diff --git a/data.nix b/data.nix
index c4f5e81..2a63265 100644
--- a/data.nix
+++ b/data.nix
@@ -26,6 +26,7 @@ rec {
 
     soju = 6697;
     soju-ws = 6698;
+    matrix-synapse = 8008;
     vaultwarden = 8222;
     headscale = 8080;
     hass = 8123;
diff --git a/flake.nix b/flake.nix
index a279a3c..8f9e4fb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -175,6 +175,9 @@
                 letsencrypt-account-key.file = ./secrets/letsencrypt/account.key.age;
                 vaultwarden-secrets-env.file = ./secrets/vaultwarden/secrets.env.age;
                 photoprism-admin-passwd.file = ./secrets/photoprism/admin_password.age;
+                synapse-jakstys-signing-key.file = ./secrets/synapse/jakstys_lt_signing_key.age;
+                synapse-registration-shared-secret.file = ./secrets/synapse/registration_shared_secret.age;
+                synapse-macaroon-secret-key.file = ./secrets/synapse/macaroon_secret_key.age;
                 syncthing-key.file = ./secrets/fwminex/syncthing/key.pem.age;
                 syncthing-cert.file = ./secrets/fwminex/syncthing/cert.pem.age;
               };
diff --git a/hosts/fwminex/configuration.nix b/hosts/fwminex/configuration.nix
index 0c26acb..3bef74b 100644
--- a/hosts/fwminex/configuration.nix
+++ b/hosts/fwminex/configuration.nix
@@ -259,6 +259,25 @@ in
           handle /.well-known/caldav {
             redir https://cdav.migadu.com/
           }
+
+            @matrixMatch {
+              path /.well-known/matrix/client
+              path /.well-known/matrix/server
+            }
+            header @matrixMatch Content-Type application/json
+            header @matrixMatch Access-Control-Allow-Origin *
+            header @matrixMatch Cache-Control "public, max-age=3600, immutable"
+
+            handle /.well-known/matrix/client {
+              respond "{\"m.homeserver\": {\"base_url\": \"https://jakstys.lt\"}}" 200
+            }
+            handle /.well-known/matrix/server {
+              respond "{\"m.server\": \"jakstys.lt:443\"}" 200
+            }
+
+            handle /_matrix/* {
+              reverse_proxy http://127.0.0.1:${toString myData.ports.matrix-synapse}
+            }
         '';
       };
     };
@@ -474,6 +493,13 @@ in
         group = "users";
       };
 
+      matrix-synapse = {
+        enable = true;
+        signingKeyPath = config.age.secrets.synapse-jakstys-signing-key.path;
+        registrationSharedSecretPath = config.age.secrets.synapse-registration-shared-secret.path;
+        macaroonSecretKeyPath = config.age.secrets.synapse-macaroon-secret-key.path;
+      };
+
       remote-builder.client =
         let
           host = myData.hosts."fra1-b.servers.jakst";
diff --git a/modules/services/default.nix b/modules/services/default.nix
index 955589c..39788f9 100644
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -11,6 +11,7 @@
     ./hass
     ./headscale
     ./jakstpub
+    ./matrix-synapse
     ./minidlna
     ./node_exporter
     ./nsd-acme
diff --git a/modules/services/matrix-synapse/default.nix b/modules/services/matrix-synapse/default.nix
new file mode 100644
index 0000000..f2eb8d2
--- /dev/null
+++ b/modules/services/matrix-synapse/default.nix
@@ -0,0 +1,129 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.mj.services.matrix-synapse = with lib.types; {
+    enable = lib.mkEnableOption "Enable matrix-synapse";
+    signingKeyPath = lib.mkOption { type = path; };
+    registrationSharedSecretPath = lib.mkOption { type = path; };
+    macaroonSecretKeyPath = lib.mkOption { type = path; };
+  };
+
+  config = lib.mkIf config.mj.services.matrix-synapse.enable {
+    services.matrix-synapse = {
+      enable = true;
+      extraConfigFiles = [ "/run/matrix-synapse/secrets.yaml" ];
+      settings = {
+        server_name = "jakstys.lt";
+        admin_contact = "motiejus@jakstys.lt";
+        enable_registration = false;
+        report_stats = true;
+        signing_key_path = "/run/matrix-synapse/jakstys_lt_signing_key";
+        log_config = pkgs.writeText "log.config" ''
+          version: 1
+          formatters:
+            precise:
+             format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+          handlers:
+            console:
+              class: logging.StreamHandler
+              formatter: precise
+          loggers:
+              synapse.storage.SQL:
+                  level: WARN
+          root:
+              level: ERROR
+              handlers: [console]
+          disable_existing_loggers: false
+        '';
+        public_baseurl = "https://jakstys.lt/";
+        database.name = "sqlite3";
+        url_preview_enabled = false;
+        max_upload_size = "50M";
+        rc_messages_per_second = 0.2;
+        rc_message_burst_count = 10.0;
+        federation_rc_window_size = 1000;
+        federation_rc_sleep_limit = 10;
+        federation_rc_sleep_delay = 500;
+        federation_rc_reject_limit = 50;
+        federation_rc_concurrent = 3;
+        allow_profile_lookup_over_federation = false;
+        thumbnail_sizes = [
+          {
+            width = 32;
+            height = 32;
+            method = "crop";
+          }
+          {
+            width = 96;
+            height = 96;
+            method = "crop";
+          }
+          {
+            width = 320;
+            height = 240;
+            method = "scale";
+          }
+          {
+            width = 640;
+            height = 480;
+            method = "scale";
+          }
+          {
+            width = 800;
+            height = 600;
+            method = "scale";
+          }
+        ];
+        user_directory = {
+          enabled = true;
+          search_all_users = false;
+          prefer_local_users = true;
+        };
+        allow_device_name_lookup_over_federation = false;
+        email = {
+          smtp_host = "127.0.0.1";
+          smtp_port = 25;
+          notf_for_new_users = false;
+          notif_from = "Jakstys %(app)s homeserver <noreply@jakstys.lt>";
+        };
+        include_profile_data_on_invite = false;
+        password_config.enabled = true;
+        require_auth_for_profile_requests = true;
+      };
+    };
+
+    systemd.tmpfiles.rules = [ "d /run/matrix-synapse 0700 matrix-synapse matrix-synapse -" ];
+
+    systemd.services = {
+      matrix-synapse =
+        let
+          # I tried to move this to preStart, but it complains:
+          #   Config is missing macaroon_secret_key
+          secretsScript = pkgs.writeShellScript "write-secrets" ''
+            set -xeuo pipefail
+            umask 077
+            ln -sf ''${CREDENTIALS_DIRECTORY}/jakstys_lt_signing_key /run/matrix-synapse/jakstys_lt_signing_key
+            cat > /run/matrix-synapse/secrets.yaml <<EOF
+            registration_shared_secret: "$(cat ''${CREDENTIALS_DIRECTORY}/registration_shared_secret)"
+            macaroon_secret_key: "$(cat ''${CREDENTIALS_DIRECTORY}/macaroon_secret_key)"
+            EOF
+          '';
+        in
+        {
+          serviceConfig.ExecStartPre = [
+            ""
+            secretsScript
+          ];
+          serviceConfig.LoadCredential = with config.mj.services.matrix-synapse; [
+            "jakstys_lt_signing_key:${signingKeyPath}"
+            "registration_shared_secret:${registrationSharedSecretPath}"
+            "macaroon_secret_key:${macaroonSecretKeyPath}"
+          ];
+        };
+    };
+  };
+}