← back to home
root@souverainete:~$ cat etude-de-cas/matrix.md
case study — stack: matrix

Leaving Slack without losing control of your communication

Deployment of a complete Matrix/Synapse infrastructure — two dedicated servers, bridges to WhatsApp and Telegram, a shared database — for an organization that wanted to keep its conversations in-house, without sacrificing ease of use.

Type of organizationNon-profit, 40 employees
TriggerSlack contract ending
Key constraintNo data outside the EU
StackDebian · Docker · Ansible
// context

The problem

The organization had been using Slack for several years. As the contract renewal approached, management wanted to evaluate an alternative hosted in Europe — without giving up what employees already used daily: team discussions, direct messages, and above all the WhatsApp groups used with external partners who, themselves, would not switch tools.

The real challenge wasn't just replacing Slack, but doing so without forcing a break on external contacts — which steered the choice towards Matrix with application bridges rather than a simple migration.

// stakes

What had to be reconciled

Sovereignty

No data hosted outside the European Union, hosting provider chosen and audited by the organization itself.

Continuity

External contacts on WhatsApp and Telegram shouldn't have to change anything about their habits.

Security

Strict separation between internal accounts and bridges to third-party services.

Scalability

Being able to add a future bridge (Signal, Discord) without reworking the whole architecture.

// architecture

The choices that shape the deployment

// 4 dedicated VMs — database, user homeserver, homeserver + bridges, shared infrastructure (outside the role's scope)
Separating users / bridges

The homeserver used daily by employees runs isolated from the homeserver that carries the bridges — an outage or update of a WhatsApp bridge can never affect internal messaging.

Shared database

A single PostgreSQL VM, one database per component, adding a future component is a single variable entry away — no new Ansible task, no server restart.

Proxy stays out of scope

The role never manages the reverse proxy, DNS, or TLS certificates — those responsibilities stay within the organization's shared infrastructure, keeping the role reusable elsewhere.

Tokens never regenerated

Bridge authentication tokens are generated once and kept — replaying the deployment never breaks an already active connection.

// implementation

What was done

01

Provisioning the 4 VMs

Database, user homeserver, homeserver + bridges, shared infrastructure — each with a single, documented role.

02

Deploying Synapse as two instances

One homeserver for internal accounts, a second dedicated to the bridges — never mixed, never on the same application base.

03

Connecting the WhatsApp and Telegram bridges

Each bridge in its own container, its own database, its own registration file — adding the next bridge without touching the existing ones.

04

Validation under real conditions

Checking that every bot responds and that messages flow both ways, before any team switches over.

05

Gradual rollout across teams

Migration team by team, with Slack kept in read-only mode while everyone got comfortable with Element.

// result

What it changes

All messaging data stays hosted in Europe, on infrastructure the organization keeps the key to — while external contacts on WhatsApp or Telegram noticed nothing about the change.

0disruption felt by external contacts
4VMs deployed reproducibly and documented
1command to add a future bridge
// limits

What stays out of scope

The business-level configuration of each bridge (WhatsApp QR-code pairing, Telegram linking) remains a manual step specific to each account — not automatable on the infrastructure side.

The reverse proxy, DNS, and TLS certificates aren't managed by this deployment — they belong to the organization's existing shared infrastructure.

Strong authentication (SSO/MFA) isn't integrated on this installation yet — a possible follow-up project with an identity provider the organization would validate itself.

Message backups are delegated to the hosting provider's existing backup policy — this deployment doesn't reinvent what's already handled correctly.

ansible-role-matrix-stack
The complete Ansible role, documented and open source, used for this deployment.
View the code on GitHub →

A similar need for sovereign communication?

Every organization has its own constraints — let's talk about yours before talking about a solution.

Get in touch →