But how to configure an identity server as identity store? I thought that's what

forward:
  servers:
    - 'matrix-org'

is for. But somehow it doesn't work. In the mxisd log I see no indicator that matrix.org is accessed.

The reason why it didn't work is that using

          proxy_pass http://localhost:8008/_matrix;
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $remote_addr;

I ran into synapse issue #4858. Using

          proxy_pass http://localhost:8008;
          proxy_set_header X-Forwarded-For $remote_addr;

instead fixed it for me. I don't know why though. Is this possibly something that has to be changed in the mxisd doc, for example here?

location /_matrix/identity/api/v1/unbind {
		return 404;
	}

is no longer the correct endpoint but is still documented as such in the mxisd wiki.

The workaround is now

location /_matrix/identity/api/v1/3pid/unbind {
		return 404;
	}