Reverse-proxy configuration problem: _synapse is also neccesary

[OmmyZhang]

Not only _matrix but _synapse is also used. (for oidc login)
I suggest to use location /_ { in examples.

[ser]

I really do not understand why reverse proxy documentation does not include _synapse/.

Are there any security reasons?

[richvdh]

One reason not to include /_synapse/ in these lists is to avoid exposing the admin apis by default.

Having discussed this, we should:

• have oidc use a path under /_synapse/client
• document that /_synapse/client should be forwarded by the reverse-proxy
• we can also mention that /_synapse/admin may optionally be forwarded.

[clokep]

One reason not to include /_synapse/ in these lists is to avoid exposing the admin apis by default.

Having discussed this, we should:

* have oidc use a path under `/_synapse/client`

* document that `/_synapse/client` should be forwarded by the reverse-proxy

* we can also mention that `/_synapse/admin` may optionally be forwarded.

@anoadragon453 It looks like #8227 only did the documentation piece. Did the OIDC path need to be moved?

[anoadragon453]

@clokep Yes it does, though I'm not sure if this issue is the best place to continue tracking it. I can open a new issue specifically for that.