diff --git a/hosts/architect/matrix.nix b/hosts/architect/matrix.nix
index 38d24b2..2dfd288 100644
--- a/hosts/architect/matrix.nix
+++ b/hosts/architect/matrix.nix
@@ -1,28 +1,44 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 
 let
-  domain = "matrix.giugl.io";
-  webui_domain = "chat.giugl.io";
+  domain = "runas.rocks";
+  webui_domain = "webchat.runas.rocks";
   network = import ./network.nix;
-  db_name = "matrix-synapse";
-in {
+  db_name = "matrix-synapse-runas.rocks";
+in
+{
   services = {
     matrix-synapse = {
       enable = true;
       settings = {
         server_name = "${domain}";
-        database_name = db_name;
+        database.args.database = db_name;
         public_baseurl = "https://${domain}";
         registration_shared_secret = "runas!";
         url_preview_enabled = true;
         dynamic_thumbnails = true;
         withJemalloc = true;
-        #      enable_registration = true;
         app_service_config_files = [
           "/var/lib/matrix-synapse/discord-registration.yaml"
           #        "/var/lib/matrix-synapse/hookshot-registration.yml"
           #        "/var/lib/matrix-synapse/telegram-registration.yaml"
         ];
+
+        oidc_providers = [{
+          idp_id = "keycloak";
+          idp_name = "Architect SSO";
+          issuer = "https://auth.giugl.io/realms/master";
+          client_id = "synapse";
+          client_secret = "hj7dkbAI75jIeggr1cW0JTRzAdvJUtq6";
+          scopes = [ "openid" "profile" ];
+          user_profile_method = "userinfo_endpoint";
+          user_mapping_provider.config = {
+            localpart_template = "{{ user.preferred_username }}";
+            display_name_template = "{{ user.name }}";
+          };
+          backchannel_logout_enabled = true;
+        }];
+
         listeners = [{
           port = 8008;
           bind_addresses = [ "127.0.0.1" ];
@@ -35,18 +51,11 @@ in {
           }];
         }];
       };
-
-      #extraConfig = ''
-      #  auto_join_rooms:
-      #    - "#general:matrix.giugl.io"
-      #  max_upload_size: "50M"
-      #'';
     };
 
     postgresql = {
       enable = true;
       package = pkgs.postgresql;
-      ensureDatabases = [ db_name ];
       ensureUsers = [{
         name = db_name;
         ensurePermissions = { "DATABASE \"${db_name}\"" = "ALL PRIVILEGES"; };
@@ -63,22 +72,25 @@ in {
         '';
         locations."= /.well-known/matrix/server".extraConfig =
           let server = { "m.server" = "${domain}:443"; };
-          in ''
+          in
+          ''
             add_header Content-Type application/json;
             return 200 '${builtins.toJSON server}';
           '';
 
-        locations."= /.well-known/matrix/client".extraConfig = let
-          client = {
-            "m.homeserver" = { "base_url" = "https://${domain}:443"; };
-            "m.identity_server" = { "base_url" = "https://vector.im"; };
-          };
-          # ACAO required to allow element-web on any URL to request this json file
-        in ''
-          add_header Content-Type application/json;
-          add_header Access-Control-Allow-Origin *;
-          return 200 '${builtins.toJSON client}';
-        '';
+        locations."= /.well-known/matrix/client".extraConfig =
+          let
+            client = {
+              "m.homeserver" = { "base_url" = "https://${domain}:443"; };
+              "m.identity_server" = { "base_url" = "https://vector.im"; };
+            };
+            # ACAO required to allow element-web on any URL to request this json file
+          in
+          ''
+            add_header Content-Type application/json;
+            add_header Access-Control-Allow-Origin *;
+            return 200 '${builtins.toJSON client}';
+          '';
 
         locations."/".extraConfig = ''
           return 404;
@@ -88,6 +100,10 @@ in {
         locations."/_matrix" = {
           proxyPass = "http://127.0.0.1:8008"; # without a trailing /
         };
+
+        locations."/_synapse" = {
+          proxyPass = "http://127.0.0.1:8008"; # without a trailing /
+        };
       };
 
       # web client
@@ -114,7 +130,7 @@ in {
       # It's also possible to use PostgreSQL.
       settings = {
         bridge = {
-          domain = domain;
+          inherit domain;
           homeserverUrl = "https://${domain}";
         };
       };
@@ -122,8 +138,8 @@ in {
   };
 
   networking.extraHosts = ''
-    ${network.architect-lan} ${domain} ${webui_domain}
-    ${network.architect-wg} ${domain} ${webui_domain}
+    ${network.architect-lan} ${lib.concatStringsSep " " [ domain webui_domain]}
+    ${network.architect-wg} ${lib.concatStringsSep " " [ domain webui_domain ]}
   '';
 
 }