Update telephony-web image to v20260324d, resolve merge conflicts
This commit is contained in:
Andrew M. Stoltz
@@ -1,495 +1,495 @@
|
||||
# Matrix Synapse + Element Web
|
||||
# PostgreSQL 16 + Synapse homeserver + Element Web client
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
# DB credentials sourced from 1Password via OnePasswordItem CRD (matrix-credentials)
|
||||
# Synapse homeserver.yaml DB password injected at runtime via init container
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: matrix
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
# Synapse homeserver.yaml template ConfigMap
|
||||
# DB password placeholder __DB_PASSWORD__ is replaced at pod startup by init container
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: synapse-config
|
||||
namespace: matrix
|
||||
data:
|
||||
homeserver.yaml.template: |
|
||||
server_name: "iamworkin.lan"
|
||||
pid_file: /data/homeserver.pid
|
||||
public_baseurl: "https://matrix.iamworkin.lan/"
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
bind_addresses: ["0.0.0.0"]
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
user: __DB_USER__
|
||||
password: __DB_PASSWORD__
|
||||
database: synapse
|
||||
host: matrix-postgres
|
||||
port: 5432
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
log_config: "/config/log.config"
|
||||
media_store_path: /data/media_store
|
||||
registration_shared_secret: "a208f2e4b260f6b7d6ff4566df49c56c8b73fa20b911ce4e617b791ee7868adc"
|
||||
report_stats: false
|
||||
macaroon_secret_key: "9964f398e8b48a91469ad419d293c06db4562f49df8cc6e129fb3a801fd9052d"
|
||||
form_secret: "7b0a9dbaf9ee94450e0b3271c408dfc4d313a55843ce4eec2ac1bb0315ffeb76"
|
||||
signing_key_path: "/data/signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
enable_registration: false
|
||||
suppress_key_server_warning: true
|
||||
log.config: |
|
||||
version: 1
|
||||
formatters:
|
||||
precise:
|
||||
format: "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s"
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: precise
|
||||
loggers:
|
||||
synapse.storage.SQL:
|
||||
level: WARNING
|
||||
root:
|
||||
level: WARNING
|
||||
handlers: [console]
|
||||
disable_existing_loggers: false
|
||||
---
|
||||
# PostgreSQL 16 StatefulSet
|
||||
# Credentials from 1Password-synced matrix-credentials secret
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: matrix-postgres
|
||||
namespace: matrix
|
||||
labels:
|
||||
app: matrix-postgres
|
||||
spec:
|
||||
serviceName: matrix-postgres
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: matrix-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: matrix-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres:16-alpine
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-User
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-Password
|
||||
- name: POSTGRES_DB
|
||||
value: synapse
|
||||
- name: POSTGRES_INITDB_ARGS
|
||||
value: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
|
||||
volumeMounts:
|
||||
- name: matrix-postgres-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
subPath: pgdata
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ["pg_isready", "-U", "synapse"]
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["pg_isready", "-U", "synapse"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: matrix-postgres-data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: matrix-postgres
|
||||
namespace: matrix
|
||||
spec:
|
||||
selector:
|
||||
app: matrix-postgres
|
||||
ports:
|
||||
- port: 5432
|
||||
targetPort: 5432
|
||||
name: postgres
|
||||
clusterIP: None
|
||||
---
|
||||
# Synapse Data PVC
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: synapse-data
|
||||
namespace: matrix
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
# Synapse Deployment
|
||||
# Init container injects DB credentials from 1Password secret into homeserver.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: synapse
|
||||
namespace: matrix
|
||||
labels:
|
||||
app: synapse
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: synapse
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: synapse
|
||||
spec:
|
||||
initContainers:
|
||||
- name: generate-signing-key
|
||||
image: matrixdotorg/synapse:latest
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
if [ \! -f /data/signing.key ]; then
|
||||
python -m synapse.app.homeserver --generate-keys --config-path /config-template/homeserver.yaml.template 2>/dev/null || true
|
||||
# If key generation fails with template, create a minimal config for key gen
|
||||
if [ \! -f /data/signing.key ]; then
|
||||
echo server_name: iamworkin.lan > /tmp/minimal.yaml
|
||||
echo signing_key_path: /data/signing.key >> /tmp/minimal.yaml
|
||||
python -c "from signedjson.key import generate_signing_key, write_signing_keys; import sys; key = generate_signing_key(a_auto); write_signing_keys(open(/data/signing.key,w), [key])" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
chown 991:991 /data/signing.key 2>/dev/null || true
|
||||
chmod 644 /data/signing.key 2>/dev/null || true
|
||||
mkdir -p /data/media_store
|
||||
chown -R 991:991 /data 2>/dev/null || true
|
||||
volumeMounts:
|
||||
- name: synapse-data
|
||||
mountPath: /data
|
||||
- name: synapse-config-template
|
||||
mountPath: /config-template
|
||||
- name: inject-credentials
|
||||
image: busybox:latest
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
# Copy template and substitute DB credentials from 1Password secret
|
||||
cp /config-template/log.config /config/log.config
|
||||
sed -e "s/__DB_PASSWORD__/${DB_PASSWORD}/g" \
|
||||
-e "s/__DB_USER__/${DB_USER}/g" \
|
||||
/config-template/homeserver.yaml.template > /config/homeserver.yaml
|
||||
echo "Credentials injected into homeserver.yaml"
|
||||
env:
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-Password
