matrix: Only expose the IRC appservice to 127.0.0.1

roles/matrix/files/matrix-appservice-irc.service

@@ -8,8 +8,7 @@ User=synapse
 WorkingDirectory=/var/lib/synapse/matrix-appservice-irc
 ExecStart=/usr/bin/node app.js \
   -c /etc/synapse/irc-bridge.yaml \
-  -f /etc/synapse/appservice-registration-irc.yaml \
-  -p 8499
+  -f /etc/synapse/appservice-registration-irc.yaml
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 
 [Install]

roles/matrix/templates/irc-bridge.yaml.j2

@@ -34,11 +34,11 @@ homeserver:
 
   # Which port should the appservice bind to. Takes priority over the one provided in the
   # command line! Optional.
-  # bindPort: 9999
+  bindPort: 8499
 
   # Use this option to force the appservice to listen on another hostname for transactions.
   # This is NOT your synapse hostname. E.g. use 127.0.0.1 to only listen locally. Optional.
-  # bindHostname: 0.0.0.0
+  bindHostname: 127.0.0.1
 
 # Configuration specific to the IRC service
 ircService: