diff --git a/.gitignore b/.gitignore
index 7e50652..a92897f 100755
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 gitea/data/*
 letsencrypt/*
 etc_wireguard/*
+matrix/synapse_data/*
+matrix/.env
diff --git a/compose.yml b/compose.yml
index ea7fd36..dc4e8e6 100644
--- a/compose.yml
+++ b/compose.yml
@@ -17,16 +17,11 @@ services:
         ipv4_address: 172.21.0.10
     labels:
       - "traefik.enable=true"
-
       - "traefik.http.routers.dashboard.rule=Host(`traefik.riverrooks.dev`)"
       - "traefik.http.routers.dashboard.entrypoints=websecure"
       - "traefik.http.routers.dashboard.service=api@internal"
-
       - "traefik.http.routers.dashboard.tls=true"
       - "traefik.http.routers.dashboard.tls.certresolver=basic"
-
-
-      #  MIDDLEWARE
       #  enable auth MIDDLEWARE
       - "traefik.http.routers.dashboard.middlewares=auth"
       #  define auth type and traffic
@@ -39,13 +34,11 @@ services:
     volumes:
       - ./etc_wireguard:/etc/wireguard
     environment:
-      # Required settings
       - WG_HOST=wg.riverrooks.dev
-      
-      # Optional settings
+      - PASSWORD_HASH=$2a$12$PzmNEYtQws9ylYYtr1yojuGJvWUOzmJTxzVSO0svSb9NvOeg1BUcC
       - WG_PORT=51820                 # WireGuard UDP port
-      - WG_DEFAULT_DNS=dns
-      - WG_ALLOWED_IPS=10.8.0.0/24
+      - WG_DEFAULT_DNS=1.1.1.1
+      - WG_ALLOWED_IPS=10.8.0.0/24, 172.16.0.0/12
       
     cap_add:
       - NET_ADMIN
@@ -59,9 +52,8 @@ services:
     ports:
       - "51820:51820/udp"
     networks:
-      traefik: {}
-      dfnk:
-        ipv4_address: 10.8.0.2
+      backend: {}
+      frontend: {}
 
     labels:
         # since by default containers are disabled, we need to enable them
@@ -82,11 +74,13 @@ services:
     restart: always
 
 networks:
-  traefik:
+  # Backend network for docker containers to talk to eachother
+  backend:
     name: traefik
     external: true
-  dfnk:
+  # VPN network for external devices to connect to the server
+  frontend:
     driver: bridge
     ipam:
       config:
-        - subnet: 10.8.0.0/24
+        - subnet: 172.20.0.0/24
diff --git a/matrix/compose.yml b/matrix/compose.yml
new file mode 100644
index 0000000..e2965c6
--- /dev/null
+++ b/matrix/compose.yml
@@ -0,0 +1,69 @@
+version: '3.8'
+
+services:
+  synapse-db:
+    image: postgres:16-alpine
+    container_name: synapse-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: synapse_user
+      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
+      POSTGRES_DB: synapse-db
+    volumes:
+      - ./postgres_data:/var/lib/postgresql/data
+    networks:
+      - matrix-net
+
+  synapse:
+    image: matrixdotorg/synapse:latest
+    container_name: matrix-synapse
+    restart: unless-stopped
+    depends_on:
+      - synapse-db
+    volumes:
+      - ./synapse_data:/data
+      - ./data:/raw-data
+    environment:
+      - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
+    # Expose internally or to a reverse proxy. 
+    # If using Traefik, omit ports and use labels instead.
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.matrix.entrypoints=websecure"
+      - "traefik.http.routers.matrix.rule=Host(`matrix.riverrooks.dev`)"
+
+      - "traefik.http.routers.matrix.service=matrix-service"
+      - "traefik.http.services.matrix-service.loadbalancer.server.port=8008"
+
+      - "traefik.http.routers.matrix.tls=true"
+      - "traefik.http.routers.matrix.tls.certresolver=basic"
+
+      - "traefik.http.routers.matrix.middlewares=matrix-raw-path"
+      - "traefik.http.routers.matrix.middlewares.matrix-raw-path.plugin.allowEncodedSlash=true"
+
+    networks:
+      - matrix-net
+      - traefik
+  matrix-delegation:
+    image: nginx:alpine
+    container_name: matrix-delegation
+    restart: unless-stopped
+    # Generates the file dynamically and starts nginx
+    command: >
+      /bin/sh -c "mkdir -p /usr/share/nginx/html/.well-known/matrix 
+      && echo '{\"m.server\": \"matrix.riverrooks.dev:443\"}' > /usr/share/nginx/html/.well-known/matrix/server 
+      && nginx -g 'daemon off;'"
+    labels:
+      - "traefik.enable=true"
+      # Crucial: This intercepts only the specific Matrix path on the root domain
+      - "traefik.http.routers.matrix-delegation.rule=Host(`riverrooks.dev`) && PathPrefix(`/.well-known/matrix/server`)"
+      - "traefik.http.routers.matrix-delegation.entrypoints=websecure" 
+      - "traefik.http.routers.matrix-delegation.tls.certresolver=basic"
+
+
+networks:
+  matrix-net:
+    driver: bridge
+  traefik:
+    external: true