88806d12fb
- Caddy admin API: bind to localhost:2019 instead of 0.0.0.0:2019 (local + production) - Production Caddyfile: block /_synapse/admin* with 403 (not needed publicly) - homeserver.yaml: explicitly set allow_public_rooms_without_auth/over_federation to false Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>