![](/static/66c60d9f/assets/icons/icon-96x96.png)
![](https://lemmy.world/pictrs/image/8286e071-7449-4413-a084-1eb5242e2cf4.png)
Not git(ea) but Synapse: I use separate Traefik routers for internal and external endpoints. Internal has access to all paths but for external entry points I allow or deny list paths as needed. It’s error prone as it can either break the app if not everything required is allowlisted, or cause a security issue if not everything is deny listed.
This sounds about half of the way to Nostr. User identity is separate from posting. Communities (relays) host the content and can have the own policies for who can interact.