diff --git a/nixos/roles/matrix.nix b/nixos/roles/matrix.nix
index ea2437d..cd74d11 100644
--- a/nixos/roles/matrix.nix
+++ b/nixos/roles/matrix.nix
@@ -1,14 +1,21 @@
-{ pkgs, config, ... }:
-let
-  serverIP = builtins.head (
-    builtins.match "([0-9.]+)/.*" config.systemd.network.networks."10-ethernet".networkConfig.Address
-  );
-in
+{ config, ... }:
 {
-  networking.firewall.allowedTCPPorts = [
-    8008
-    8448
-  ];
+  networking.firewall = {
+    allowedTCPPorts = [
+      8008
+      8448
+      3478
+    ];
+    allowedUDPPorts = [
+      3478
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 49152;
+        to = 65535;
+      }
+    ];
+  };
 
   sops.secrets = {
     matrix_macaroon_secret = { };
@@ -16,37 +23,74 @@ in
       owner = "matrix-synapse";
       group = "matrix-synapse";
     };
+    matrix_turn_secret = {
+      owner = "matrix-synapse";
+      group = "matrix-synapse";
+    };
   };
 
-  services.matrix-synapse = {
-    enable = true;
-    settings = {
-      server_name = "cyperpunk.de";
-      public_baseurl = "http://matrix.cyperpunk.de";
-      enable_registration = false; # TODO: disable
-      enable_registration_without_verfication = true;
-      trusted_key_servers = [ { server_name = "matrix.org"; } ];
-      suppress_key_server_warning = true;
-      registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
-      macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
-      listeners = [
-        {
-          port = 8008;
-          bind_addresses = [ "0.0.0.0" ];
-          type = "http";
-          tls = false;
-          x_forwarded = true;
-          resources = [
-            {
-              names = [
-                "client"
-                "federation"
-              ];
-              compress = false;
-            }
-          ];
-        }
-      ];
+  services = {
+    matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "cyperpunk.de";
+        public_baseurl = "https://matrix.cyperpunk.de";
+        enable_registration = true; # TODO: disable
+        enable_registration_without_verification = true;
+        trusted_key_servers = [ { server_name = "matrix.org"; } ];
+        suppress_key_server_warning = true;
+        registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
+        macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
+
+        # TURN configuration
+        turn_uris = [
+          "turn:turn.cyperpunk.de?transport=udp"
+          "turn:turn.cyperpunk.de?transport=tcp"
+        ];
+        turn_shared_secret_path = config.sops.secrets.matrix_turn_secret.path;
+        turn_user_lifetime = "1h";
+        experimental_features = {
+          "msc3266_enabled" = true;
+        };
+        extra_well_known_client_content = {
+          "io.element.call.backend" = {
+            url = "https://call.element.io";
+          };
+        };
+
+        listeners = [
+          {
+            port = 8008;
+            bind_addresses = [ "0.0.0.0" ];
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+            resources = [
+              {
+                names = [
+                  "client"
+                  "federation"
+                ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+      };
+    };
+
+    coturn = {
+      enable = true;
+      no-cli = true;
+      no-tcp-relay = true;
+      min-port = 49152;
+      max-port = 65535;
+      use-auth-secret = true;
+      static-auth-secret-file = config.sops.secrets.matrix_turn_secret.path;
+      realm = "turn.cyperpunk.de";
+      extraConfig = ''
+        no-multicast-peers
+      '';
     };
   };
 }
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 532c4c7..6b918a6 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -3,6 +3,7 @@ OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNF
 grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str]
 matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
 matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
+matrix_turn_secret: ENC[AES256_GCM,data:HdcVJ8BjPLjjCXe8Q+lNo3R6wOiLkIaP/IABWQJKKuFmS3h+eu60naUtOPeht83Ko9dLlkgQhGJzoL8k1OyrFg==,iv:5NX6jc8Iuf9LKkqGVCNW81qPW55DN5qRiVtA+5sxgF8=,tag:jnan7xem74sC5d2aoCJ3Zw==,type:str]
 vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9yamwDV7cTSRRp3n3O2VjDKTcI5Vo6RP2QUjcqUqYf98cZ09wDMc+6+oHHJke7+O0FgRgOC0vOQFs4bfZCBJBLxogrGiwtLGkyykR6VYhrT64AN3CbrXflj82OED2Hl8WwEdruBzGIcfnh6FqQowDx6vDR/kXXJHk=,iv:PJQo5V7FaKPQ+GzZNsy3KB+xyjcDKJ1UBHErrqgn/1U=,tag:BRIDJEDOAeToqio/DHMQaA==,type:str]
 flame_password: ENC[AES256_GCM,data:1rNB2CskrMV3EYII+0JfZVDvZE8=,iv:pHJtc+1YSPRYrZG97X3r0+x/cPPUlr8jO+0w2HR+VNw=,tag:qQ/1IPxweBt9iIH4Zsh7+A==,type:str]
 flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
@@ -24,7 +25,7 @@ sops:
             N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-11T21:27:16Z"
-    mac: ENC[AES256_GCM,data:6uKae66muzkB8qPMUSkya4r4wA4oYnNttu+Md0USTHyY0VlMZefucfgpPGr79JC4l0u99kVRNyEqIY1kp/tdspeKHtGfpWmX4Djx/jMOSPWfzX99Y9ICC9KIdZgYdVJeGiwJKZUEHU0vlAopFGODQ2++sHqjrIAxO1EkGFkAgRA=,iv:Z00NF38aNk26n8+d+3b2bKFJjlN5LVWplyyE6ED9rUw=,tag:5xdT9q0dQXW/SA3CduzJug==,type:str]
+    lastmodified: "2026-04-14T14:21:09Z"
+    mac: ENC[AES256_GCM,data:+h/eJT7L80PLXN9rFf0wBz5P1rbIptv+BVj1Q0sbILRodOEfO59ztXoHmlQWeO44FdGTE3ID1/WGBDBxqBn4/QuzEWe4ToaMWlpsBCmCBlpG5zNeO7cLk7s178z6Jm+2ZIyNdoZ0x/LU2urpdUMYFQnNr5B5oZJfNxPpHwRpeew=,iv:PMiGyuVmHhKHGcxAN99GwM5OTv8FLAXPTZEjJJdg/FM=,tag:uavEchiQnwejxV2jTfZ6hw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2