Self-hosting Matrix Synapse on a Linux VPS means operating your own homeserver, database, media store, DNS, TLS certificates, and federation endpoints. The safest production path is to choose the permanent Matrix server name first, install Synapse from an official package or container, run it with PostgreSQL, place it behind an HTTPS reverse proxy, and establish backups and upgrade procedures before inviting users.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Your server name is not a cosmetic hostname. It becomes the domain portion of every Matrix ID, such as @user:example.com, and cannot be changed later. Treat domain registration, DNS, certificate issuance, and federation policy as part of the initial design.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you need before installing Synapse
A Synapse deployment has several connected parts. Synapse handles Matrix client and federation APIs, PostgreSQL stores account and room state, the media repository stores uploads, a reverse proxy terminates HTTPS, DNS publishes the service, and optional TURN infrastructure relays voice and video traffic.
Choose the permanent server name
Decide the final Matrix server name before generating configuration. If the server name is example.com, a user will normally have an ID such as @alice:example.com. The name is embedded in room aliases, user IDs, signatures, and federation metadata; changing the VPS hostname later does not change it.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The installation documentation states: “It is important to choose the name for your server before you install Synapse, because it cannot be changed later.” A production service normally uses an organization’s domain rather than a provider-specific VPS hostname.
Select a VPS and operating system
- Use a Linux VPS with a stable public IPv4 address and, preferably, working IPv6.
- Confirm that the provider permits Matrix federation and inbound and outbound traffic on the ports you intend to use.
- Choose durable disk storage with enough headroom for database growth, media uploads, logs, and backups.
- Use a supported Debian or Ubuntu release, or another distribution for which your chosen Synapse installation method supplies supported packages.
- Enable the provider firewall and retain console access in case an SSH rule locks you out.
There is no authoritative universal CPU, RAM, disk, or user-count minimum. Required capacity depends on concurrent users, room activity, federation traffic, media volume, retention rules, URL previews, and whether workers are added later. Start with measured requirements and monitor growth rather than trusting a fixed “minimum VPS” figure.
Plan DNS and delegation
Point the chosen domain to the VPS before requesting certificates. If Synapse runs on a separate host such as matrix.example.com while users retain IDs at example.com, publish Matrix delegation responses at /.well-known/matrix/server and, where appropriate, /.well-known/matrix/client. These records tell clients and other homeservers where the actual service lives.
Decide whether federation will arrive directly on port 8448 or through delegated routing. Document the choice, because DNS, firewall rules, proxy listeners, and certificate names must agree.
Choose an installation method
Use an official Synapse package or the official container image rather than an old distribution package. The published container image is ghcr.io/element-hq/synapse; the project also provides a Matrix Docker image and Docker Compose examples. On Debian and Ubuntu, current Matrix/Element packages are preferred over stale packages from the base distribution.
| Method | Upgrade control | Isolation and operations | Best fit |
|---|---|---|---|
| Distribution or vendor package | Package manager controls versions; read Synapse upgrade notes before each change. | Integrates with the host service manager, logs, users, and firewall. | Administrators who want a conventional Linux service. |
| Official container | Image tags make releases explicit; you control when to pull and recreate. | Configuration, PostgreSQL connectivity, media, and signing keys must be mounted as persistent volumes. | Teams already operating Docker or Compose. |
| Ansible or similar automation | Repeatable, reviewable changes and easier rebuilds. | More adjacent tooling and inventory to maintain; observability and backup tasks still need explicit design. | Several hosts or a requirement for reproducible infrastructure. |
Whichever method you choose, keep the generated configuration, signing key, media directory, database credentials, and deployment files under controlled permissions. Do not place secrets in a public repository or a world-readable volume.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Prepare the host
- Create a non-root administrative account and use SSH keys. Disable password SSH login after confirming key access and retain an out-of-band console.
- Apply current operating-system security updates. Enable unattended security updates when they fit your change-control policy.
- Set the host’s time synchronization, hostname, and firewall policy.
- Allow SSH only from trusted networks where practical. Expose HTTP only for certificate issuance or redirects, and expose HTTPS and the federation path required by your design.
- Create a dedicated Synapse service account if your package or container layout does not create one automatically.
Generate Synapse configuration safely
Run the official generation procedure with the permanent server name. Keep the signing key private: it authenticates the homeserver to federated peers, and losing it can make recovery or identity continuity difficult. Store a protected copy outside the VPS as part of your backup plan.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Review the generated configuration before starting the service. Confirm the public server name, listeners, media path, database section, registration policy, and trusted proxy settings. Avoid exposing the administrative listener directly to the internet.
