diff --git a/hosts/quasar/default.nix b/hosts/quasar/default.nix
index fc8a69b..e997ebf 100644
--- a/hosts/quasar/default.nix
+++ b/hosts/quasar/default.nix
@@ -5,6 +5,7 @@
     nixosModules.nettika
     nixosModules.promptmoji
     agenix.nixosModules.default
+    ./matrix.nix
   ];
 
   nixpkgs.config.allowUnfree = true;
@@ -26,58 +27,14 @@
 
   environment.systemPackages = [ pkgs.htop ];
 
-  age.secrets = {
-    matrix-synapse-secrets = {
-      file = ./secrets/matrix-synapse-secrets.yaml;
-      mode = "400";
-      owner = "matrix-synapse";
-    };
-  };
-
   services.postgresql.enable = true;
 
   services.caddy = {
     enable = true;
-    virtualHosts = {
-      "quasar.leaf.ninja".extraConfig = ''
-        respond "quasar is online"
-        header Strict-Transport-Security: "max-age=63072000; includeSubDomains"
-      '';
-      "consortium.chat".extraConfig = ''
-        respond /.well-known/matrix/server <<JSON
-          {
-            "m.server": "matrix.consortium.chat:443"
-          }
-          JSON 200
-        respond /.well-known/matrix/client <<JSON
-          {
-            "m.homeserver": {
-              "base_url": "https://matrix.consortium.chat"
-            }
-          }
-          JSON 200
-        reverse_proxy localhost:8008
-        header Strict-Transport-Security "max-age=63072000; includeSubDomains"
-      '';
-      "matrix.consortium.chat".extraConfig = ''
-        reverse_proxy /_matrix/* localhost:8008
-        reverse_proxy /_synapse/client/* localhost:8008
-      '';
-      "admin.consortium.chat".extraConfig = ''
-        root * ${pkgs.synapse-admin}
-        file_server
-      '';
-    };
-  };
-
-  services.matrix-synapse = {
-    enable = true;
-    settings = {
-      server_name = "consortium.chat";
-      database_type = "psycopg2";
-      database_args.database = "matrix-synapse";
-    };
-    extraConfigFiles = [ config.age.secrets.matrix-synapse-secrets.path ];
+    virtualHosts."quasar.leaf.ninja".extraConfig = ''
+      respond "quasar is online"
+      header Strict-Transport-Security: "max-age=63072000; includeSubDomains"
+    '';
   };
 
   programs.fish.enable = true;
diff --git a/hosts/quasar/matrix.nix b/hosts/quasar/matrix.nix
new file mode 100644
index 0000000..9bb6fa5
--- /dev/null
+++ b/hosts/quasar/matrix.nix
@@ -0,0 +1,46 @@
+{ pkgs, config, ... }:
+let
+  canonicalDomain = "consortium.chat";
+  delegatedDomain = "matrix.consortium.chat";
+  adminAppDomain = "admin.consortium.chat";
+in {
+  age.secrets.matrix-synapse-secrets = {
+    file = ./secrets/matrix-synapse-secrets.yaml;
+    owner = "matrix-synapse";
+    mode = "400";
+  };
+
+  services.matrix-synapse = {
+    enable = true;
+    settings = {
+      server_name = "consortium.chat";
+      database_type = "psycopg2";
+      database_args.database = "matrix-synapse";
+    };
+    extraConfigFiles = [ config.age.secrets.matrix-synapse-secrets.path ];
+  };
+
+  services.caddy.virtualHosts = {
+    ${canonicalDomain}.extraConfig = let
+      wellknown = {
+        server = builtins.toJSON { "m.server" = "${delegatedDomain}:443"; };
+        client = builtins.toJSON {
+          "m.homeserver".base_url = "https://${delegatedDomain}";
+        };
+      };
+    in ''
+      respond /.well-known/matrix/server `${wellknown.server}` 200
+      respond /.well-known/matrix/client `${wellknown.client}` 200
+      reverse_proxy localhost:8008
+      header Strict-Transport-Security "max-age=63072000; includeSubDomains"
+    '';
+    ${delegatedDomain}.extraConfig = ''
+      reverse_proxy /_matrix/* localhost:8008
+      reverse_proxy /_synapse/client/* localhost:8008
+    '';
+    ${adminAppDomain}.extraConfig = ''
+      root * ${pkgs.synapse-admin}
+      file_server
+    '';
+  };
+}