#synapse — Public Fediverse posts on home.social

Björns Techblog @[email protected] · 2026-07-31 · 11:42 UTC

Run your own Synapse server including Element Call and Element Web

https://blog.sengotta.net/run-your-own-synapse-server-including-element-call-and-element-web/

Once again, this is mainly a post for myself, so that I do not forget everything the next time I have to set up a Matrix server. This time it is about Synapse, the reference server for the Matrix protocol.

If you have found this page, you probably already know what Synapse and the Matrix protocol are. Besides normal textchat, it can also handle voice and video calls and many other things. The Matrix protocol is very powerful. Unfortunately, this also makes it very complicated. As a result, there are still not many serious alternatives to Synapse or the Element clients if you want to use the full feature set.

So why am I spending time on this? In everyday life I mainly use Signal. In my opinion it is an excellent service, although some people will probably disagree immediately. However, it is a centralised service, it depends on a mobile phone number, it is within Donald Trump’s jurisdiction, and if the planned chat control ever becomes reality, Signal has already said that they might leave the European market.

For me, my own Synapse server is therefore a kind of emergency plan for communication. It is also very useful for smart home notifications, privacy-related applications and similar things. Matrix is designed to be decentralised, so it is a bit unfortunate that so many users have made matrix.org their permanent home.

Setting up a Synapse server, including the backend for Element Call, is unfortunately not straightforward. That is why I decided to collect everything in one place. This is not a step-by-step tutorial explaining every single line. At some point you still have to think for yourself. The guide is also based on my own setup, namely Docker with a native nginx reverse proxy. Your setup may be different, but perhaps this can still serve as a useful reference. I had to collect the required information from many different sources myself. Therefore, I will include all relevant configuration files so that you can compare them with your own.

Originally I wanted to upload the files to Codeberg, but apparently the service is currently having some problems.

At the end, you should have a working Synapse server including Element Web and Element Call.

Requirements:

Internet facing Linux server with docker, docker compose and nginx. If you use a firewall dont forget to confgigure it correctly
Two Domains i use matrix.example.eu and matrixrtc.example.eu, you have to replace them on any accurance
TLS Certs for both domains

Folder structure

The first step is to create a suitable folder structure. In my case, every container together with its configuration files has its own directory below /opt. For my Matrix server it looks like this.

opt
└── matrix
    ├── elementweb
    ├── livekit
    ├── postgres
    ├── synapse
    └── docker-compose.yaml

You do not need to create the docker-compose.yaml file yet.

Generate homeserver.yaml

Once the directory structure is ready, let Synapse generate the initial homeserver.yaml together with all required keys and secrets. You can do this with the following command. Afterwards you will find the generated homeserver.yaml inside the synapse directory. If your directory layout is different, simply adjust the command accordingly.

docker run -it --rm \
  -v /opt/matrix/synapse:/data \
  -e SYNAPSE_SERVER_NAME=matrix.example.eu \
  -e SYNAPSE_REPORT_STATS=no \
  matrixdotorg/synapse:latest generate

Editing homeserver.yaml

Now open the generated homeserver.yaml and apply the changes shown in my example. Please do not simply copy and paste everything, otherwise your own keys and secrets will be overwritten. Go through the file line by line. If you are unsure about a setting, have a look at the Synapse documentation. As already mentioned, you still have to think for yourself from time to time. Also make sure to choose a proper password for the PostgreSQL database. You will need exactly the same password later in your Docker Compose configuration.

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
server_name: "matrix.example.eu"
pid_file: /data/homeserver.pid
listeners:
  - port: 8008
    resources:
    - compress: false
      names:
      - client
      - federation
    tls: false
    type: http
    x_forwarded: true
database:
  name: psycopg2
  args:
    user: synapse
    password: mySuperSecretPassword
    database: synapse
    host: db
    port: 5432
    cp_min: 5
    cp_max: 10
log_config: "/data/matrix.example.eu.log.config"
media_store_path: /data/media_store
max_upload_size: 50M
enable_registration: false
enable_registration_without_verification: false
registration_shared_secret: "AutoGenerated"
# Retention policy
retention:
  enabled: true
  default_policy:
    min_lifetime: 1d
    max_lifetime: 365d
url_preview_enabled: true
url_preview_ip_range_blacklist:
  - '127.0.0.0/8'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'
report_stats: false
macaroon_secret_key: "AutoGenerated"
form_secret: "AutoGenerated"
signing_key_path: "/data/matrix.example.eu.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"
experimental_features:
  # MSC3266: Room summary API. Used for knocking over federation
  msc3266_enabled: true
  # MSC4222: needed for syncv2 state_after. This allows clients to
  # correctly track the state of the room.
  msc4222_enabled: true
  # MSC4140: Delayed events are required for proper call participation signalling. If disabled it is very likely that you end up with stuck calls in Matrix rooms
  msc4140_enabled: true

# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h

rc_message:
  # This needs to match at least e2ee key sharing frequency plus a bit of headroom
  # Note key sharing events are bursty
  per_second: 0.5
  burst_count: 30
  # This needs to match at least the heart-beat frequency plus a bit of headroom
  # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
rc_delayed_event_mgmt:
  per_second: 1
  burst_count: 20

Edit docker-compose.yaml

Next, create the docker-compose.yaml file. The file is already commented, so it should be reasonably clear which values need to be changed. The most important ones are the database password as well as the key and secret for LiveKit. The comments also explain how to generate these values.

services:
  synapse:
    image: matrixdotorg/synapse:latest
    container_name: synapse
    restart: unless-stopped
    volumes:
      - ./synapse:/data
    ports:
      - "127.0.0.1:8008:8008"   # Bind to loopback
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    container_name: synapse-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: CHANGEME #also in synapse/homeserver.yaml
      POSTGRES_DB: synapse
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    volumes:
      - ./postgres:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"

  auth-service:
    image: ghcr.io/element-hq/lk-jwt-service:latest
    container_name: element-call-jwt
    hostname: auth-server
    environment:
      - LIVEKIT_JWT_PORT=8080
      - LIVEKIT_URL=https://matrixrtc.example.eu/livekit/sfu #CHANGEME
      - LIVEKIT_KEY=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_SECRET=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.example.eu
    restart: unless-stopped
    ports:
      - 127.0.0.1:8070:8080 #Change 8070 to whichever port you want JWT to be available on locally

  livekit:
    image: livekit/livekit-server:latest
    container_name: element-call-livekit
    command: --config /etc/livekit.yaml
    ports:
      - 127.0.0.1:7880:7880/tcp
      - 7881:7881/tcp
      - 50100-50200:50100-50200/udp
    restart: unless-stopped
    volumes:
      - ./livekit/config.yaml:/etc/livekit.yaml:ro

  element-web:
    image: vectorim/element-web:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8009:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost:80/version || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    volumes:
      - ./element-web/config.json:/app/config.json
    depends_on:
      - synapse

Livekit configuration

The next file to edit is config.yaml inside the livekit directory. Here you mainly have to adjust the external IP address of your server and insert the LiveKit key and secret you generated before. By the way, I recently came across an interesting article (https://sspaeth.de/2026/04/matrix-voip-and-livekit/) explaining that, in most cases, you will not need a TURN server at all—neither the one built into LiveKit nor a separate CoTURN installation. One less service to maintain is rarely a bad thing.

port: 7880
bind_addresses:
  - "0.0.0.0"
rtc:
  tcp_port: 7881
  port_range_start: 50100
  port_range_end: 50200
  use_external_ip: true
  node_ip: Externe IP eures Servers
room:
  auto_create: false
logging:
  level: info
turn:
  enabled: false
  domain: localhost
  cert_file: ""
  key_file: ""
  tls_port: 5349
  udp_port: 443
  external_tls: true
keys:
  LIVEKIT_KEY: LIVEKIT_SECRET # Values from your docker compose, mind the space!

