diff --git a/app/matrix/lib/matrix-ng.libsonnet b/app/matrix/lib/matrix-ng.libsonnet
index 91c92d2..a807a1a 100644
--- a/app/matrix/lib/matrix-ng.libsonnet
+++ b/app/matrix/lib/matrix-ng.libsonnet
@@ -212,6 +212,23 @@
                 authSecret: { secretKeyRef: { name: "coturn", key: "auth_secret" } },
             },
         },
+
+        postgres: {
+            # Deploy on-cluster postgres: a postgres instance backed by Ceph.
+            # Okay for tiny baby synapses, not okay for chonkers. If not
+            # enabled, bring your own external postgres.
+            enable: true,
+
+            # If not deploying on-cluster postgres, the following needs to be
+            # set.
+            host: error "host must be set with off-cluster postgres",
+            username: "synapse",
+            database: "synapse",
+            port: 5432,
+            # Default to the same password secret ref that is used for
+            # on-cluster postgres.
+            password: { secretKeyRef: { name: "synapse", key: "postgres_password" } },
+        },
     },
 
     # DEPRECATED: this needs to be removed in favor of namespace.Contain() in
@@ -227,7 +244,8 @@
 
     namespace: kube.Namespace(cfg.namespace),
 
-    postgres3: postgres {
+    postgres3: if cfg.postgres.enable then postgres {
+        local psql = self,
         cfg+: {
             namespace: cfg.namespace,
             appName: "synapse",
@@ -239,13 +257,18 @@
             storageSize: "100Gi",
             initdbArgs: "--encoding='UTF8' --lc-collate='C' --lc-ctype='C'",
 
+            # Doesn't influence postgres instance, but used by synapse
+            # libsonnet. Do not override.
+            port: psql.svc.port,
+            host: psql.svc.host,
+
             opts: {
                 max_connections: "300",
                 shared_buffers: "80MB",
                 wal_level: "logical",
             },
         },
-    },
+    } else {},
 
     redis: redis {
         cfg+: {
@@ -312,8 +335,13 @@
 
     synapse: synapse {
         ns: app.namespace,
-        postgres: app.postgres3,
-        redis: app.redis,
+        postgres: if cfg.postgres.enable then app.postgres3 else {
+            # If not using on-cluster postgres, pass the config postgres object
+            # as the postgres object into the synapse lib. It's a bit ugly (we
+            # should have some common 'config' type instead) but it's good
+            # enough.
+            cfg: cfg.postgres,
+        }, redis: app.redis,
         appservices: app.appservices,
         cfg+: app.cfg {
             image: app.cfg.images.synapse,