Registration and the first administrator
Create the first administrator with the supported registration tool or the authenticated Admin API. The registration_shared_secret deserves special care: the installation guide warns that anyone who knows it can register users, including administrators, even when ordinary registration is disabled. Generate a strong random value, restrict file permissions, and rotate it only with a documented plan.
After creating the initial administrator, decide whether public registration is needed. If it is enabled, add rate limits, email or verification controls where supported, and abuse monitoring. If it is disabled, provide an authenticated administrative path for provisioning accounts.
Use PostgreSQL for production
SQLite is suitable for testing and small experiments, not a production homeserver. The installation guidance says that almost all production installations should use PostgreSQL because its performance and query behavior are better for Synapse workloads.
Create a dedicated database and role
Install a supported PostgreSQL server and the client library required by your Synapse package or container. Use a database role dedicated to Synapse; do not reuse a superuser account. A typical database creation sequence is:
sudo -u postgres createuser --pwprompt synapse
sudo -u postgres createdb --encoding=UTF8 --locale=C --lc-ctype=C --template=template0 --owner=synapse synapseThe exact command-line options can vary by PostgreSQL release. The important properties are UTF-8 encoding, LC_COLLATE=C, LC_CTYPE=C, and template0, as specified by the Synapse PostgreSQL guide.
Point Synapse at PostgreSQL
In the Synapse database section, select the PostgreSQL engine and provide the database name, role, password, host, and port. Keep the password in a protected secret file or environment mechanism supported by your deployment method. Test authentication from the Synapse host before starting migration or production traffic.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Version requirements change. Synapse 1.122 and later require PostgreSQL 13 or newer according to the upgrade notes. Verify the requirement again against the release you are installing; do not assume an older database major version remains supported.
Put Synapse behind HTTPS and a reverse proxy
Synapse’s local HTTP listener on port 8008 is intended for testing. Production clients and federated homeservers should reach the APIs through HTTPS terminated by a reverse proxy such as nginx, Apache, Caddy, HAProxy, or relayd.
Route the required paths
Forward both /_matrix and /_synapse/client to Synapse. Preserve the original host and scheme, and set the forwarding headers Synapse expects:
X-Forwarded-For: client-address
X-Forwarded-Proto: httpsUse a certificate containing the complete trust chain and renew it automatically. Verify renewal before the first certificate expires; a failed renewal can take down both login and federation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand ports 443 and 8448
Client traffic normally enters on HTTPS port 443. Federation commonly uses port 8448 when no delegation is configured. If your reverse proxy serves federation through delegated port 443, ensure the corresponding .well-known/matrix/server response points peers to the correct host and port.
Test from outside the VPS. Check that the advertised name resolves publicly, the certificate matches that name, the proxy reaches Synapse, and the response does not redirect API requests to an unrelated website. Confirm that the proxy passes the original scheme; otherwise Synapse can generate incorrect redirects or reject requests as insecure.
Configure federation deliberately
Federation allows your homeserver to exchange room state and events with other Matrix servers. It depends on all of the following being correct:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Public DNS for the server name or its delegation records.
- A publicly trusted certificate whose names match the advertised endpoint.
- Firewall and provider policy permitting the selected federation route.
- Reverse-proxy routing for federation and the required forwarding headers.
- A reachable endpoint from outside your own network.
Perform a federation test only after DNS, TLS, and proxy configuration are complete. If it fails, inspect certificate-chain errors, incorrect ports, stale DNS, blocked provider traffic, and proxy access logs before changing Synapse settings.
Set limits, directories, media, and abuse controls
Do not leave policy at accidental defaults. Decide who may register, whether users can create public rooms, which rooms appear in the directory, maximum media sizes, retention periods, and how abuse reports are handled. Media limits are also a capacity control: a permissive upload policy can consume disk faster than message traffic.
Handle URL previews safely
URL previews are disabled by default. If you enable them, configure the URL-preview IP-range blacklist, including loopback and private address ranges. This is critical because an unprotected preview fetcher can be abused to make Synapse request internal network addresses. Recheck the blacklist after network changes and when adding internal services.
Add TURN for reliable calls
Direct peer-to-peer media often fails behind carrier-grade NAT, restrictive firewalls, or symmetric NAT. For reliable VoIP routed through the homeserver, the installation documentation states: “For reliable VoIP calls to be routed via this homeserver, you MUST configure a TURN server.”
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDeploy coturn or a managed TURN service, configure shared credentials, and open the required UDP and TCP relay ports in both the VPS firewall and provider firewall. Store the shared secret separately from ordinary user passwords. Test calls from different networks, including a mobile connection, rather than testing only two clients on the same LAN.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Back up what makes the server recoverable
A database dump alone is not a complete Synapse backup. Protect these items separately:
- PostgreSQL data, including a tested logical dump or physical backup strategy.
