diff --git a/nixos/machines/orbi/configuration.nix b/nixos/machines/orbi/configuration.nix
index 3e307f7..5b4010e 100644
--- a/nixos/machines/orbi/configuration.nix
+++ b/nixos/machines/orbi/configuration.nix
@@ -34,7 +34,7 @@
     #./sync-torrent.nix
 
     #./social-jitsi.nix
-    #./social-matrix.nix
+    ./social-matrix.nix
 
     # matrix
     # ------
diff --git a/nixos/machines/orbi/social-matrix.nix b/nixos/machines/orbi/social-matrix.nix
index e0764b2..f8441d4 100644
--- a/nixos/machines/orbi/social-matrix.nix
+++ b/nixos/machines/orbi/social-matrix.nix
@@ -1,37 +1,119 @@
 { config, pkgs, ... }:
 let
+  # 1. create DNS entry `_matrix._tcp.ingolf-wagner.de SRV - 10 8443 matrix.ingolf-wagner.de` (8443 for federation)
+  # 2. create DNS entry `matrix.ingolf-wagner.de A - 95.216.66.212`
+  # 3. test with : https://federationtester.matrix.org/#ingolf-wagner.de
+  # 4. info at : https://silvio.github.io/docker-matrix/Example.configs.html
 
-  inherit (config.services.dendrite.settings.global) server_name;
-  fqdn = "matrix.terranix.org";
-  element-web-terranix.org =
+  domain = "ingolf-wagner.de";
+  baseUrl = "https://matrix.${domain}";
+  add_user_script = pkgs.writers.writeBashBin "matrix-create-user" ''
+    ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
+        -k $( ${pkgs.gojq}/bin/gojq \
+            --yaml-input \
+            --raw-output \
+            '.registration_shared_secret' \
+            ${config.sops.secrets.matrix_shared_secret.path} ) \
+        http://localhost:8008
+  '';
+
+  clientConfig."m.homeserver".base_url = baseUrl;
+  serverConfig."m.server" = "matrix.${domain}:443";
+  mkWellKnown = data: ''
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
+
+  element-web =
     pkgs.runCommand "element-web-with-config"
       {
         nativeBuildInputs = [ pkgs.buildPackages.jq ];
       } ''
       cp -r ${pkgs.element-web} $out
       chmod -R u+w $out
-      jq '."default_server_config"."m.homeserver" = { "base_url": "https://${nginx-vhost}:443", "server_name": "${server_name}" }' \
+      jq '."default_server_config"."m.homeserver" = { "base_url": "https://matrix.${domain}", "server_name": "${domain}" }' \
         > $out/config.json < ${pkgs.element-web}/config.json
-      ln -s $out/config.json $out/config.${nginx-vhost}.json
+      ln -s $out/config.json $out/config.matrix.${domain}.json
     '';
 in
 {
 
-  # postgresql instance dedicated to matrix
+  networking.firewall.allowedTCPPorts = [ 80 443 8443 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8443 ];
+
+  environment.systemPackages = [ add_user_script ];
+
+  sops.secrets.matrix_shared_secret.owner = "matrix-synapse";
+  users.users.matrix-synapse = {
+    isSystemUser = true;
+    uid = config.ids.uids.matrix-synapse;
+    group = "matrix-synapse";
+  };
+  users.groups.matrix-synapse.gid = config.ids.gids.matrix-synapse;
+
   # todo : mount postgresql folder in a dedicated zfs pool
-  containers.synapse-postgresql = {
+  containers.matrix-ingolf-wagner-de = {
     autoStart = true;
     privateNetwork = false;
+
+    bindMounts = {
+      rootpassword = {
+        hostPath = config.sops.secrets.matrix_shared_secret.path;
+        mountPoint = "/run/secrets/matrix-shared-secret";
+        isReadOnly = true;
+      };
+    };
+
     config = { config, pkgs, lib, ... }: {
       system.stateVersion = "23.11";
-      services.postgresql.enable = true;
-      services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
-        CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-        CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-          TEMPLATE template0
-          LC_COLLATE = "C"
-          LC_CTYPE = "C";
-      '';
+
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "synapse-init.sql" ''
+          CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+          CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+            TEMPLATE template0
+            LC_COLLATE = "C"
+            LC_CTYPE = "C";
+        '';
+      };
+
+      services.matrix-synapse = {
+        enable = true;
+        settings.server_name = domain;
+        # The public base URL value must match the `base_url` value set in `clientConfig` above.
+        # The default value here is based on `server_name`, so if your `server_name` is different
+        # from the value of `matrix.<domain>` above, you will likely run into some mismatched domain names
+        # in client applications.
+        settings.public_baseurl = baseUrl;
+        extraConfigFiles = [ "/run/secrets/matrix-shared-secret" ];
+        settings.listeners = [
+          {
+            port = 8008;
+            bind_addresses = [ "::1" ];
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+            #resources = [{
+            #  names = [ "client" "federation" ];
+            #  compress = true;
+            #}];
+            resources = [
+              {
+                names = [ "client" ];
+                compress = true;
+              }
+              {
+                names = [ "federation" ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+      };
+
+
     };
   };
 
