Tirion
Back to blog

How to Self-Host Matrix Synapse with Tirion's Free Configurator

By Michael

Every message you send through Slack, Teams, or Google Chat lives on someone else's server. You're trusting a third party with your conversations and hoping their privacy policy doesn't change, their infrastructure doesn't get breached, and their business model never shifts in a direction you don't like.

Self-hosting Matrix Synapse means none of that matters. Your messages live on your server, encrypted end-to-end, under your control. Whether you're a small team that values privacy, a company with compliance requirements, or just someone who believes communication infrastructure shouldn't belong to Big Tech, Matrix gives you a real alternative. And with Tirion's free configurator, you can go from zero to a production-ready deployment in under an hour.

Why Self-Host Your Messaging?

Privacy. Your conversations never leave your server. No vendor can read, mine, or hand over your data. You decide who has access, period.

No per-seat pricing. Host 5 users or 500. The software is free and open source. You only pay for the server it runs on, or someone to manage it for you if things get hectic.

Control. Choose your own bridges, bots, SSO provider, and storage backend. No artificial feature gates, no vendor lock-in, no surprise pricing changes.

Federation. Matrix is an open protocol. You can communicate with other Matrix servers around the world, or keep yours completely private. Your call.

Compliance-ready. If you do have regulatory requirements (HIPAA, SOC 2, GDPR), self-hosted Matrix checks those boxes too. You control data residency, retention, and access.

What Is Matrix / Synapse?

Matrix is an open standard for decentralized, encrypted communication. Think of it as an open protocol like email, but for real-time messaging with end-to-end encryption, voice/video calls, and rich integrations built in.

Synapse is the reference homeserver implementation. It's what actually runs on your server, stores your messages, and handles federation with other Matrix servers.

Element is the most popular client, available on web, desktop, iOS, and Android. It connects to your Synapse server and gives your team a familiar chat interface.

How Matrix E2EE Maps to HIPAA

If you're in healthcare (or any field that handles protected health information), you've probably been told you need "HIPAA-compliant messaging." What does that actually mean?

The HIPAA Security Rule requires safeguards for electronic protected health information (ePHI). The relevant piece here is § 164.312(e)(2)(ii), Transmission Security, which calls for a mechanism to encrypt ePHI in transit. There's also § 164.312(a)(2)(iv), Access Control, which covers encryption of ePHI at rest.

Both of these are "addressable" specifications. In HIPAA terms, that doesn't mean optional. It means you either implement it or document in writing why you chose an equivalent alternative. For a messaging system carrying ePHI, there's no reasonable alternative to encryption.

Matrix handles this natively. Every message sent in an encrypted room is encrypted on the sender's device using the Megolm protocol (based on the Double Ratchet algorithm, the same cryptographic foundation as Signal). The message travels to the server already encrypted and is only decrypted on the recipient's device. The server never sees plaintext. That satisfies transmission security because the data is encrypted before it ever hits the wire, and it goes further than what HIPAA requires since even the server operator can't read the messages.

For encryption at rest, the messages stored in your PostgreSQL database are the Megolm ciphertext. The server literally does not have the keys to decrypt them. Combine that with full-disk encryption on your server (which our configurator can remind you to set up), and you've covered § 164.312(a)(2)(iv) as well.

No BAA with a SaaS vendor. No hoping that a third party's "HIPAA-compliant" marketing actually holds up. You own the infrastructure, you control the encryption, and the math speaks for itself. At the very most, should you choose to run the Synapse server on a cloud platform, a BAA with the cloud provider is all you need. Major players like AWS, Azure, and Vultr would happily satisfy this requirement.

What You'll Need

Before you start, make sure you have:

  • A server: a VPS or dedicated machine running Debian/Ubuntu (2+ GB RAM, 2+ CPU cores recommended)
  • A domain name: e.g., matrix.yourcompany.com with DNS pointed to your server
  • SSH access: root or sudo access to your server
  • About 30 minutes for the configurator wizard and Ansible deployment

Step 1: Fill Out the Configurator

Head to tirion.dev/services/hipaa-im and select a deployment option. Self-service lets you download the configuration files and run the deployment yourself. Managed means we handle the deployment and ongoing maintenance for you. Either way, the configurator is the same. Fill in your details and you'll walk through 8 steps:

  1. Domain & Infrastructure. Enter your domain, server IP, SSH port, and hosting provider.
  2. Web Server / Reverse Proxy. Tell us if you're running nginx, Apache, or Caddy in front of the deployment. If not, Traefik handles everything automatically.
  3. Security & Federation. Enable or disable federation, public registration, presence tracking, and encryption scope.
  4. SSO / OIDC. Optionally connect Keycloak, Authentik, Okta, Microsoft Entra ID, or Google for single sign-on.
  5. Integrations & Bridges. Toggle bridges for WhatsApp, Telegram, Signal, Slack, Discord, and 20+ other platforms.
  6. Automations & Bots. Enable moderation bots (Mjolnir), reminder bots, Maubot, and more.
  7. Media & Storage. Choose local storage, S3, MinIO, Backblaze, or Wasabi for media files. Set retention policies.
  8. Performance & Advanced. Configure Synapse workers, Redis, TURN servers, backups, and monitoring.

Each step saves your progress automatically. Take your time. You can come back and adjust anything before submitting.

Step 2: Review and Download

On the final review screen, you'll see a summary of everything you've configured along with an estimated monthly cost. When you're happy with it, submit the configuration.

You'll download a ZIP bundle containing everything you need:

  • vars.yml configures every aspect of your Matrix deployment
  • hosts is the Ansible inventory file pointing to your server
  • A reverse proxy config (nginx, Caddy, Apache, etc.) if you told the wizard you have an existing proxy in front of the deployment
  • README.md with setup instructions specific to your configuration

These files are ready to use with the matrix-docker-ansible-deploy playbook, which is the industry-standard way to deploy Matrix with Docker.

Step 3: Run the Ansible Playbook

Clone the playbook and drop in your generated files:

# Clone the playbook
git clone https://github.com/spantaleev/matrix-docker-ansible-deploy.git
cd matrix-docker-ansible-deploy

# Copy your generated files
cp ~/Downloads/vars.yml inventory/host_vars/matrix.yourcompany.com/vars.yml
cp ~/Downloads/hosts inventory/hosts

# Install required Ansible roles
just roles

# Run the playbook
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start

The playbook will SSH into your server, install Docker, pull all the necessary container images, and start everything up. Depending on your server and how many bridges/bots you enabled, this takes 5-15 minutes.

Tip: Use a Cheap VPS as an Ingress Gateway

If you have hardware at home or on-premise, you don't need to rent a beefy VPS to run Synapse. Instead, grab a cheap VPS (even a $5/month box works) and use it purely as an ingress gateway. You get a static public IP from the cloud provider, and all the actual processing happens on your own hardware without paying cloud markup for CPU and RAM.

The setup looks like this: run a reverse proxy (nginx, Caddy, etc.) on the VPS, terminate your SSL certs at the ingress gateway, set up WireGuard on both the VPS and your local server, and route traffic through the tunnel. From the outside, everything looks like it's running on the VPS. On the inside, Synapse and all its containers are running on your own machine. This is exactly how we run our demo server.

Step 4: Log In and Invite Your Team

Once the playbook finishes, open your browser and navigate to https://element.yourcompany.com (or whatever domain you configured). You'll see the Element web client.

Create your admin account, set up your first room, and start inviting team members. If you enabled SSO, your team can log in with their existing credentials. No new passwords to remember.

What's Running Under the Hood?

After deployment, your server is running a full Matrix stack in Docker containers:

  • Synapse handles messages, rooms, and federation
  • Element Web is the browser-based chat client
  • Traefik is the reverse proxy with automatic SSL certificates
  • PostgreSQL is the database backend
  • Any bridges you enabled (WhatsApp, Telegram, Signal, etc.)
  • Any bots you enabled (moderation, reminders, automation)

Everything is managed by Docker Compose and can be updated by re-running the Ansible playbook.

Next Steps

  • Set up backups. The configurator can enable automatic PostgreSQL backups. For full disaster recovery, consider adding Borg backup to a remote repository.
  • Monitor your server. Enable Prometheus + Grafana in the Performance step for real-time dashboards.
  • Add bridges. Connect WhatsApp, Telegram, or Slack so your team can reach contacts on other platforms without leaving Element.
  • Harden security. Review the Security step options for rate limiting, federation controls, and encryption scope.

Ready to Get Started?

Our configurator is free and takes about 10 minutes to complete. You'll walk away with Ansible files tailored to your exact needs. That said, deployments differ substantially and despite our best efforts we can't guarantee the configuration files will be plug-and-play. If you chose the self-service path, the community over at #matrix:matrix.org and the playbook's GitHub issues are great resources. If you'd rather not troubleshoot on your own, that's exactly what our managed option is for.

Start configuring your Matrix server

Have questions? Contact us and we'll help you get set up.