Element Web configuration

The last configuration file is the JSON configuration for Element Web, assuming you want to use it. Once again, you mainly need to adjust the URLs and a few other values so that they match your own setup.

{
    "default_server_config": {
        "m.homeserver": {
            "base_url": "https://matrix.example.eu",
            "server_name": "matrix.example.eu"
        },
        "m.identity_server": {
            "base_url": "https://vector.im"
        }
    },
    "disable_custom_urls": false,
    "disable_guests": false,
    "disable_login_language_selector": false,
    "disable_3pid_login": false,
    "force_verification": false,
    "brand": "Element",
    "default_widget_container_height": 280,
    "default_country_code": "DE",
    "show_labs_settings": false,
    "features": {
        "feature_video_rooms": true,
        "feature_group_calls": true,
        "feature_element_call_video_rooms": true,
        "feature_oidc_native_flow": true
    },
    "default_federate": true,
    "default_theme": "light",
    "room_directory": {
        "servers": ["https://matrix.example.eu"]
    },
    "setting_defaults": {
        "breadcrumbs": true
    },
    "element_call": {
        "url": "https://matrixrtc.example.eu"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
}

Nginx configuration

To make your Synapse server reachable from the Internet and allow federation with other Matrix servers, you also need a suitable reverse proxy. In my case this is nginx. You can use the following configuration as a starting point. Of course, you have to replace the domain names and the paths to your TLS certificates with your own values.

# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrix.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;


    client_max_body_size 50M;

    # Well-known for Client Configuration
    location /.well-known/matrix/client {
        return 200 '{"m.homeserver": {"base_url": "https://matrix.example.eu"}, "m.identity_server": {"base_url": "https://vector.im"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrixrtc.example.eu/livekit/jwt"}]}';
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, OPTIONS';
    }

    # Well-known for federation
    location /.well-known/matrix/server {
        return 200 '{"m.server":"matrix.example.eu:8448"}';
        default_type application/json;
    }

    location / {
        proxy_pass http://localhost:8009;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    # Forward to dockerized Synapse
    location ~* ^(\/_matrix|\/_synapse\/client) {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;

        proxy_read_timeout    600;
        proxy_connect_timeout 600;
        proxy_send_timeout    600;
    }
}

# Federation Port 8448
server {
    listen 8448 ssl http2;
    listen [::]:8448 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    client_max_body_size 50M;


    location / {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;
    }
}
# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrixrtc.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrixrtc.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrixrtc.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrixrtc.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

location ^~ /livekit/jwt/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # MatrixRTC Authorization Service running at port 8080
      proxy_pass http://localhost:8070/;
    }

    location ^~ /livekit/sfu/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_send_timeout 120;
      proxy_read_timeout 120;
      proxy_buffering off;

      proxy_set_header Accept-Encoding gzip;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";


      # LiveKit SFU websocket connection running at port 7880
      proxy_pass http://localhost:7880/;
    }
}

After that, create the appropriate symbolic link so that nginx knows about the new configuration and reload the service. Danach konnt Ihr wieder in den Ordner /opt/matrix wechseln und den Synapse Server starten:

Start Synapse Server

Once this is done, change back to your /opt/matrix directory and start the Synapse server.

docker compose up

For the first start I deliberately left out the detached mode. This way you can watch the log output and also see when the database initialisation has finished.

Creating users

Since registration is disabled, you have to create users from the command line. The first user can also be made an administrator straight away. For any additional users, simply replace –admin with –no-admin.

docker exec -it synapse register_new_matrix_user \
  http://localhost:8008 \
  -c /data/homeserver.yaml \
  -u meinErsterUser \
  -p SuperSicheresPasswort \
  --admin

At this point your own Synapse server should be running and should also be able to federate with other Matrix servers. If you notice mistakes in the configuration or have constructive suggestions, feel free to leave a comment. Setting up a complete Matrix environment is quite complex, and there is no single guide that works perfectly for every setup (and this one isnt it either).

Still, I hope this article encourages some people to set up their own Matrix server. Every additional independent server makes the Matrix ecosystem a little more resilient, and that can only be a good thing.

#element #linux #livekit #matrix #opensource #selfhosting #synapse #unplugbigtech #unplugtrump @bjoern

#element #linux #livekit #matrix #opensource #selfhosting

Björns Techblog @[email protected] · 2026-07-31 · 11:42 UTC

Run your own Synapse server including Element Call and Element Web

https://blog.sengotta.net/run-your-own-synapse-server-including-element-call-and-element-web/

Once again, this is mainly a post for myself, so that I do not forget everything the next time I have to set up a Matrix server. This time it is about Synapse, the reference server for the Matrix protocol.

If you have found this page, you probably already know what Synapse and the Matrix protocol are. Besides normal textchat, it can also handle voice and video calls and many other things. The Matrix protocol is very powerful. Unfortunately, this also makes it very complicated. As a result, there are still not many serious alternatives to Synapse or the Element clients if you want to use the full feature set.

So why am I spending time on this? In everyday life I mainly use Signal. In my opinion it is an excellent service, although some people will probably disagree immediately. However, it is a centralised service, it depends on a mobile phone number, it is within Donald Trump’s jurisdiction, and if the planned chat control ever becomes reality, Signal has already said that they might leave the European market.

For me, my own Synapse server is therefore a kind of emergency plan for communication. It is also very useful for smart home notifications, privacy-related applications and similar things. Matrix is designed to be decentralised, so it is a bit unfortunate that so many users have made matrix.org their permanent home.

Setting up a Synapse server, including the backend for Element Call, is unfortunately not straightforward. That is why I decided to collect everything in one place. This is not a step-by-step tutorial explaining every single line. At some point you still have to think for yourself. The guide is also based on my own setup, namely Docker with a native nginx reverse proxy. Your setup may be different, but perhaps this can still serve as a useful reference. I had to collect the required information from many different sources myself. Therefore, I will include all relevant configuration files so that you can compare them with your own.

Originally I wanted to upload the files to Codeberg, but apparently the service is currently having some problems.

At the end, you should have a working Synapse server including Element Web and Element Call.

Requirements:

Internet facing Linux server with docker, docker compose and nginx. If you use a firewall dont forget to confgigure it correctly
Two Domains i use matrix.example.eu and matrixrtc.example.eu, you have to replace them on any accurance
TLS Certs for both domains

Folder structure

The first step is to create a suitable folder structure. In my case, every container together with its configuration files has its own directory below /opt. For my Matrix server it looks like this.

opt
└── matrix
    ├── elementweb
    ├── livekit
    ├── postgres
    ├── synapse
    └── docker-compose.yaml

You do not need to create the docker-compose.yaml file yet.

