{
  flake.nixosModules.matrix = {
    config,
    lib,
    ...
  }: let
    cfg = config.hive.matrix;
    ketesa-web-root = fetchTarball {
      url = "https://github.com/etkecc/ketesa/releases/download/v1.4.0/ketesa.tar.gz";
      sha256 = "sha256:0za0rddcbxn2ra4xlykn7v8b4j0ddyacivyzp91m80r071ds1dk7";
    };
  in {
    options.hive.matrix = {
      enable = lib.mkEnableOption "Enable matrix server (synapse)";

      localPort = lib.mkOption {
        type = lib.types.int;
        default = 8474;
        description = "The internal port of the synapse server";
      };

      ketesaLocalPort = lib.mkOption {
        type = lib.types.int;
        default = 8475;
        description = "The internal port of the ketesa virtual host";
      };

      hiddenServiceHostnameSopsKey = lib.mkOption {
        type = lib.types.str;
        description = "The sops key of the secret containing the hostname of the hidden service";
      };
      hiddenServiceSecret = lib.mkOption {
        type = lib.types.path;
        description = "The file containing the hidden service's secret";
      };
      ketesaHiddenServiceSecret = lib.mkOption {
        type = lib.types.path;
        description = "The file containing the ketesa hidden service's secret";
      };
    };

    config = lib.mkIf cfg.enable {
      # Database setup
      services.postgresql = {
        enable = true;
      };

      # Hidden service
      services.tor = {
        enable = true;
        enableGeoIP = false;
        relay.onionServices.matrix = {
          secretKey = cfg.hiddenServiceSecret;
          version = 3;
          map = [
            {
              port = 80;
              target = {
                addr = "[::1]";
                port = cfg.localPort;
              };
            }
          ];
        };
        relay.onionServices.ketesa = {
          secretKey = cfg.ketesaHiddenServiceSecret;
          version = 3;
          map = [
            {
              port = 80;
              target = {
                addr = "127.0.0.1";
                port = cfg.ketesaLocalPort;
              };
            }
          ];
        };
      };

      # Virtual host for ketesa
      services.nginx.virtualHosts."ketesa-localhost" = {
        listen = [
          {
            addr = "127.0.0.1";
            port = cfg.ketesaLocalPort;
          }
        ];
        forceSSL = false;
        enableACME = false;
        root = "${ketesa-web-root}";
      };

      # Secret hostname for matrix-synapse
      sops.templates."hidden-matrix-synapse".owner = "matrix-synapse";
      sops.templates."hidden-matrix-synapse".content = ''
        server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
        public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
      '';

      # Synapse
      services.matrix-synapse = {
        enable = true;
        settings.listeners = [
          {
            port = cfg.localPort;
            bind_addresses = ["::1"];
            type = "http";
            tls = false;
            x_forwarded = false;
            resources = [
              {
                names = [
                  "client"
                ];
                compress = false;
              }
            ];
          }
        ];
        settings = {
          enable_registration = true;
          registration_requires_token = true;
          report_stats = false;
          federation_domain_whitelist = [];
          federation_ip_range_blacklist = ["0.0.0.0/0"];
        };

        extraConfigFiles = [
          config.sops.templates."hidden-matrix-synapse".path
        ];
      };
    };
  };
}