// Wiredgeist Blueprint WG-001

The Escape Route

Deploying a sovereign, end-to-end encrypted Matrix homeserver (Tuwunel) backed by an enterprise-grade Identity provider (Keycloak) on your own hardware.

Target OS Headless Ubuntu

Identity/SSO Keycloak (2FA)

Protocol Matrix (Rust)

Runtime Docker Compose

docker-compose.yml

version: '3.8'

services:
  postgres:
    image: postgres:15-alpine
    container_name: keycloak_db
    restart: unless-stopped
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: your_secure_db_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - private_chat_net

  keycloak:
    image: quay.io/keycloak/keycloak:24.0
    container_name: keycloak_auth
    restart: unless-stopped
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: your_secure_db_password
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: your_secure_admin_password
    command: start-dev
    ports:
      - "8080:8080"
    depends_on:
      - postgres
    networks:
      - private_chat_net

  tuwunel:
    image: tuwunel/tuwunel:latest
    container_name: matrix_homeserver
    restart: unless-stopped
    # [Insert your custom Tuwunel settings here]
    depends_on:
      - keycloak
    networks:
      - private_chat_net

networks:
  private_chat_net:
    driver: bridge

volumes:
  postgres_data:

Deployment Workflow

Deploy your Ubuntu 24.04 server and establish secure, key-based SSH logins. Disable password authentication entirely inside your sshd config.
Install the Docker Engine and Docker Compose.
Save the YAML above as docker-compose.yml on your server.
Launch the infrastructure in the background using docker compose up -d.
Establish a secure outbound tunnel on your Cloudflare dashboard, mapping your domain address straight to your local instance.
Access Keycloak to set up your admin credentials, define your Matrix Client redirect URI, and enforce Two-Factor Authentication.