BLUEPRINT_ID // WG-001SOVEREIGN_ARCH

The Escape Route: Sovereign Private Chat

Deploying a sovereign, end-to-end encrypted Matrix homeserver (Tuwunel) backed by an enterprise Identity provider (Keycloak) on your own hardware.

TARGET OS: Headless Linux

IDENTITY / SSO: Keycloak (2FA)

PROTOCOL: Matrix (Rust)

RUNTIME: Docker Compose

docker-compose.yml

version: '3.8'

services:
  postgres:
    image: postgres:15-alpine
    container_name: keycloak_db
    restart: unless-stopped
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: your_secure_db_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - private_chat_net

  keycloak:
    image: quay.io/keycloak/keycloak:24.0
    container_name: keycloak_auth
    restart: unless-stopped
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: your_secure_db_password
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: your_secure_admin_password
    command: start-dev
    ports:
      - "8080:8080"
    depends_on:
      - postgres
    networks:
      - private_chat_net

  tuwunel:
    image: tuwunel/tuwunel:latest
    container_name: matrix_homeserver
    restart: unless-stopped
    # [Insert your custom Tuwunel parameters here]
    depends_on:
      - keycloak
    networks:
      - private_chat_net

networks:
  private_chat_net:
    driver: bridge

volumes:
  postgres_data:

Deployment Protocol

Deploy your headless Linux server and establish key-based SSH logins. Disable password authentication entirely inside your sshd config.
Install the Docker Engine and Docker Compose plugin.
Save the YAML above as docker-compose.yml.
Launch the enclave in the background using docker compose up -d.
Establish an encrypted Cloudflare Tunnel mapping your domain straight to your local instance.
Log into Keycloak to enforce Two-Factor Authentication and configure your Matrix client redirect URI.