Fix incorrect port mapping in docker-compose.yml

[Kuan-Lun]

The port mapping for the Synapse service was incorrectly set to 8448:8448/tcp. This has been corrected to 8448:8008/tcp to match the Traefik configuration, which specifies the backend service port as 8008 using the traefik.http.services.synapse.loadbalancer.server.port.

[CLAassistant]

All committers have signed the CLA.

[anoadragon453]

This came up previously in #17702, and I did some investigation in #17702 (comment).

My conclusion was that directly exposing 8008 would not work as that port won't terminate TLS, whereas remote homeservers sending federation traffic to 8448 would wrap the request in TLS. So I don't believe this would work (unless you put a reverse proxy in front, but the second example does that).

This change is a step in the right direction (Synapse isn't actually listening on port 8448), but I think you'll still fail to federate.

@Kuan-Lun have you had this change working in your setup?

[Kuan-Lun]

Thank you for your response.

To address your question, I have tested this change in my setup with a reverse proxy (Traefik) configured to handle TLS termination. The connection to port 8008 works as expected, and federation is successful under this setup. This aligns with the README for Docker, which recommends using a reverse proxy for TLS support, and the section on Testing a new installation, which states that TLS configuration is required unless running on a local machine.

Additionally, the configuration in line 47 of docker-compose.yml specifies the Host, which implies that users are expected to use a reverse proxy to access port 8008. The Volumes for Docker section does not mention where to place CA files, further supporting this assumption.

I believe this change improves consistency with the Traefik configuration, but I’m happy to adjust if there are other considerations. Let me know your thoughts!