Generate homeserver.yaml

Once the directory structure is ready, let Synapse generate the initial homeserver.yaml together with all required keys and secrets. You can do this with the following command. Afterwards you will find the generated homeserver.yaml inside the synapse directory. If your directory layout is different, simply adjust the command accordingly.

docker run -it --rm \
  -v /opt/matrix/synapse:/data \
  -e SYNAPSE_SERVER_NAME=matrix.example.eu \
  -e SYNAPSE_REPORT_STATS=no \
  matrixdotorg/synapse:latest generate

Editing homeserver.yaml

Now open the generated homeserver.yaml and apply the changes shown in my example. Please do not simply copy and paste everything, otherwise your own keys and secrets will be overwritten. Go through the file line by line. If you are unsure about a setting, have a look at the Synapse documentation. As already mentioned, you still have to think for yourself from time to time. Also make sure to choose a proper password for the PostgreSQL database. You will need exactly the same password later in your Docker Compose configuration.

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
server_name: "matrix.example.eu"
pid_file: /data/homeserver.pid
listeners:
  - port: 8008
    resources:
    - compress: false
      names:
      - client
      - federation
    tls: false
    type: http
    x_forwarded: true
database:
  name: psycopg2
  args:
    user: synapse
    password: mySuperSecretPassword
    database: synapse
    host: db
    port: 5432
    cp_min: 5
    cp_max: 10
log_config: "/data/matrix.example.eu.log.config"
media_store_path: /data/media_store
max_upload_size: 50M
enable_registration: false
enable_registration_without_verification: false
registration_shared_secret: "AutoGenerated"
# Retention policy
retention:
  enabled: true
  default_policy:
    min_lifetime: 1d
    max_lifetime: 365d
url_preview_enabled: true
url_preview_ip_range_blacklist:
  - '127.0.0.0/8'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'
report_stats: false
macaroon_secret_key: "AutoGenerated"
form_secret: "AutoGenerated"
signing_key_path: "/data/matrix.example.eu.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"
experimental_features:
  # MSC3266: Room summary API. Used for knocking over federation
  msc3266_enabled: true
  # MSC4222: needed for syncv2 state_after. This allows clients to
  # correctly track the state of the room.
  msc4222_enabled: true
  # MSC4140: Delayed events are required for proper call participation signalling. If disabled it is very likely that you end up with stuck calls in Matrix rooms
  msc4140_enabled: true

# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h

rc_message:
  # This needs to match at least e2ee key sharing frequency plus a bit of headroom
  # Note key sharing events are bursty
  per_second: 0.5
  burst_count: 30
  # This needs to match at least the heart-beat frequency plus a bit of headroom
  # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
rc_delayed_event_mgmt:
  per_second: 1
  burst_count: 20

Edit docker-compose.yaml

Next, create the docker-compose.yaml file. The file is already commented, so it should be reasonably clear which values need to be changed. The most important ones are the database password as well as the key and secret for LiveKit. The comments also explain how to generate these values.

services:
  synapse:
    image: matrixdotorg/synapse:latest
    container_name: synapse
    restart: unless-stopped
    volumes:
      - ./synapse:/data
    ports:
      - "127.0.0.1:8008:8008"   # Bind to loopback
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    container_name: synapse-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: CHANGEME #also in synapse/homeserver.yaml
      POSTGRES_DB: synapse
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    volumes:
      - ./postgres:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"

  auth-service:
    image: ghcr.io/element-hq/lk-jwt-service:latest
    container_name: element-call-jwt
    hostname: auth-server
    environment:
      - LIVEKIT_JWT_PORT=8080
      - LIVEKIT_URL=https://matrixrtc.example.eu/livekit/sfu #CHANGEME
      - LIVEKIT_KEY=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_SECRET=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.example.eu
    restart: unless-stopped
    ports:
      - 127.0.0.1:8070:8080 #Change 8070 to whichever port you want JWT to be available on locally

  livekit:
    image: livekit/livekit-server:latest
    container_name: element-call-livekit
    command: --config /etc/livekit.yaml
    ports:
      - 127.0.0.1:7880:7880/tcp
      - 7881:7881/tcp
      - 50100-50200:50100-50200/udp
    restart: unless-stopped
    volumes:
      - ./livekit/config.yaml:/etc/livekit.yaml:ro

  element-web:
    image: vectorim/element-web:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8009:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost:80/version || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    volumes:
      - ./element-web/config.json:/app/config.json
    depends_on:
      - synapse

Livekit configuration

The next file to edit is config.yaml inside the livekit directory. Here you mainly have to adjust the external IP address of your server and insert the LiveKit key and secret you generated before. By the way, I recently came across an interesting article (https://sspaeth.de/2026/04/matrix-voip-and-livekit/) explaining that, in most cases, you will not need a TURN server at all—neither the one built into LiveKit nor a separate CoTURN installation. One less service to maintain is rarely a bad thing.

port: 7880
bind_addresses:
  - "0.0.0.0"
rtc:
  tcp_port: 7881
  port_range_start: 50100
  port_range_end: 50200
  use_external_ip: true
  node_ip: Externe IP eures Servers
room:
  auto_create: false
logging:
  level: info
turn:
  enabled: false
  domain: localhost
  cert_file: ""
  key_file: ""
  tls_port: 5349
  udp_port: 443
  external_tls: true
keys:
  LIVEKIT_KEY: LIVEKIT_SECRET # Values from your docker compose, mind the space!

Element Web configuration

The last configuration file is the JSON configuration for Element Web, assuming you want to use it. Once again, you mainly need to adjust the URLs and a few other values so that they match your own setup.

{
    "default_server_config": {
        "m.homeserver": {
            "base_url": "https://matrix.example.eu",
            "server_name": "matrix.example.eu"
        },
        "m.identity_server": {
            "base_url": "https://vector.im"
        }
    },
    "disable_custom_urls": false,
    "disable_guests": false,
    "disable_login_language_selector": false,
    "disable_3pid_login": false,
    "force_verification": false,
    "brand": "Element",
    "default_widget_container_height": 280,
    "default_country_code": "DE",
    "show_labs_settings": false,
    "features": {
        "feature_video_rooms": true,
        "feature_group_calls": true,
        "feature_element_call_video_rooms": true,
        "feature_oidc_native_flow": true
    },
    "default_federate": true,
    "default_theme": "light",
    "room_directory": {
        "servers": ["https://matrix.example.eu"]
    },
    "setting_defaults": {
        "breadcrumbs": true
    },
    "element_call": {
        "url": "https://matrixrtc.example.eu"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
}

Nginx configuration

To make your Synapse server reachable from the Internet and allow federation with other Matrix servers, you also need a suitable reverse proxy. In my case this is nginx. You can use the following configuration as a starting point. Of course, you have to replace the domain names and the paths to your TLS certificates with your own values.

# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrix.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;


    client_max_body_size 50M;

    # Well-known for Client Configuration
    location /.well-known/matrix/client {
        return 200 '{"m.homeserver": {"base_url": "https://matrix.example.eu"}, "m.identity_server": {"base_url": "https://vector.im"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrixrtc.example.eu/livekit/jwt"}]}';
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, OPTIONS';
    }

    # Well-known for federation
    location /.well-known/matrix/server {
        return 200 '{"m.server":"matrix.example.eu:8448"}';
        default_type application/json;
    }

    location / {
        proxy_pass http://localhost:8009;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    # Forward to dockerized Synapse
    location ~* ^(\/_matrix|\/_synapse\/client) {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;

        proxy_read_timeout    600;
        proxy_connect_timeout 600;
        proxy_send_timeout    600;
    }
}

# Federation Port 8448
server {
    listen 8448 ssl http2;
    listen [::]:8448 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    client_max_body_size 50M;


    location / {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;
    }
}
# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrixrtc.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrixrtc.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrixrtc.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrixrtc.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

location ^~ /livekit/jwt/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # MatrixRTC Authorization Service running at port 8080
      proxy_pass http://localhost:8070/;
    }

    location ^~ /livekit/sfu/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_send_timeout 120;
      proxy_read_timeout 120;
      proxy_buffering off;

      proxy_set_header Accept-Encoding gzip;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";


      # LiveKit SFU websocket connection running at port 7880
      proxy_pass http://localhost:7880/;
    }
}

After that, create the appropriate symbolic link so that nginx knows about the new configuration and reload the service. Danach konnt Ihr wieder in den Ordner /opt/matrix wechseln und den Synapse Server starten:

Start Synapse Server

Once this is done, change back to your /opt/matrix directory and start the Synapse server.

docker compose up

For the first start I deliberately left out the detached mode. This way you can watch the log output and also see when the database initialisation has finished.

Creating users

Since registration is disabled, you have to create users from the command line. The first user can also be made an administrator straight away. For any additional users, simply replace –admin with –no-admin.

docker exec -it synapse register_new_matrix_user \
  http://localhost:8008 \
  -c /data/homeserver.yaml \
  -u meinErsterUser \
  -p SuperSicheresPasswort \
  --admin

At this point your own Synapse server should be running and should also be able to federate with other Matrix servers. If you notice mistakes in the configuration or have constructive suggestions, feel free to leave a comment. Setting up a complete Matrix environment is quite complex, and there is no single guide that works perfectly for every setup (and this one isnt it either).

Still, I hope this article encourages some people to set up their own Matrix server. Every additional independent server makes the Matrix ecosystem a little more resilient, and that can only be a good thing.

#element #linux #livekit #matrix #opensource #selfhosting #synapse #unplugbigtech #unplugtrump @bjoern

#element #linux #livekit #matrix #opensource #selfhosting

Björns Techblog @[email protected] · 2026-07-31 · 11:03 UTC

Eigenen Synapse Server für das Matrix Protokoll betreiben inklusive Element Call

https://blog.sengotta.net/eigenen-synapse-server-fuer-das-matrix-protokoll-betreiben-inklusive-element-call/

Mal wieder ein Beitrag der vor allem mir als Gedankenstütze dienen soll. Und zwar geht es diesmal um Synapse, dem Referenzserver für das Matrix Protokoll.

Wer hier gelandet ist wird sicher schon wissen was Synapse bzw. das Matrix Protokoll ist. Über diesen Server kann man vor allem chatten aber auch Video- und Audioanrufe abwickeln und noch vieles mehr. Das Matrix Protokoll ist extrem mächtig. Das ist nicht immer ein Vorteil, denn es zu implementieren ist somit auch extrem schwer. Das führt auch dazu das es bisher eigentlich kaum eine ernst zunehmende Alternative zu Synapse oder den Element Clients gibt wenn man den vollen Funktionsumfang nutzen möchte.

Aber warum mach ich mir die Arbeit. Naja im Alltag nutze ich überwiegend Signal, was meiner Meinung nach ein super Dienst ist, auch wenn hier manche Leute jetzt wieder Schnappatmung kriegen. Aber dieser Dienst ist halt zentralisiert, an eine Mobilfunknummer gebunden, liegt im Machtbereich von Donald Trump und falls die Chatkontrolle kommt dann hat man auch schon angedroht sich aus dem europäischen Markt zurück zu ziehen.

Mein eigener Synapse Server ist also mein Plan B in Sachen Kommunikation, ausserdem ist so eine Chatplattform auch ganz praktisch in Bezug auf Smarthome Benachrichtigungen, Datenschutz und Co. Des Weiteren ist Matrix als dezentrales System gedacht, von daher ist es geradezu traurig bis gefährlich wie viele User dieses Ökosystems Ihr Zuhause auf der Hauptinstanz matrix.org haben.

Leider ist das Setup eines Synapse Servers inkl. dem Backend für Element Call nicht trivial, deswegen habe ich das hier mal zusammengefasst. Aber nein das hier ist jetzt keine Anleitung wo ich jedes Fitzelchen kommentiere etc. Teilweise muss man auch das eigene Hirn noch einschalten. Ausserdem ist das ganze an mein spezifisches Setup (Docker mit nativ installiertem nginx als reverse Proxy) angepasst. So oder so ist es ggf. eine Inspiration für euer eigenes Setup. Auch ich musste mir die Infos an etlichen Stellen zusammensuchen. Ich werde hier die einzelnen Config Dateien in den Beitrag einbetten so das Ihr nachschauen könnt was Ihr ändern müsst.

Eigentlich wollte ich Sie auf Codeberg laden aber der Dienst kämpft wohl gerade mit Problemen.

Am Ende solltet Ihr einen Synapse Server inkl. Element Web und Element Call am laufen haben.

Vorraussetzungen:

ein aus dem Internet erreichbarer Linux Server mit Docker, Docker compose und nginx. Falls Ihr eine Firewall einsetzt denkt daran diese entsprechend einzurichten und die notwendigen Ports freizugeben
Zwei Domains, ich nutze im Beispiel matrix.example.eu und matrixrtc.example.eu, diese müsste Ihr natürlich überall wo Sie vorkommen ersetzen
TLS Zertifikate für die beiden Domains

Ordnerstruktur:

Legt euch zuerst eine passende Ordnerstruktur an. Bei mir liegen die einzelnen Containerdefinitionen und Ihre Config Dateien in eigenen Ordnern unter /opt. Für meinen Matrix Server sieht das dann so aus:

opt
└── matrix
    ├── elementweb
    ├── livekit
    ├── postgres
    ├── synapse
    └── docker-compose.yaml

Die docker-compose.yaml müsst ihr jetzt noch nicht erstellen.