@@ -43,7 +125,47 @@ in
     recommendedGzipSettings = true;
     recommendedProxySettings = true;
     virtualHosts = {
-      "${fqdn}" = {
+      # If the A and AAAA DNS records on example.org do not point on the same host as the
+      # records for myhostname.example.org, you can easily move the /.well-known
+      # virtualHost section of the code to the host that is serving example.org, while
+      # the rest stays on myhostname.example.org with no other changes required.
+      # This pattern also allows to seamlessly move the homeserver from
+      # myhostname.example.org to myotherhost.example.org by only changing the
+      # /.well-known redirection target.
+
+      #"${domain}" = {
+      #  enableACME = true;
+      #  forceSSL = true;
+      #  # This section is not needed if the server_name of matrix-synapse is equal to
+      #  # the domain (i.e. example.org from @foo:example.org) and the federation port
+      #  # is 8448.
+      #  # Further reference can be found in the docs about delegation under
+      #  # https://element-hq.github.io/synapse/latest/delegate.html
+      #  locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+      #  # This is usually needed for homeserver discovery (from e.g. other Matrix clients).
+      #  # Further reference can be found in the upstream docs at
+      #  # https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient
+      #  locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+      #};
+
+      "matrix.${domain}" = {
+        listen = [
+          {
+            addr = "0.0.0.0";
+            port = 80;
+          }
+          {
+            addr = "0.0.0.0";
+            port = 443;
+            ssl = true;
+          }
+          # for federation
+          {
+            addr = "0.0.0.0";
+            port = 8443;
+            ssl = true;
+          }
+        ];
         enableACME = true;
         forceSSL = true;
         # It's also possible to do a redirect here or something else, this vhost is not
@@ -56,33 +178,25 @@ in
         # *must not* be used here.
         locations."/_matrix".proxyPass = "http://[::1]:8008";
         # Forward requests for e.g. SSO and password-resets.
-        locations."/_synapse/client".proxyPass = "http://[::1]:8008";
+        #locations."/_synapse/client".proxyPass = "http://[::1]:8008";
+      };
+      "element.${domain}" = {
+        forceSSL = true;
+        enableACME = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_read_timeout 600;
+        '';
+        #  locations."/_matrix".proxyPass = "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+        #  # for remote admin access
+        #  locations."/_synapse".proxyPass = "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
+        locations."/".root = element-web;
       };
     };
+
   };
 
-  services.matrix-synapse = {
-    enable = true;
-    settings.server_name = config.networking.domain;
-    # The public base URL value must match the `base_url` value set in `clientConfig` above.
-    # The default value here is based on `server_name`, so if your `server_name` is different
-    # from the value of `fqdn` above, you will likely run into some mismatched domain names
-    # in client applications.
-    settings.public_baseurl = baseUrl;
-    settings.listeners = [
-      {
-        port = 8008;
-        bind_addresses = [ "::1" ];
-        type = "http";
-        tls = false;
-        x_forwarded = true;
-        resources = [{
-          names = [ "client" "federation" ];
-          compress = true;
-        }];
-      }
-    ];
-  };
 
   # $ nix-shell -p dendrite --run 'generate-keys --private-key /tmp/key'
   #sops.secrets.matrix-server-key = { };
@@ -152,19 +266,6 @@ in
   #  "matrix-server-key:${config.sops.secrets.matrix-server-key.path}"
   #];
 
-  #services.nginx.virtualHosts.${nginx-vhost} = {
-  #  forceSSL = true;
-  #  enableACME = true;
-  #  extraConfig = ''
-  #    proxy_set_header Host $host;
-  #    proxy_set_header X-Real-IP $remote_addr;
-  #    proxy_read_timeout 600;
-  #  '';
-  #  locations."/_matrix".proxyPass = "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
-  #  # for remote admin access
-  #  locations."/_synapse".proxyPass = "http://127.0.0.1:${toString config.services.dendrite.httpPort}";
-  #  locations."/".root = element-web-terranix.org;
-  #};
 
   #services.nginx.virtualHosts.${server_name} = {
   #  locations."= /.well-known/matrix/server".alias =