diff --git a/services/matrix-synapse.nix b/services/matrix-synapse.nix
index fcb61b2..49151da 100644
--- a/services/matrix-synapse.nix
+++ b/services/matrix-synapse.nix
@@ -15,54 +15,70 @@
   services.nginx = {
     enable = true;
     # only recommendedProxySettings and recommendedGzipSettings are strictly required,
-    # but the rest make sense as well
+    # but the rest make sense as well (according to the broken example from the manual)
     recommendedTlsSettings = true;
     recommendedOptimisation = true;
     recommendedGzipSettings = true;
     recommendedProxySettings = true;
 
     virtualHosts = {
+
       # This host section can be placed on a different host than the rest,
-      # i.e. to delegate from the host being accessible as ${config.networking.domain}
-      # to another host actually running the Matrix homeserver.
+      # i.e. to delegate from the host on which matrix / synapse actually run.
+      # This may make migration easier; in our case it's mostly added complexity.
       "hacc.space" = {
-        locations."= /.well-known/matrix/server".extraConfig =
-          let
-            # use 443 instead of the default 8448 port to unite
-            # the client-server and server-server port for simplicity
-            server = { "m.server" = "matrix.hacc.space:443"; };
-          in ''
-            add_header Content-Type application/json;
-            return 200 '${builtins.toJSON server}';
-          '';
+        # see https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
+        # for documentation on what should be returned at these endpoints.
+        locations."= /.well-known/matrix/server".extraConfig = ''
+          add_header Content-Type application/json;
+          return 200 '${builtins.toJSON  { "m.server" = "matrix.hacc.space:443"; }}';
+        '';
+        # this is to configure the nice default homeserver setting for our element web.
         locations."= /.well-known/matrix/client".extraConfig =
-          let
-            client = {
-              "m.homeserver" =  { "base_url" = "https://matrix.hacc.space"; };
-              "m.identity_server" =  { "base_url" = "https://vector.im"; };
-            };
-          # ACAO required to allow element-web on any URL to request this json file
-          in ''
-            add_header Content-Type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON client}';
-          '';
+          let client = {
+            "m.homeserver" =  { "base_url" = "https://matrix.hacc.space"; };
+            "m.identity_server" =  { "base_url" = "https://vector.im"; };
+          };
+        in ''
+          add_header Content-Type application/json;
+          add_header Access-Control-Allow-Origin *;
+          return 200 '${builtins.toJSON client}';
+        '';
       };
 
-      # Reverse proxy for Matrix client-server and server-server communication
+
+      # this serves the actual matrix endpoint
       "matrix.hacc.space" = {
         enableACME = true;
         forceSSL = true;
 
-        # Or do a redirect instead of the 404, or whatever is appropriate for you.
-        # But do not put a Matrix Web client here! See the Element web section below.
+        # it is not recommended to have the actual element web interface on the same domain,
+        # cf. https://github.com/vector-im/element-web#separate-domains on this.
         locations."/".extraConfig = ''
           return 404;
         '';
 
-        # forward all Matrix API calls to the synapse Matrix homeserver
         locations."/_matrix" = {
-          proxyPass = "http://[::1]:8008"; # without a trailing /
+          proxyPass = "http://[::1]:8008";
+        };
+      };
+
+
+      # the element web client for our matrix server.
+      "element.matrix.hacc.space" = {
+        enableACME = true;
+        forceSSL = true;
+        serverAliases = [
+          "element.hacc.space"
+        ];
+        root = pkgs.element-web.override {
+          conf = {
+            # the base_url here must be identical to the one on hacc.space/.well-known above.
+            default_server_config."m.homeserver" = {
+              "base_url" = "https://matrix.hacc.space";
+              "server_name" = "matrix.hacc.space";
+            };
+          };
         };
       };
     };
@@ -71,43 +87,16 @@
   services.matrix-synapse = {
     enable = true;
     server_name = "hacc.space";
-    # TODO: this is horrible, and should probably be removed once everything's running
-    # so we won't have secrets in the nix store.
-    #
-    # I used this to test that the server works at all, and I've removed it again for now.
-    registration_shared_secret = "";
-    listeners = [
-      {
-        port = 8008;
-        bind_address = "::1";
-        type = "http";
-        tls = false;
-        x_forwarded = true;
-        resources = [
-          {
-            names = [ "client" "federation" ];
-            compress = false;
-          }
-        ];
-      }
-    ];
-  };
-
-  services.nginx.virtualHosts."element.matrix.hacc.space" = {
-    enableACME = true;
-    forceSSL = true;
-    serverAliases = [
-      "element.hacc.space"
-    ];
-    root = pkgs.element-web.override {
-      conf = {
-        default_server_config."m.homeserver" = {
-          "base_url" = "https://matrix.hacc.space";
-          "server_name" = "matrix.hacc.space";
-        };
-      };
-    };
-
-    #locations."= /config.element.matrix.hacc.space.json".alias = element.outPath + "/config.json";
+    listeners = [ {
+      port = 8008;
+      bind_address = "::1";
+      type = "http";
+      tls = false;
+      x_forwarded = true;
+      resources = [ {
+        names = [ "client" "federation" ];
+        compress = false;
+      } ];
+    } ];
   };
 }