techlist.io
KREN
cloudflare

Building a serverless, post-quantum Matrix homeserver (opens in new tab)

typescriptcloudflare-workersserverlesspost-quantum-cryptographydurable-objectscloudflare-d1honomatrix

The post describes a proof-of-concept Matrix homeserver ported from Synapse to Cloudflare Workers. It replaces traditional VPS, PostgreSQL, Redis, and filesystem infrastructure with Workers, Durable Objects, D1, KV, and R2, reducing operational overhead and allowing costs to fall near zero when idle. The design also provides post-quantum TLS automatically while preserving Matrix’s end-to-end encryption, though the homeserver still exposes metadata.

From Synapse to Cloudflare Workers

  • Traditional Synapse deployments depend on:
    • PostgreSQL for persistent state
    • Redis for caching
    • Filesystem storage for media
    • VPS infrastructure and operational maintenance
  • The proof of concept reimplemented core Matrix functionality in TypeScript with Hono, including:
    • Event authorization
    • Room state resolution
    • Cryptographic verification
  • Cloudflare services replace the traditional components:
    • Durable Objects provide strongly consistent, atomic coordination.
    • D1 replaces PostgreSQL.
    • KV replaces Redis.
    • R2 replaces filesystem-based media storage.

Benefits of a Serverless Homeserver

  • Deployment becomes a single wrangler deploy command.
  • Cloudflare provides TLS termination, load balancing, DDoS protection, and global distribution.
  • Request-based pricing means the homeserver can cost almost nothing during periods of inactivity.
  • Workers execute close to users in more than 300 locations, reducing latency for globally distributed communities.
  • Built-in security features reduce the need to configure firewalls, rate limiting, WAF rules, and IP reputation systems manually.

Post-Quantum TLS and Matrix Encryption

  • Cloudflare’s TLS 1.3 connections use hybrid X25519MLKEM768.
  • This combines:
    • X25519, a classical elliptic-curve algorithm
    • ML-KEM, a lattice-based post-quantum algorithm standardized by NIST
  • The hybrid design requires both cryptographic systems to be broken before the connection is compromised.
  • Traditional deployments would need to upgrade cryptographic libraries, configure cipher suites, test client compatibility, and monitor negotiation failures.
  • Workers provide this protection automatically through Cloudflare’s infrastructure.

How Messages Are Protected

  • Matrix clients encrypt messages locally using Megolm before sending them.
  • The encrypted Megolm payload is then transported over TLS using post-quantum hybrid key agreement.
  • The Worker terminates TLS but receives only ciphertext, which it stores and routes without seeing plaintext.
  • Recipients download the ciphertext over another protected TLS connection and decrypt it locally.
  • This creates two independent encryption layers:
    • TLS protects data in transit.
    • Megolm end-to-end encryption protects message contents from the homeserver and infrastructure providers.

Metadata and Privacy Limits

  • The homeserver operator can still observe metadata, including:
    • Room membership
    • Room existence
    • Message timing
    • Other routing and account information
  • Message contents remain inaccessible because they are encrypted before reaching the server.
  • Encrypted-room media is also encrypted client-side, and private keys remain on user devices.

Storage Architecture

  • The design assigns each storage primitive to the consistency model it supports best.
  • D1 stores durable, queryable Matrix data, including users, rooms, events, and device keys across more than 25 tables.
  • Durable Objects handle real-time coordination and the strong consistency needed for Matrix state resolution.
  • KV provides cache-like storage, while R2 handles media and filesystem-style objects.

The project demonstrates that a Matrix homeserver can be made substantially easier to operate with serverless infrastructure while gaining globally distributed execution and automatic post-quantum transport security. It remains a personal proof of concept, so production deployments should evaluate feature completeness, scalability, compatibility, and the privacy implications of relying on Cloudflare.