- The media repository, which may be much larger than the database.
- The signing key and other cryptographic secrets.
- Synapse configuration, deployment files, and reverse-proxy configuration.
- DNS and certificate-account information needed to rebuild the endpoint.
Use encrypted, access-controlled backup storage and keep at least one copy outside the VPS provider. Test restoration on an isolated host: restore PostgreSQL, copy media, restore configuration and signing keys, then verify login, room history, media downloads, and federation. A backup that has never been restored is an assumption, not a recovery plan.
Monitor the service and plan capacity
Begin with Synapse in monolith mode for a small installation. Add workers only when measured workload justifies the additional processes, routing, queues, and operational complexity. The official documentation covers Prometheus metrics and worker scaling.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTrack the signals that reveal a problem before users report it:
- Disk utilization and media growth rate.
- PostgreSQL connections, slow queries, storage, and failed backups.
- Federation queues, remote-server errors, and delayed outbound events.
- Request latency, worker latency, CPU, memory, and restart counts.
- Certificate expiration and reverse-proxy error rates.
- Log volume and repeated authentication or registration failures.
Set alerts with enough headroom for maintenance. Disk exhaustion can prevent both Synapse and PostgreSQL from writing, so reserve space for database maintenance and log rotation.
Upgrade without breaking federation
Read every Synapse upgrade note before changing versions. Upgrade the operating system, Python runtime, PostgreSQL, reverse proxy, and Synapse package within their supported lifecycles; Synapse withdraws support for end-of-life dependencies.
- Confirm a recent, restorable backup and record the current versions.
- Read the release and upgrade notes for database, configuration, media, and client-impact changes.
- Check that PostgreSQL meets the new minimum; for Synapse 1.122 and later this is PostgreSQL 13 or newer.
- Apply the Synapse upgrade in a maintenance window appropriate to your user base.
- Run database migrations as instructed by the release and watch logs during startup.
- Test login, sending messages, media, federation, administration, and TURN calls.
Authenticated media became enabled by default in Synapse 1.120. Older clients or integrations that assumed unauthenticated media URLs may need changes, so test media access after upgrading.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Troubleshoot the most common failures
Clients cannot connect
- Check that the client’s server-name discovery reaches the intended
.well-known/matrix/clientresponse. - Verify port 443, certificate validity, and proxy forwarding of
/_matrixand/_synapse/client. - Inspect
X-Forwarded-Proto; an HTTP value behind an HTTPS proxy commonly causes redirect or security problems.
Federation fails but local login works
- Confirm the federation port or delegation record is publicly reachable.
- Check that the certificate chain and advertised hostname match.
- Review provider abuse rules and firewall logs for blocked inbound or outbound federation traffic.
- Read Synapse and reverse-proxy logs together; a proxy 404 on federation paths is different from a remote TLS failure.
Synapse will not start after a database change
- Test the PostgreSQL role, password, host, port, and database name independently.
- Confirm UTF-8 and the required locale/template settings were used when creating the database.
- Check the supported PostgreSQL major version for the installed Synapse release.
- Restore the last known-good configuration only after preserving logs and the failed configuration for diagnosis.
Calls connect without audio or video
Check TURN credentials, relay ports, UDP reachability, and the client’s advertised TURN configuration. Test across unrelated networks; a successful same-LAN call does not prove that TURN is working.
Package, container, or automation: a practical decision
Choose the method that matches the skills and recovery process you already operate. Packages are straightforward on one Linux host. Containers make image versions and volume boundaries explicit but require disciplined volume backups. Automation improves repeatability and rebuilds but does not remove the need to design PostgreSQL, proxy, TURN, DNS, and monitoring as separate dependencies.
For any method, write down how to rebuild the VPS from an empty image. The procedure should identify the server name, DNS and delegation records, package or image version, database restoration command, media location, signing-key restoration, proxy certificate process, firewall rules, and post-restore federation test.
Quick Recap
A production-readiness checklist
- The permanent server name is chosen and documented.
- DNS and any
.well-knowndelegation responses are correct. - Synapse comes from an official package or container and runs on supported dependencies.
- PostgreSQL is used for production with a dedicated role and database.
- HTTPS terminates at a reverse proxy with complete certificates and correct forwarding headers.
- Client and federation routes have been tested from outside the VPS.
- The registration shared secret, signing key, and database credentials are protected.
- Registration, room directory, media, retention, and abuse policies are intentional.
- URL-preview private-range protections are configured if previews are enabled.
- TURN is deployed and tested if reliable VoIP is required.
- Database, media, keys, and configuration are backed up and restoration has been rehearsed.
- Monitoring covers disk, database, federation, latency, certificates, and logs.
- Upgrade notes and dependency support windows are part of the maintenance calendar.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