Homeserver.yaml generieren:

Haben wir die Ordnerstruktur angelegt lassen wir uns von Synapse eine homeserver.yaml inkl. Keys, Secrets etc erstellen. Das macht Ihr mit folgendem Befehl, die homeserver.yaml findet Ihr danach im Ordner Synapse. Falls Ihr eine andere Ordnerstruktur habt müsst ihr das natürlich anpassen.

docker run -it --rm \
  -v /opt/matrix/synapse:/data \
  -e SYNAPSE_SERVER_NAME=matrix.example.eu \
  -e SYNAPSE_REPORT_STATS=no \
  matrixdotorg/synapse:latest generate

Homeserver.yaml bearbeiten:

Jetzt schaut Ihr euch die homeserver.yaml an und führt die Änderungen durch die Ihr ein meinem Beispiel seht. Bitte nicht einfach Copy und Paste machen, dann sind eure Keys und Secrets weg. Schaut euch alle Zeilen an, wenn Ihr euch bei etwas nicht sicher seit dann schaut in die Synapse Doku. Wie gesagt, selber denken ist wichtig. Setzt auf jeden Fall ein sicheres Passwort für die Postgres Datenbank, Ihr werdet es auch in der Docker Compose Datei brauchen.

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
server_name: "matrix.example.eu"
pid_file: /data/homeserver.pid
listeners:
  - port: 8008
    resources:
    - compress: false
      names:
      - client
      - federation
    tls: false
    type: http
    x_forwarded: true
database:
  name: psycopg2
  args:
    user: synapse
    password: mySuperSecretPassword
    database: synapse
    host: db
    port: 5432
    cp_min: 5
    cp_max: 10
log_config: "/data/matrix.example.eu.log.config"
media_store_path: /data/media_store
max_upload_size: 50M
enable_registration: false
enable_registration_without_verification: false
registration_shared_secret: "AutoGenerated"
# Retention policy
retention:
  enabled: true
  default_policy:
    min_lifetime: 1d
    max_lifetime: 365d
url_preview_enabled: true
url_preview_ip_range_blacklist:
  - '127.0.0.0/8'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'
report_stats: false
macaroon_secret_key: "AutoGenerated"
form_secret: "AutoGenerated"
signing_key_path: "/data/matrix.example.eu.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"
experimental_features:
  # MSC3266: Room summary API. Used for knocking over federation
  msc3266_enabled: true
  # MSC4222: needed for syncv2 state_after. This allows clients to
  # correctly track the state of the room.
  msc4222_enabled: true
  # MSC4140: Delayed events are required for proper call participation signalling. If disabled it is very likely that you end up with stuck calls in Matrix rooms
  msc4140_enabled: true

# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h

rc_message:
  # This needs to match at least e2ee key sharing frequency plus a bit of headroom
  # Note key sharing events are bursty
  per_second: 0.5
  burst_count: 30
  # This needs to match at least the heart-beat frequency plus a bit of headroom
  # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
rc_delayed_event_mgmt:
  per_second: 1
  burst_count: 20

Docker Compose bearbeiten:

Als nächstes nehmen wir uns die Docker Compose Datei vor. Auch darin ist eigentlich alles kommentiert was Ihr ändern müsst. Das wichtigeste ist das Datenbank Passwort sowie Key und Secret für Livekit. Wir Ihr diese generiert steht auch in den Kommentaren der Datei.

services:
  synapse:
    image: matrixdotorg/synapse:latest
    container_name: synapse
    restart: unless-stopped
    volumes:
      - ./synapse:/data
    ports:
      - "127.0.0.1:8008:8008"   # Bind to loopback
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    container_name: synapse-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: CHANGEME #also in synapse/homeserver.yaml
      POSTGRES_DB: synapse
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    volumes:
      - ./postgres:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"

  auth-service:
    image: ghcr.io/element-hq/lk-jwt-service:latest
    container_name: element-call-jwt
    hostname: auth-server
    environment:
      - LIVEKIT_JWT_PORT=8080
      - LIVEKIT_URL=https://matrixrtc.example.eu/livekit/sfu #CHANGEME
      - LIVEKIT_KEY=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_SECRET=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.example.eu
    restart: unless-stopped
    ports:
      - 127.0.0.1:8070:8080 #Change 8070 to whichever port you want JWT to be available on locally

  livekit:
    image: livekit/livekit-server:latest
    container_name: element-call-livekit
    command: --config /etc/livekit.yaml
    ports:
      - 127.0.0.1:7880:7880/tcp
      - 7881:7881/tcp
      - 50100-50200:50100-50200/udp
    restart: unless-stopped
    volumes:
      - ./livekit/config.yaml:/etc/livekit.yaml:ro

  element-web:
    image: vectorim/element-web:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8009:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost:80/version || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    volumes:
      - ./element-web/config.json:/app/config.json
    depends_on:
      - synapse

Livekit konfiguration:

Nun ist die config.yaml im Unterordner livekit dran. Hier müsst Ihr eigentlich nur die externe IP eures Server sowie Key und Secret anpassen die Ihr gerade generiert habt. Übrigens wie ich letztens noch gelesen habe (https://sspaeth.de/2026/04/matrix-voip-and-livekit/) werdet ihr in den allermeisten Fällen keinen Turn Server brauchen. Also weder den in Livekit noch sowas wie CoTurn.

port: 7880
bind_addresses:
  - "0.0.0.0"
rtc:
  tcp_port: 7881
  port_range_start: 50100
  port_range_end: 50200
  use_external_ip: true
  node_ip: Externe IP eures Servers
room:
  auto_create: false
logging:
  level: info
turn:
  enabled: false
  domain: localhost
  cert_file: ""
  key_file: ""
  tls_port: 5349
  udp_port: 443
  external_tls: true
keys:
  LIVEKIT_KEY: LIVEKIT_SECRET # Values from your docker compose, mind the space!

Element Web konfiguration:

Die letzte Config Datei, diesmal aber im json Format, die Ihr anpassen müsst ist die für Element Web, falls Ihr das verwenden wollt. Auch hier müsst Ihr vorallem die URL’s anpassen etc.

{
    "default_server_config": {
        "m.homeserver": {
            "base_url": "https://matrix.example.eu",
            "server_name": "matrix.example.eu"
        },
        "m.identity_server": {
            "base_url": "https://vector.im"
        }
    },
    "disable_custom_urls": false,
    "disable_guests": false,
    "disable_login_language_selector": false,
    "disable_3pid_login": false,
    "force_verification": false,
    "brand": "Element",
    "default_widget_container_height": 280,
    "default_country_code": "DE",
    "show_labs_settings": false,
    "features": {
        "feature_video_rooms": true,
        "feature_group_calls": true,
        "feature_element_call_video_rooms": true,
        "feature_oidc_native_flow": true
    },
    "default_federate": true,
    "default_theme": "light",
    "room_directory": {
        "servers": ["https://matrix.example.eu"]
    },
    "setting_defaults": {
        "breadcrumbs": true
    },
    "element_call": {
        "url": "https://matrixrtc.example.eu"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
}

Nginx konfigurieren:

Damit euer Synapse Server von aussen erreichbar ist, föderieren kann etc. müsst Ihr natürlich auch noch einen passenden reverse Proxy, in meinem Fall einen nginx einrichten. Dazu könnt Ihr folgende Config nehmen, natürlich müsst ihr die ganzen Domains sowie die Pfade zu den TLS Zertifikaten anspassen.

# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrix.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;


    client_max_body_size 50M;

    # Well-known for Client Configuration
    location /.well-known/matrix/client {
        return 200 '{"m.homeserver": {"base_url": "https://matrix.example.eu"}, "m.identity_server": {"base_url": "https://vector.im"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrixrtc.example.eu/livekit/jwt"}]}';
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, OPTIONS';
    }

    # Well-known for federation
    location /.well-known/matrix/server {
        return 200 '{"m.server":"matrix.example.eu:8448"}';
        default_type application/json;
    }

    location / {
        proxy_pass http://localhost:8009;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    # Forward to dockerized Synapse
    location ~* ^(\/_matrix|\/_synapse\/client) {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;

        proxy_read_timeout    600;
        proxy_connect_timeout 600;
        proxy_send_timeout    600;
    }
}

# Federation Port 8448
server {
    listen 8448 ssl http2;
    listen [::]:8448 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    client_max_body_size 50M;


    location / {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;
    }
}
# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrixrtc.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrixrtc.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrixrtc.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrixrtc.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

location ^~ /livekit/jwt/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # MatrixRTC Authorization Service running at port 8080
      proxy_pass http://localhost:8070/;
    }

    location ^~ /livekit/sfu/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_send_timeout 120;
      proxy_read_timeout 120;
      proxy_buffering off;

      proxy_set_header Accept-Encoding gzip;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";


      # LiveKit SFU websocket connection running at port 7880
      proxy_pass http://localhost:7880/;
    }
}

Jetzt noch die Config mittels symlink eurem nginx bekant machen und diesen reloaden.

Synapse Server starten:

Danach konnt Ihr wieder in den Ordner /opt/matrix wechseln und den Synapse Server starten:

docker compose up

Ich habe hier das detachen erst einmal weg gelassen, so könnt Ihr die Ausgaben beobachten und wisst auch wann die Datenbankinitialisierung vorbei ist.

Benutzer anlegen:

Nun müsst Ihr natürlich noch User anlegen, da wir die Registrierung deaktiviert haben, machen wir das über die Kommandozeile. Den ersten User machen wir auch gleich zum Admin, bei den anderen Usern tauscht ihr das –admin gegen ein –no-admin.

docker exec -it synapse register_new_matrix_user \
  http://localhost:8008 \
  -c /data/homeserver.yaml \
  -u meinErsterUser \
  -p SuperSicheresPasswort \
  --admin

Nun sollte euer eigener Synapse Server laufen und auch mit anderen Server föderieren können. Falls Ihr konstruktive Anmerkungen habt, eine Fehler in der Config seht etc. dann schreibt einfach einen Kommentar. Wie gesagt das ganze aufzusetzen ist extrem komplex und den einen ultimativen Guide gibt es nicht (und der hier ist es sicher auch nicht).

Aber ich hoffe ich kann auf die Weise den einen oder anderen dazu bewegen sich auch so ein System aufzusetzen und damit dazu beizutragen das Matrix Ökosystem ein bisschen resilienter zu machen.

#element #linux #matrix #opensource #selfhosting #synapse #unplugbigtech #unplugtrump @bjoern

#element #linux #matrix #opensource #selfhosting #synapse

Björns Techblog @[email protected] · 2026-07-31 · 11:03 UTC

Eigenen Synapse Server für das Matrix Protokoll betreiben inklusive Element Call

https://blog.sengotta.net/eigenen-synapse-server-fuer-das-matrix-protokoll-betreiben-inklusive-element-call/

Mal wieder ein Beitrag der vor allem mir als Gedankenstütze dienen soll. Und zwar geht es diesmal um Synapse, dem Referenzserver für das Matrix Protokoll.

Wer hier gelandet ist wird sicher schon wissen was Synapse bzw. das Matrix Protokoll ist. Über diesen Server kann man vor allem chatten aber auch Video- und Audioanrufe abwickeln und noch vieles mehr. Das Matrix Protokoll ist extrem mächtig. Das ist nicht immer ein Vorteil, denn es zu implementieren ist somit auch extrem schwer. Das führt auch dazu das es bisher eigentlich kaum eine ernst zunehmende Alternative zu Synapse oder den Element Clients gibt wenn man den vollen Funktionsumfang nutzen möchte.

Aber warum mach ich mir die Arbeit. Naja im Alltag nutze ich überwiegend Signal, was meiner Meinung nach ein super Dienst ist, auch wenn hier manche Leute jetzt wieder Schnappatmung kriegen. Aber dieser Dienst ist halt zentralisiert, an eine Mobilfunknummer gebunden, liegt im Machtbereich von Donald Trump und falls die Chatkontrolle kommt dann hat man auch schon angedroht sich aus dem europäischen Markt zurück zu ziehen.

Mein eigener Synapse Server ist also mein Plan B in Sachen Kommunikation, ausserdem ist so eine Chatplattform auch ganz praktisch in Bezug auf Smarthome Benachrichtigungen, Datenschutz und Co. Des Weiteren ist Matrix als dezentrales System gedacht, von daher ist es geradezu traurig bis gefährlich wie viele User dieses Ökosystems Ihr Zuhause auf der Hauptinstanz matrix.org haben.

Leider ist das Setup eines Synapse Servers inkl. dem Backend für Element Call nicht trivial, deswegen habe ich das hier mal zusammengefasst. Aber nein das hier ist jetzt keine Anleitung wo ich jedes Fitzelchen kommentiere etc. Teilweise muss man auch das eigene Hirn noch einschalten. Ausserdem ist das ganze an mein spezifisches Setup (Docker mit nativ installiertem nginx als reverse Proxy) angepasst. So oder so ist es ggf. eine Inspiration für euer eigenes Setup. Auch ich musste mir die Infos an etlichen Stellen zusammensuchen. Ich werde hier die einzelnen Config Dateien in den Beitrag einbetten so das Ihr nachschauen könnt was Ihr ändern müsst.

Eigentlich wollte ich Sie auf Codeberg laden aber der Dienst kämpft wohl gerade mit Problemen.

Am Ende solltet Ihr einen Synapse Server inkl. Element Web und Element Call am laufen haben.

Vorraussetzungen:

ein aus dem Internet erreichbarer Linux Server mit Docker, Docker compose und nginx. Falls Ihr eine Firewall einsetzt denkt daran diese entsprechend einzurichten und die notwendigen Ports freizugeben
Zwei Domains, ich nutze im Beispiel matrix.example.eu und matrixrtc.example.eu, diese müsste Ihr natürlich überall wo Sie vorkommen ersetzen
TLS Zertifikate für die beiden Domains

Ordnerstruktur:

Legt euch zuerst eine passende Ordnerstruktur an. Bei mir liegen die einzelnen Containerdefinitionen und Ihre Config Dateien in eigenen Ordnern unter /opt. Für meinen Matrix Server sieht das dann so aus:

opt
└── matrix
    ├── elementweb
    ├── livekit
    ├── postgres
    ├── synapse
    └── docker-compose.yaml

Die docker-compose.yaml müsst ihr jetzt noch nicht erstellen.

