Matrix Server VPS

Who it suits

Private, end-to-end encrypted chat for a family, team or community, using Element or any Matrix app, with federation to the rest of Matrix. Synapse is the mature reference server; lighter servers such as Conduit and continuwuity are younger and make no production-ready claim.

Which plan

Standard (2 vCPU, 4 GB) is the smallest plan we offer it on: Synapse's install guide asks for at least 1 GB of free memory to join large rooms, and PostgreSQL runs alongside. Joining big public rooms is what makes Synapse heavy; a private server for a family stays light.

What we install

We add matrix.org's package repository, download matrix-synapse-py3 and create a PostgreSQL database with the C collation Synapse requires. vps9-https matrix.example.com names the server, installs and configures Synapse (PostgreSQL, registration off), creates an admin with a generated password in /root/matrix-admin.txt, and serves the Matrix APIs and .well-known files on 443 through Caddy.

From order to ready

1. Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
2. Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
3. Application ready. This can be minutes after SSH works. The installer writes its exit code to /var/lib/vps9-setup.exit; a value of 0 means installation succeeded. After vps9-https, Synapse is ready when curl http://127.0.0.1:8008/health answers OK on the server and https://<your domain>/.well-known/matrix/client answers from outside.

What you still do

1. Choose the server's name: it's in every user ID (@you:matrix.example.com) and can never change. Point that domain at the server and allow ports 80 and 443 in the panel firewall.
2. Run vps9-https matrix.example.com. Synapse starts, Caddy gets a certificate, and your admin login (@admin:matrix.example.com) is written to /root/matrix-admin.txt.
3. Sign in with Element or another Matrix app, with https://matrix.example.com as the homeserver.
4. Add people with register_new_matrix_user -c /etc/matrix-synapse/conf.d/vps9.yaml http://127.0.0.1:8008; open registration stays off.

Exposure and security

Synapse listens on localhost only. Caddy on 80 and 443 serves the client and federation APIs, with federation on 443 through .well-known, so port 8448 stays closed. Registration is off, and the admin is created with Synapse's registration secret, which only root can read. With federation, servers your users talk to see the rooms and messages shared with them, as with email.

Backups and upgrades

Synapse updates with the system's packages from matrix.org's repository (apt upgrade); the automatic security updates we turn on cover the operating system only, so upgrade Synapse yourself after reading its notes. Back up the PostgreSQL database (pg_dump), /etc/matrix-synapse, which holds the signing key, and /var/lib/matrix-synapse off the server. We run the hardware, the network and the first-boot install; after that, Matrix Synapse is yours to run, and we don't manage or update it for you. Off-site backups of the whole disk are an optional paid add-on; they copy the disk as it is at one moment, so keep the app's own backups as well.