diff --git a/compose.yml b/compose.yml
index dc4e8e6..b76f9ed 100644
--- a/compose.yml
+++ b/compose.yml
@@ -5,6 +5,9 @@ services:
     image: traefik:v3.6
     container_name: traefik
     restart: unless-stopped
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
     ports:
       - "80:80"
       - "443:443"
@@ -12,6 +15,9 @@ services:
       - "/var/run/docker.sock:/var/run/docker.sock" # running as root TODO need to make new user
       - "./letsencrypt:/letsencrypt"
       - "./traefik.yml:/etc/traefik/traefik.yml:ro" # sets the traefik.yml file as the options file for configuring proxy settings
+    environment:
+      - DESEC_TOKEN=RnKb69i8npX4HyvLr25NnQ1p25Kr
+      - LEGO_DISABLE_CNAME_SUPPORT=true
     networks:
       traefik:
         ipv4_address: 172.21.0.10
@@ -52,7 +58,7 @@ services:
     ports:
       - "51820:51820/udp"
     networks:
-      backend: {}
+      traefik: {}
       frontend: {}
 
     labels:
@@ -75,7 +81,7 @@ services:
 
 networks:
   # Backend network for docker containers to talk to eachother
-  backend:
+  traefik:
     name: traefik
     external: true
   # VPN network for external devices to connect to the server
diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml
index ee338c1..edbdf9e 100644
--- a/gitea/docker-compose.yml
+++ b/gitea/docker-compose.yml
@@ -26,7 +26,7 @@ services:
         - "traefik.enable=true"
         - "traefik.http.routers.gitea.rule=Host(`git.riverrooks.dev`)"
         - "traefik.http.routers.gitea.entrypoints=websecure"
-        - "traefik.http.routers.gitea.tls.certresolver=myresolver"
+        - "traefik.http.routers.gitea.tls.certresolver=desecresolver"
         # Explicitly tell Traefik to send the web traffic to internal port 3000
         - "traefik.http.services.gitea.loadbalancer.server.port=3000"
         # Tell Traefik to exclusively use the 'proxy' network to route traffic
diff --git a/matrix/compose.yml b/matrix/compose.yml
index e2965c6..01c07f0 100644
--- a/matrix/compose.yml
+++ b/matrix/compose.yml
@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   synapse-db:
     image: postgres:16-alpine
@@ -9,6 +7,7 @@ services:
       POSTGRES_USER: synapse_user
       POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
       POSTGRES_DB: synapse-db
+      POSTGRES_INITDB_ARGS: "--locale=C --encoding=UTF8"
     volumes:
       - ./postgres_data:/var/lib/postgresql/data
     networks:
@@ -39,9 +38,6 @@ services:
       - "traefik.http.routers.matrix.tls=true"
       - "traefik.http.routers.matrix.tls.certresolver=basic"
 
-      - "traefik.http.routers.matrix.middlewares=matrix-raw-path"
-      - "traefik.http.routers.matrix.middlewares.matrix-raw-path.plugin.allowEncodedSlash=true"
-
     networks:
       - matrix-net
       - traefik
@@ -49,17 +45,29 @@ services:
     image: nginx:alpine
     container_name: matrix-delegation
     restart: unless-stopped
-    # Generates the file dynamically and starts nginx
+    # 1. Using "|" keeps literal newlines so the script executes perfectly
     command: >
-      /bin/sh -c "mkdir -p /usr/share/nginx/html/.well-known/matrix 
-      && echo '{\"m.server\": \"matrix.riverrooks.dev:443\"}' > /usr/share/nginx/html/.well-known/matrix/server 
-      && nginx -g 'daemon off;'"
+      /bin/sh -c "mkdir -p /usr/share/nginx/html/.well-known/matrix && echo '{\"m.server\": \"matrix.riverrooks.dev:443\"}' > /usr/share/nginx/html/.well-known/matrix/server && nginx -g 'daemon off;'"
     labels:
       - "traefik.enable=true"
-      # Crucial: This intercepts only the specific Matrix path on the root domain
       - "traefik.http.routers.matrix-delegation.rule=Host(`riverrooks.dev`) && PathPrefix(`/.well-known/matrix/server`)"
-      - "traefik.http.routers.matrix-delegation.entrypoints=websecure" 
-      - "traefik.http.routers.matrix-delegation.tls.certresolver=basic"
+      - "traefik.http.routers.matrix-delegation.entrypoints=websecure"
+      - "traefik.http.routers.matrix-delegation.tls.certresolver=desecresolver"
+    # 2. Added the traefik network so Traefik can actually reach this container
+    networks:
+      - matrix-net
+      - traefik
+  mautrix-gmessages:
+    image: dock.mau.fi/mautrix/gmessages:latest
+    container_name: mautrix-gmessages
+    restart: unless-stopped
+    volumes:
+      - ./data:/data
+    networks:
+      - matrix-net
+    depends_on:
+      - synapse-db
+      - synapse
 
 
 networks:
diff --git a/traefik.yml b/traefik.yml
index a8bf791..5199d0a 100644
--- a/traefik.yml
+++ b/traefik.yml
@@ -23,6 +23,10 @@ entryPoints:
           scheme: https
   websecure:
     address: ":443"
+    http:
+      encodedCharacters:
+        allowEncodedSlash: true
+        allowEncodedHash: true  # This is crucial for Matrix room aliases!
 
 certificatesResolvers:
   basic:
@@ -31,3 +35,13 @@ certificatesResolvers:
       storage: /letsencrypt/acme.json
       # Use the TLS challenge for domain verification
       tlsChallenge: {}
+  desecresolver:
+    acme:
+      email: web-admin@riverrooks.art
+      storage: /letsencrypt/acme.json
+      dnsChallenge:
+        provider: desec
+        delayBeforeCheck: 15
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"