Choose names before launch
Plan the server name, delegation and client discovery. Some identity choices are difficult to change later. Verify federation with an external test instead of checking only the login page.
Start with realistic resources
The Guardian configuration can be evaluated for a modest deployment. Large federated rooms, retained events and media can substantially increase database and memory requirements.
Treat administration separately
Protect administrative interfaces, registration secrets and signing keys. Limit open registration where appropriate and keep supported software and dependencies current.
Describe the encryption boundary
Supported end-to-end encrypted rooms protect content between clients. The homeserver still handles useful metadata and any unencrypted content. Users need to understand client verification and recovery.
Plan retention and restoration
Set deliberate event and media retention, keep consistent database backups and preserve the configuration and signing keys needed for recovery. Test the result, not just the backup job.
Choose resources for this workload
Evaluate Guardian for a growing Synapse service with PostgreSQL and media storage. Room history, federation patterns and media retention can matter more than account count. Keep external client traffic and database access in separate security boundaries.
A homeserver rollout
Use the maintained upstream instructions for the selected release. The sequence below identifies the decisions and pass conditions to record in your own runbook.
- Choose the permanent server name before creating accounts
- Install a supported Synapse release and PostgreSQL configuration
- Set HTTPS and any well-known delegation required for the chosen name
- Restrict registration and protect administrator credentials
- Test client login, local messaging and an authorised federation path
- Back up signing keys, configuration, database and required media; rehearse restoration
Official documentation: Maintained upstream setup guidance
What to verify before relying on it
A private homeserver still shares federated room events with participating servers. Explain that boundary to users and verify the installed version’s retention and security settings.
A little more clarity.
Does this use case include a managed application installation?
No. It describes a workload for customer-administered infrastructure. Application setup, updates, moderation, licensing and recovery remain your responsibility unless a separate managed agreement says otherwise.