diff --git a/modules/matrix.nix b/modules/matrix.nix
new file mode 100644
index 0000000..6981690
--- /dev/null
+++ b/modules/matrix.nix
@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  services.matrix-synapse = {
+    enable = false;
+    configureRedisLocally = true;
+    withJemalloc = true;
+    settings = {
+      enable_metrics = true;
+      enable_registration = true;
+      dynamic_thumbnails = true;
+      max_upload_size = "100M";
+      public_baseurl = "https://matrix.tfcconnection.org/";
+      server_name = "tfcconnection.org";
+    };
+  };
+}
diff --git a/system/shen/configuration.nix b/system/shen/configuration.nix
index 378c66b..13d3ca8 100644
--- a/system/shen/configuration.nix
+++ b/system/shen/configuration.nix
@@ -141,8 +141,8 @@
 	    encode gzip
 	    reverse_proxy localhost:8080
 	
-      redir /.well-known/carddav /remote.php/carddav 301
-      redir /.well-known/caldav /remote.php/caldav 301
+      redir /.well-known/carddav /remote.php/dav 301
+      redir /.well-known/caldav /remote.php/dav 301
       header {
               Strict-Transport-Security "max-age=15768000; includeSubDomains; reload;"
               Access-Control-Allow-Origin *
@@ -268,17 +268,11 @@
     virtualHosts = {
       "tfcconnection.com".extraConfig = ''
         redir https://tfcconnection.org
-        header {
-              Access-Control-Allow-Origin *
-        }
       '';
     };
     virtualHosts = {
       "www.tfcconnection.org".extraConfig = ''
         redir https://tfcconnection.org
-        header {
-              Access-Control-Allow-Origin *
-        }
       '';
     };
     virtualHosts = {
@@ -316,7 +310,8 @@
         encode gzip
         reverse_proxy 127.0.0.1:4242
         header {
-          Access-Control-Allow-Origin *
+          Access-Control-Allow-Origin https://tfcconnection.org
+          Access-Control-Allow-Headers *
         }
       '';
     };