Skip to content

Merovingian

OMG SOFTWARE / MEROVINGIAN

A security-first Matrix homeserver

Merovingian is a Matrix homeserver written in modern C++26. Its design treats containment, fail-closed validation, narrow trust boundaries, and continuous security verification as core requirements rather than post-hoc hardening.

Read the user guide View the architecture Open the repository

Beta software

Merovingian is suitable for evaluation and testing. It is not yet production-ready and should not be deployed as a production Matrix homeserver until the blocking items in the production milestone are closed.

Why Merovingian

  • Security-first boundaries

    Federation handling, media decoding, secret storage, and configuration validation are designed around explicit trust boundaries and fail-closed behavior.

  • Process isolation

    Untrusted work is pushed into sandboxed worker processes with platform-specific confinement and resource limits.

  • Constrained C++ ownership

    Raw allocation and ownership primitives are mechanically restricted, with RAII, smart pointers, sanitizers, fuzzing, and static analysis used continuously.

  • Narrow cryptographic surface

    Cryptography is delegated to libsodium, signing material is encrypted at rest, and secret handling is explicitly bounded.

  • Continuous verification

    CI covers builds, static analysis, sanitizers, fuzzing, CodeQL, reproducibility, SBOM generation, secret scanning, and package workflows.

  • Operator-focused deployment

    Merovingian is designed for reverse-proxy deployments, strict configuration validation, structured logging, and auditable security-sensitive operations.

Start here

For operators, begin with the User guide. It covers installation, configuration, reverse proxies, database backends, first-run setup, upgrades, troubleshooting, and the security checklist.

For contributors, begin with the Development environment, then review the testing standards and security coding rules.

For design and security review, see the architecture, threat model, runtime hardening, cryptographic boundary, and the architecture decision records that explain why the code is shaped the way it is.

Production status

The project has been in beta since v0.10.59. Federation, persistence, packaging, and runtime security controls are implemented and covered by CI, but the project still has explicit blockers before a 1.0.0 production release.

See Road to 1.0 for the current release gates, capability gaps for per-area status, and the changelog for what changed in each version.

This site is rebuilt from main on every merge, so it always describes the latest merged code. The version it was built from is shown in the footer.