A native Matrix server for private communications on the home LAN and existing trusted VPN. The goal was useful encrypted chat without federation, public registration, router port forwards, containers, or a second web stack.
Element X / Element Web
↓ LAN or trusted VPN
NGINX HTTPS on existing VM
↓
Synapse on 127.0.0.1:8008
↓
PostgreSQL on local storageSynapse is deliberately loopback-only. NGINX is the only client ingress. The Matrix federation port is not exposed, public registration is disabled, guest access is disabled, and URL previews start disabled to avoid turning a chat feature into an internal-network fetch path.
The homeserver is ap3xailvm.ap3x.net. Element Web is served at chat.ap3x.net. Both names resolve only through the internal DNS design and are covered by the RyanOS Matrix Internal CA certificate.
iPhone and iPad users can use Element X with the custom homeserver. Browser users can open Element Web directly or use the MatrixChat page inside RyanOS.
MatrixChat is an additive RyanOS section with two tiles: the embedded Element Web client and a direct Element Web link. The embedded client is not a proxy and does not receive passwords, access tokens, Matrix sessions, or room keys. Login remains inside Element.
A device must trust the internal CA for the embedded frame to load without a certificate warning.
Live Matrix message history is configured for seven days using Synapse-supported retention jobs. Media retention is separately configured and last-access based; it is not implemented with direct database deletion. PostgreSQL autovacuum remains the normal space-reuse mechanism.
The Matrix backup timer creates an encrypted archive on the existing SMB mount at /mnt/VM/Matrix. It contains the logical Synapse database dump, relevant configuration, media, and deployment artifacts. The archive checksum is verified from the SMB copy before a run is marked successful.
The private GitHub Matrix repository receives only allowlisted, sanitized configuration templates and documentation. It never receives chat history, media, database dumps, keys, passwords, access tokens, or encrypted recovery material.
Native Synapse, PostgreSQL, Element Web, internal DNS, internal TLS, NGINX routing, daily backup scheduling, and the initial encrypted SMB backup are live. The GBrain Matrix bridge is intentionally not claimed as active: the matrix-gbrain service is currently inactive. Likewise, a Hermes Matrix account must be verified in Synapse before it is described as provisioned or connected.
That distinction matters. A dashboard or a document should report observed state, not future intent as a completed control.