Bug]: Matrix cannot connect to the internal Synapse server [1 pull requests, 3 comments, 4 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#52054Fetched 2026-04-08 01:16:05
View on GitHub
Comments
3
Participants
4
Timeline
10
Reactions
0
Author
Timeline (top)
commented ×3cross-referenced ×2labeled ×2closed ×1

On March 22, 2026, an application built using Docker failed to connect to the internal network server address. If the hostname is used, the following error message appears:

2026-03-22T03:30:02.024+00:00 [matrix] [main] starting provider (http://synapse:8008)
2026-03-22T03:30:02.052+00:00 [matrix] [main] channel exited: Matrix homeserver must use https:// unless it targets a private or loopback host

If an internal IP address is used, the following error message will be displayed:

2026-03-22T03:34:20.992+00:00 [matrix] [main] starting provider (http://172.29.0.88:8008)
2026-03-22T03:34:21.012+00:00 [matrix] [main] channel exited: Blocked hostname or private/internal/special-use IP address

Error Message

On March 22, 2026, an application built using Docker failed to connect to the internal network server address. If the hostname is used, the following error message appears: If an internal IP address is used, the following error message will be displayed:

Root Cause

On March 22, 2026, an application built using Docker failed to connect to the internal network server address. If the hostname is used, the following error message appears:

2026-03-22T03:30:02.024+00:00 [matrix] [main] starting provider (http://synapse:8008)
2026-03-22T03:30:02.052+00:00 [matrix] [main] channel exited: Matrix homeserver must use https:// unless it targets a private or loopback host

If an internal IP address is used, the following error message will be displayed:

2026-03-22T03:34:20.992+00:00 [matrix] [main] starting provider (http://172.29.0.88:8008)
2026-03-22T03:34:21.012+00:00 [matrix] [main] channel exited: Blocked hostname or private/internal/special-use IP address

Fix Action

Fixed

PR fix notes

PR #52107: fix(net): treat bare hostnames as private for HTTP security checks

Description (problem / solution / changelog)

Summary

  • Docker/Kubernetes service names like synapse, postgres, redis are bare hostnames (no dots) that resolve to internal container IPs
  • These hostnames cannot exist on the public internet — they are always internal service names
  • Previously, isPrivateOrLoopbackHost only recognized IP addresses and localhost as private, causing Matrix (and potentially other plugins) to reject http://synapse:8008 in Docker environments
  • This fix recognizes bare hostnames (no dots, not IP addresses) as private hosts, allowing HTTP connections without requiring allowPrivateNetwork: true

Fixes #52054

Test plan

  • Added test: bare hostnames (synapse, postgres, redis, my-matrix-server) are accepted
  • Added test: FQDNs with dots (matrix.example.com) are still rejected
  • All 55 existing net.test.ts tests pass
  • All lint checks pass

🤖 Generated with Claude Code

Changed files

  • src/agents/schema/clean-for-gemini.test.ts (modified, +44/-0)
  • src/agents/schema/clean-for-gemini.ts (modified, +5/-0)
  • src/gateway/net.test.ts (modified, +12/-0)
  • src/gateway/net.ts (modified, +10/-3)
  • src/infra/net/ssrf.ts (modified, +9/-0)

Code Example

2026-03-22T03:30:02.024+00:00 [matrix] [main] starting provider (http://synapse:8008)
2026-03-22T03:30:02.052+00:00 [matrix] [main] channel exited: Matrix homeserver must use https:// unless it targets a private or loopback host

---

2026-03-22T03:34:20.992+00:00 [matrix] [main] starting provider (http://172.29.0.88:8008)
2026-03-22T03:34:21.012+00:00 [matrix] [main] channel exited: Blocked hostname or private/internal/special-use IP address

---
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

On March 22, 2026, an application built using Docker failed to connect to the internal network server address. If the hostname is used, the following error message appears:

2026-03-22T03:30:02.024+00:00 [matrix] [main] starting provider (http://synapse:8008)
2026-03-22T03:30:02.052+00:00 [matrix] [main] channel exited: Matrix homeserver must use https:// unless it targets a private or loopback host

If an internal IP address is used, the following error message will be displayed:

2026-03-22T03:34:20.992+00:00 [matrix] [main] starting provider (http://172.29.0.88:8008)
2026-03-22T03:34:21.012+00:00 [matrix] [main] channel exited: Blocked hostname or private/internal/special-use IP address

Steps to reproduce

As described above

Expected behavior

I hope to be able to access the hostname and internal IP address normally.

Actual behavior

As described above

OpenClaw version

2026.3.14

Operating system

Ubuntu 24.04

Install method

docker

Model

minimax

Provider / routing chain

minimax

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

On March 22, 2026, the latest main code was fetched and then deployed using Docker.

extent analysis

Fix Plan

To resolve the issue, we need to update the Docker configuration to allow the container to access the internal network server address using HTTPS.

Here are the steps:

  • Update the docker-compose.yml file to include the https protocol in the URL.
  • Add a self-signed certificate or a trusted certificate to the container.

Example docker-compose.yml update:

version: '3'
services:
  matrix:
    ...
    environment:
      - MATRIX_HOMESERVER_URL=https://synapse:8008

Alternatively, you can use the internal IP address with HTTPS:

version: '3'
services:
  matrix:
    ...
    environment:
      - MATRIX_HOMESERVER_URL=https://172.29.0.88:8008

If you are using a self-signed certificate, you may need to add the --insecure flag to the Docker run command or set the MATRIX_HOMESERVER_VERIFY_SSL environment variable to false.

Verification

To verify that the fix worked, restart the Docker container and check the logs for any errors. You can also use a tool like curl to test the connection:

curl -k https://synapse:8008

or

curl -k https://172.29.0.88:8008

If the connection is successful, you should see a response from the server.

Extra Tips

  • Make sure to update the docker-compose.yml file correctly and restart the container after making changes.
  • If you are using a self-signed certificate, be aware of the security implications and consider using a trusted certificate instead.
  • You can also use a reverse proxy like NGINX to handle the HTTPS connection and forward requests to the internal server.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

I hope to be able to access the hostname and internal IP address normally.

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING