···3030 enableACME = true;
3131 locations."/_matrix" = {
3232 proxyPass = "http://[::1]:8008";
3333+ # Without this Synapse sees every client as ::1, because
3434+ # `x_forwarded = true` falls back to the peer address when no
3535+ # X-Forwarded-For arrives. rc_login.address then becomes a single
3636+ # global bucket: one person mistyping a password five times locks
3737+ # out login for everyone, bridges included.
3838+ recommendedProxySettings = true;
3339 };
3440 };
3541 };