Homeserver.yaml generieren:

Haben wir die Ordnerstruktur angelegt lassen wir uns von Synapse eine homeserver.yaml inkl. Keys, Secrets etc erstellen. Das macht Ihr mit folgendem Befehl, die homeserver.yaml findet Ihr danach im Ordner Synapse. Falls Ihr eine andere Ordnerstruktur habt müsst ihr das natürlich anpassen.

docker run -it --rm \
  -v /opt/matrix/synapse:/data \
  -e SYNAPSE_SERVER_NAME=matrix.example.eu \
  -e SYNAPSE_REPORT_STATS=no \
  matrixdotorg/synapse:latest generate

Homeserver.yaml bearbeiten:

Jetzt schaut Ihr euch die homeserver.yaml an und führt die Änderungen durch die Ihr ein meinem Beispiel seht. Bitte nicht einfach Copy und Paste machen, dann sind eure Keys und Secrets weg. Schaut euch alle Zeilen an, wenn Ihr euch bei etwas nicht sicher seit dann schaut in die Synapse Doku. Wie gesagt, selber denken ist wichtig. Setzt auf jeden Fall ein sicheres Passwort für die Postgres Datenbank, Ihr werdet es auch in der Docker Compose Datei brauchen.

# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
server_name: "matrix.example.eu"
pid_file: /data/homeserver.pid
listeners:
  - port: 8008
    resources:
    - compress: false
      names:
      - client
      - federation
    tls: false
    type: http
    x_forwarded: true
database:
  name: psycopg2
  args:
    user: synapse
    password: mySuperSecretPassword
    database: synapse
    host: db
    port: 5432
    cp_min: 5
    cp_max: 10
log_config: "/data/matrix.example.eu.log.config"
media_store_path: /data/media_store
max_upload_size: 50M
enable_registration: false
enable_registration_without_verification: false
registration_shared_secret: "AutoGenerated"
# Retention policy
retention:
  enabled: true
  default_policy:
    min_lifetime: 1d
    max_lifetime: 365d
url_preview_enabled: true
url_preview_ip_range_blacklist:
  - '127.0.0.0/8'
  - '10.0.0.0/8'
  - '172.16.0.0/12'
  - '192.168.0.0/16'
report_stats: false
macaroon_secret_key: "AutoGenerated"
form_secret: "AutoGenerated"
signing_key_path: "/data/matrix.example.eu.signing.key"
trusted_key_servers:
  - server_name: "matrix.org"
experimental_features:
  # MSC3266: Room summary API. Used for knocking over federation
  msc3266_enabled: true
  # MSC4222: needed for syncv2 state_after. This allows clients to
  # correctly track the state of the room.
  msc4222_enabled: true
  # MSC4140: Delayed events are required for proper call participation signalling. If disabled it is very likely that you end up with stuck calls in Matrix rooms
  msc4140_enabled: true

# The maximum allowed duration by which sent events can be delayed, as
# per MSC4140.
max_event_delay_duration: 24h

rc_message:
  # This needs to match at least e2ee key sharing frequency plus a bit of headroom
  # Note key sharing events are bursty
  per_second: 0.5
  burst_count: 30
  # This needs to match at least the heart-beat frequency plus a bit of headroom
  # Currently the heart-beat is every 5 seconds which translates into a rate of 0.2s
rc_delayed_event_mgmt:
  per_second: 1
  burst_count: 20

Docker Compose bearbeiten:

Als nächstes nehmen wir uns die Docker Compose Datei vor. Auch darin ist eigentlich alles kommentiert was Ihr ändern müsst. Das wichtigeste ist das Datenbank Passwort sowie Key und Secret für Livekit. Wir Ihr diese generiert steht auch in den Kommentaren der Datei.

services:
  synapse:
    image: matrixdotorg/synapse:latest
    container_name: synapse
    restart: unless-stopped
    volumes:
      - ./synapse:/data
    ports:
      - "127.0.0.1:8008:8008"   # Bind to loopback
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    container_name: synapse-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: CHANGEME #also in synapse/homeserver.yaml
      POSTGRES_DB: synapse
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    volumes:
      - ./postgres:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"

  auth-service:
    image: ghcr.io/element-hq/lk-jwt-service:latest
    container_name: element-call-jwt
    hostname: auth-server
    environment:
      - LIVEKIT_JWT_PORT=8080
      - LIVEKIT_URL=https://matrixrtc.example.eu/livekit/sfu #CHANGEME
      - LIVEKIT_KEY=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_SECRET=CHANGEME # use tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 64 to generate key / also change in livekit/config.yaml
      - LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.example.eu
    restart: unless-stopped
    ports:
      - 127.0.0.1:8070:8080 #Change 8070 to whichever port you want JWT to be available on locally

  livekit:
    image: livekit/livekit-server:latest
    container_name: element-call-livekit
    command: --config /etc/livekit.yaml
    ports:
      - 127.0.0.1:7880:7880/tcp
      - 7881:7881/tcp
      - 50100-50200:50100-50200/udp
    restart: unless-stopped
    volumes:
      - ./livekit/config.yaml:/etc/livekit.yaml:ro

  element-web:
    image: vectorim/element-web:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8009:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost:80/version || exit 1"]
      start_period: "5s"
      interval: "15s"
      timeout: "5s"
    volumes:
      - ./element-web/config.json:/app/config.json
    depends_on:
      - synapse

Livekit konfiguration:

Nun ist die config.yaml im Unterordner livekit dran. Hier müsst Ihr eigentlich nur die externe IP eures Server sowie Key und Secret anpassen die Ihr gerade generiert habt. Übrigens wie ich letztens noch gelesen habe (https://sspaeth.de/2026/04/matrix-voip-and-livekit/) werdet ihr in den allermeisten Fällen keinen Turn Server brauchen. Also weder den in Livekit noch sowas wie CoTurn.

port: 7880
bind_addresses:
  - "0.0.0.0"
rtc:
  tcp_port: 7881
  port_range_start: 50100
  port_range_end: 50200
  use_external_ip: true
  node_ip: Externe IP eures Servers
room:
  auto_create: false
logging:
  level: info
turn:
  enabled: false
  domain: localhost
  cert_file: ""
  key_file: ""
  tls_port: 5349
  udp_port: 443
  external_tls: true
keys:
  LIVEKIT_KEY: LIVEKIT_SECRET # Values from your docker compose, mind the space!

Element Web konfiguration:

Die letzte Config Datei, diesmal aber im json Format, die Ihr anpassen müsst ist die für Element Web, falls Ihr das verwenden wollt. Auch hier müsst Ihr vorallem die URL’s anpassen etc.

{
    "default_server_config": {
        "m.homeserver": {
            "base_url": "https://matrix.example.eu",
            "server_name": "matrix.example.eu"
        },
        "m.identity_server": {
            "base_url": "https://vector.im"
        }
    },
    "disable_custom_urls": false,
    "disable_guests": false,
    "disable_login_language_selector": false,
    "disable_3pid_login": false,
    "force_verification": false,
    "brand": "Element",
    "default_widget_container_height": 280,
    "default_country_code": "DE",
    "show_labs_settings": false,
    "features": {
        "feature_video_rooms": true,
        "feature_group_calls": true,
        "feature_element_call_video_rooms": true,
        "feature_oidc_native_flow": true
    },
    "default_federate": true,
    "default_theme": "light",
    "room_directory": {
        "servers": ["https://matrix.example.eu"]
    },
    "setting_defaults": {
        "breadcrumbs": true
    },
    "element_call": {
        "url": "https://matrixrtc.example.eu"
    },
    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
}

Nginx konfigurieren:

Damit euer Synapse Server von aussen erreichbar ist, föderieren kann etc. müsst Ihr natürlich auch noch einen passenden reverse Proxy, in meinem Fall einen nginx einrichten. Dazu könnt Ihr folgende Config nehmen, natürlich müsst ihr die ganzen Domains sowie die Pfade zu den TLS Zertifikaten anspassen.

# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrix.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;


    client_max_body_size 50M;

    # Well-known for Client Configuration
    location /.well-known/matrix/client {
        return 200 '{"m.homeserver": {"base_url": "https://matrix.example.eu"}, "m.identity_server": {"base_url": "https://vector.im"}, "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://matrixrtc.example.eu/livekit/jwt"}]}';
        default_type application/json;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, OPTIONS';
    }

    # Well-known for federation
    location /.well-known/matrix/server {
        return 200 '{"m.server":"matrix.example.eu:8448"}';
        default_type application/json;
    }

    location / {
        proxy_pass http://localhost:8009;
        proxy_set_header X-Forwarded-For $remote_addr;
    }

    # Forward to dockerized Synapse
    location ~* ^(\/_matrix|\/_synapse\/client) {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;

        proxy_read_timeout    600;
        proxy_connect_timeout 600;
        proxy_send_timeout    600;
    }
}

# Federation Port 8448
server {
    listen 8448 ssl http2;
    listen [::]:8448 ssl http2;
    server_name matrix.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrix.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrix.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    client_max_body_size 50M;


    location / {
        proxy_pass         http://localhost:8008;
        proxy_set_header   X-Forwarded-For $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Host $host;
        proxy_http_version 1.1;
    }
}
# HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name matrixrtc.example.eu;

    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Client API
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name matrixrtc.example.eu;

    ssl_certificate     /etc/letsencrypt/live/matrixrtc.example.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/matrixrtc.example.eu/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

location ^~ /livekit/jwt/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # MatrixRTC Authorization Service running at port 8080
      proxy_pass http://localhost:8070/;
    }

    location ^~ /livekit/sfu/ {
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_send_timeout 120;
      proxy_read_timeout 120;
      proxy_buffering off;

      proxy_set_header Accept-Encoding gzip;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";


      # LiveKit SFU websocket connection running at port 7880
      proxy_pass http://localhost:7880/;
    }
}

Jetzt noch die Config mittels symlink eurem nginx bekant machen und diesen reloaden.

Synapse Server starten:

Danach konnt Ihr wieder in den Ordner /opt/matrix wechseln und den Synapse Server starten:

docker compose up

Ich habe hier das detachen erst einmal weg gelassen, so könnt Ihr die Ausgaben beobachten und wisst auch wann die Datenbankinitialisierung vorbei ist.

Benutzer anlegen:

Nun müsst Ihr natürlich noch User anlegen, da wir die Registrierung deaktiviert haben, machen wir das über die Kommandozeile. Den ersten User machen wir auch gleich zum Admin, bei den anderen Usern tauscht ihr das –admin gegen ein –no-admin.

docker exec -it synapse register_new_matrix_user \
  http://localhost:8008 \
  -c /data/homeserver.yaml \
  -u meinErsterUser \
  -p SuperSicheresPasswort \
  --admin

Nun sollte euer eigener Synapse Server laufen und auch mit anderen Server föderieren können. Falls Ihr konstruktive Anmerkungen habt, eine Fehler in der Config seht etc. dann schreibt einfach einen Kommentar. Wie gesagt das ganze aufzusetzen ist extrem komplex und den einen ultimativen Guide gibt es nicht (und der hier ist es sicher auch nicht).

Aber ich hoffe ich kann auf die Weise den einen oder anderen dazu bewegen sich auch so ein System aufzusetzen und damit dazu beizutragen das Matrix Ökosystem ein bisschen resilienter zu machen.

#element #linux #matrix #opensource #selfhosting #synapse #unplugbigtech #unplugtrump @bjoern

#element #linux #matrix #opensource #selfhosting #synapse

BjoernAusGE @[email protected] · 2026-07-30 · 12:42 UTC

So i moved my own Synapse Server to its final TLD. Time to start using it regulary, till now i have only playing around with it, trying to get Element Call etc. working properly.
#selfhosting #matrix #synapse #unplugbigtech #unplugtrump

#selfhosting #matrix #synapse #unplugbigtech #unplugtrump

BjoernAusGE @[email protected] · 2026-07-30 · 12:42 UTC

So i moved my own Synapse Server to its final TLD. Time to start using it regulary, till now i have only playing around with it, trying to get Element Call etc. working properly.
#selfhosting #matrix #synapse #unplugbigtech #unplugtrump

#selfhosting #matrix #synapse #unplugbigtech #unplugtrump

VibeOps @[email protected] · 2026-07-25 · 06:26 UTC

Produktiv-Updates vom Handy aus steuern — mit einem AI-Agenten im Matrix-Chat 🤖📱

Samstagmorgen, Kaffee in Reichweite, und mein selbstgehosteter Stack meldet drei verfügbare Updates. Also kurzerhand per Element X auf dem Handy dem AI-Agenten (Hermes, selbstgehostet) geschrieben: „Mach mal."

Was dann passierte — komplett per Chat, ohne SSH, ohne Laptop:

Forgejo (Git-Server): Patch-Update eingespielt, Healthchecks verifiziert, Changelog-Eintrag committed und gepusht.

Synapse (Matrix-Homeserver): Minor-Update inkl. automatischer DB-Schema-Migration. Release Notes wurden vorher auf Breaking Changes gescannt — betraf uns nicht, grünes Licht. Das Update lief übrigens über denselben Homeserver, der gerade neu gestartet wurde. Die Chat-Verbindung hat's überlebt. Selbstheilend quasi 😄

Element Web (Web-Client): Patch-Update, Config-Mount geprüft, alles da.

Nebenbei wurde der Update-Prozess selbst besser: Alle drei Dienste von floating latest-Tags auf Version-Pinning umgestellt, also reproduzierbar und rollback-fähig. Für jeden Dienst wurde ein wiederverwendbares Update-Playbook angelegt, inklusive der Fallstricke, die man nur einmal erleben will. Und ein fehlender Changelog-Eintrag vom letzten Major-Upgrade wurde nachträglich recherchiert und dokumentiert.

Der eigentliche Mindbender: Ich habe Production-Updates von einem Handy-Chat aus angestoßen — und der Agent hat nicht einfach Befehle abgearbeitet, sondern Versionen geprüft, Release Notes gelesen, verifiziert, dokumentiert und sein eigenes Wissen für das nächste Mal erweitert.

Selfhosting + AI-Agenten + offene Protokolle ist eine ziemlich starke Kombination.

#selfhosting #matrix #forgejo #synapse #ai #homelab #automation #vibeops #kimik3 #hermes_agent

#selfhosting #matrix #forgejo #synapse #ai #homelab

VibeOps @vibeops · 2026-07-25 · 06:26 UTC