Deploy a self-hosted messenger with text, files and video calls — without third-party services, on our own hardware, with the ability to communicate with users of other Matrix servers. Additionally: invite-only registration, an administrator panel, backups and monitoring on par with the rest of the infrastructure.
Matrix is an open federated protocol: your own server is fully under your control, while users can talk to any other Matrix server, like email between domains. The homeserver is Synapse (the reference implementation) with PostgreSQL. The client is Element X on iOS/Android.
Synapse and PostgreSQL live in a Proxmox LXC container on the home server. The service is published to the outside through a cloud edge node with a public IP: nginx terminates TLS (Let’s Encrypt), while traffic to the container goes over a WireGuard tunnel. Federation works over the standard port 443 with delegation via .well-known — no extra ports were opened for it. Registration is invite-only (registration tokens); spam bots are shut out.
Modern Element X uses the MatrixRTC stack for calls. On the cloud edge node we deployed LiveKit SFU (the media server through which audio and video streams flow), a JWT authorization service that links Matrix accounts to LiveKit, and coturn as TURN/STUN. Clients discover the call backend automatically — via .well-known. The result: encrypted one-on-one calls and group video conferences without a single third-party service.
Administration is done through a web panel accessible only from a trusted IP. Every night a PostgreSQL dump and a copy of the configuration with media files are taken and replicated to a second node, while a separate check watches the freshness of the copies and sends an alert to Telegram if a backup did not arrive; the dump’s restorability was verified by an actual restore. The server is included in the shared monitoring: Zabbix and Prometheus/Grafana.
Two were caught and fixed along the way. First: Debian/Ubuntu packages auto-start a service with the default config before you write your own, and enable —now does not restart an already running process — this way the TURN server spent several minutes as an open relay until a restart applied the config with authentication. Second: for the LiveKit reverse proxy, stripping the path prefix is critical — without it the client hits the wrong endpoint and the call does not establish. The rule after this project: wrote the config — do a restart and verify the effective config from the log.
A full-featured federated messenger with end-to-end encryption and video calls — on our own infrastructure, under monitoring and with verifiable backups. Stack: Matrix Synapse, PostgreSQL, nginx, Let’s Encrypt, WireGuard, coturn, LiveKit, Proxmox LXC.