diff --git a/README.md b/README.md
index 534fc03..4664407 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,7 @@ Edit the generated `.env` files to fill in the required fields:
 - `./caddy/.env`
 - `./crowdsec/.env`
 - `./prometheus/.env`
+- `./matrix/.env` (set `POSTGRES_PASSWORD`; must match the DB password in `./matrix/data/synapse/homeserver.yaml`)
 - `./caddy/Caddyfile.private`
 
 ### 4. Bouncer Keys (CrowdSec)
diff --git a/caddy/.env.example b/caddy/.env.example
index 90b543f..0dd206d 100644
--- a/caddy/.env.example
+++ b/caddy/.env.example
@@ -45,6 +45,9 @@ GOPKG_PROXY_DOMAIN=
 ############# Ech0 #############
 ECH0_DOMAIN=
 
+############# Matrix #############
+MATRIX_DOMAIN=
+
 ############# CrowdSec #############
 # Same value as CROWDSEC_BOUNCER_KEY_CADDY in crowdsec/.env
 CROWDSEC_API_KEY=
diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index 4adfa47..6920907 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -155,10 +155,23 @@
     request_body {
         max_size 124MB
     }
-    route {
-        import security
-        reverse_proxy http://ghost:2368 {
-            header_up Host {http.request.host}
+    # Matrix federation/client delegation (server_name = apex domain)
+    handle /.well-known/matrix/server {
+        header Content-Type application/json
+        header Access-Control-Allow-Origin *
+        respond `{"m.server":"{$MATRIX_DOMAIN}:443"}`
+    }
+    handle /.well-known/matrix/client {
+        header Content-Type application/json
+        header Access-Control-Allow-Origin *
+        respond `{"m.homeserver":{"base_url":"https://{$MATRIX_DOMAIN}"}}`
+    }
+    handle {
+        route {
+            import security
+            reverse_proxy http://ghost:2368 {
+                header_up Host {http.request.host}
+            }
         }
     }
 }
@@ -252,4 +265,20 @@
     }
 }
 
+############## matrix (synapse) ##############
+{$MATRIX_DOMAIN} {
+    import access-log
+    request_body {
+        max_size 512MB
+    }
+    route {
+        import security
+        @matrix path /_matrix/* /_synapse/client/*
+        reverse_proxy @matrix http://synapse:8008 {
+            header_up Host {http.request.host}
+        }
+        respond 404
+    }
+}
+
 import Caddyfile.private
diff --git a/main.sh b/main.sh
index 7efc395..cae9196 100755
--- a/main.sh
+++ b/main.sh
@@ -66,6 +66,7 @@ generate_env_files() {
     cp --update=none ./stalwart/.env.example ./stalwart/.env
     cp --update=none ./crowdsec/.env.example ./crowdsec/.env
     cp --update=none ./prometheus/.env.example ./prometheus/.env
+    cp --update=none ./matrix/.env.example ./matrix/.env
     cp --update=none ./caddy/Caddyfile.private.example ./caddy/Caddyfile.private
     print_success ".env files generated."
 }
@@ -216,6 +217,15 @@ start_services() {
         exit 1
     fi
 
+    echo "Starting matrix..."
+    $DOCKER_COMPOSE_COMMAND -f ./matrix/docker-compose.yaml up --pull always -d
+    if [ $? -eq 0 ]; then
+        print_success "Matrix started successfully."
+    else
+        print_error "failed to start Matrix!"
+        exit 1
+    fi
+
     echo "Starting crowdsec..."
     $DOCKER_COMPOSE_COMMAND -f ./crowdsec/docker-compose.yaml up --pull always -d
     if [ $? -eq 0 ]; then
@@ -412,6 +422,15 @@ stop_services() {
         exit 1
     fi
 
+    echo "Stopping matrix..."
+    $DOCKER_COMPOSE_COMMAND -f ./matrix/docker-compose.yaml down
+    if [ $? -eq 0 ]; then
+        print_success "Matrix stopped successfully."
+    else
+        print_error "failed to stop Matrix!"
+        exit 1
+    fi
+
     echo "Stopping watchtower..."
     $DOCKER_COMPOSE_COMMAND -f ./watchtower/docker-compose.yaml down
     if [ $? -eq 0 ]; then
diff --git a/matrix/.env.example b/matrix/.env.example
new file mode 100644
index 0000000..c14aa52
--- /dev/null
+++ b/matrix/.env.example
@@ -0,0 +1 @@
+POSTGRES_PASSWORD=
diff --git a/matrix/.gitignore b/matrix/.gitignore
new file mode 100644
index 0000000..3da9bd7
--- /dev/null
+++ b/matrix/.gitignore
@@ -0,0 +1,2 @@
+/data
+.env
diff --git a/matrix/docker-compose.yaml b/matrix/docker-compose.yaml
new file mode 100644
index 0000000..b9cfefc
--- /dev/null
+++ b/matrix/docker-compose.yaml
@@ -0,0 +1,58 @@
+networks:
+  caddy:
+    name: caddy
+    driver: bridge
+    external: true
+  matrix:
+    name: matrix
+    driver: bridge
+
+services:
+  synapse:
+    image: ghcr.io/element-hq/synapse:latest
+    restart: unless-stopped
+    container_name: synapse
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
+    environment:
+      UID: 1000
+      GID: 100
+      SYNAPSE_CONFIG_DIR: /data
+      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
+    volumes:
+      - ./data/synapse:/data
+    networks:
+      - caddy
+      - matrix
+    depends_on:
+      db:
+        condition: service_healthy
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "3"
+
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    container_name: synapse-db
+    environment:
+      POSTGRES_USER: synapse
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: synapse
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C"
+    volumes:
+      - ./data/postgres:/var/lib/postgresql/data
+    networks:
+      - matrix
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U synapse"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "100m"
+        max-file: "3"