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-User
|
||||
volumeMounts:
|
||||
- name: synapse-config-template
|
||||
mountPath: /config-template
|
||||
- name: synapse-config-rendered
|
||||
mountPath: /config
|
||||
containers:
|
||||
- name: synapse
|
||||
image: matrixdotorg/synapse:latest
|
||||
ports:
|
||||
- containerPort: 8008
|
||||
name: http
|
||||
env:
|
||||
- name: SYNAPSE_CONFIG_DIR
|
||||
value: /config
|
||||
- name: SYNAPSE_CONFIG_PATH
|
||||
value: /config/homeserver.yaml
|
||||
volumeMounts:
|
||||
- name: synapse-data
|
||||
mountPath: /data
|
||||
- name: synapse-config-rendered
|
||||
mountPath: /config
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 200m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: "1"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8008
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8008
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: synapse-data
|
||||
persistentVolumeClaim:
|
||||
claimName: synapse-data
|
||||
- name: synapse-config-template
|
||||
configMap:
|
||||
name: synapse-config
|
||||
- name: synapse-config-rendered
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: synapse
|
||||
namespace: matrix
|
||||
spec:
|
||||
selector:
|
||||
app: synapse
|
||||
ports:
|
||||
- port: 8008
|
||||
targetPort: 8008
|
||||
name: http
|
||||
---
|
||||
# Element Web ConfigMap
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: element-web-config
|
||||
namespace: matrix
|
||||
data:
|
||||
config.json: |
|
||||
{
|
||||
"default_server_config": {
|
||||
"m.homeserver": {
|
||||
"base_url": "https://matrix.iamworkin.lan",
|
||||
"server_name": "iamworkin.lan"
|
||||
}
|
||||
},
|
||||
"brand": "BlueJay Chat",
|
||||
"disable_guests": true,
|
||||
"disable_3pid_login": true
|
||||
}
|
||||
---
|
||||
# Element Web Deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: element-web
|
||||
namespace: matrix
|
||||
labels:
|
||||
app: element-web
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: element-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: element-web
|
||||
spec:
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: element-web
|
||||
image: vectorim/element-web:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: element-config
|
||||
mountPath: /app/config.json
|
||||
subPath: config.json
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 80
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 80
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: element-config
|
||||
configMap:
|
||||
name: element-web-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: element-web
|
||||
namespace: matrix
|
||||
spec:
|
||||
selector:
|
||||
app: element-web
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
name: http
|
||||
---
|
||||
# TLS Certificates via cert-manager
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: matrix-tls
|
||||
namespace: matrix
|
||||
spec:
|
||||
secretName: matrix-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- matrix.iamworkin.lan
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: element-tls
|
||||
namespace: matrix
|
||||
spec:
|
||||
secretName: element-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- element.iamworkin.lan
|
||||
---
|
||||
# Traefik IngressRoute - Synapse
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: synapse
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`matrix.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: synapse
|
||||
port: 8008
|
||||
tls:
|
||||
secretName: matrix-tls
|
||||
---
|
||||
# Traefik IngressRoute - Element Web
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: element-web
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`element.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: element-web
|
||||
port: 80
|
||||
tls:
|
||||
secretName: element-tls
|
||||
---
|
||||
# 1Password secret sync — creates matrix-credentials K8s Secret
|
||||
# Fields: DB-User, DB-Password, Registration-Secret, username, password, URL
|
||||
apiVersion: onepassword.com/v1
|
||||
kind: OnePasswordItem
|
||||
metadata:
|
||||
name: matrix-credentials
|
||||
namespace: matrix
|
||||
spec:
|
||||
itemPath: vaults/IAmWorkin/items/Matrix Synapse
|
||||
---
|
||||
# Public IngressRoute - Element Web (flowercore.io with Cloudflare origin cert)
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: element-public
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`element.flowercore.io`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: element-web
|
||||
port: 80
|
||||
tls:
|
||||
secretName: cf-origin-flowercore-io
|
||||
---
|
||||
# Public IngressRoute - Synapse (flowercore.io with Cloudflare origin cert)
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: synapse-public
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`matrix.flowercore.io`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: synapse
|
||||
port: 8008
|
||||
tls:
|
||||
secretName: cf-origin-flowercore-io
|
||||
# Matrix Synapse + Element Web
|
||||
# PostgreSQL 16 + Synapse homeserver + Element Web client
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
# DB credentials sourced from 1Password via OnePasswordItem CRD (matrix-credentials)
|
||||
# Synapse homeserver.yaml DB password injected at runtime via init container
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: matrix
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
# Synapse homeserver.yaml template ConfigMap
|
||||
# DB password placeholder __DB_PASSWORD__ is replaced at pod startup by init container
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: synapse-config
|
||||
namespace: matrix
|
||||
data:
|
||||
homeserver.yaml.template: |
|
||||
server_name: "iamworkin.lan"
|
||||
pid_file: /data/homeserver.pid
|
||||
public_baseurl: "https://matrix.iamworkin.lan/"
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
bind_addresses: ["0.0.0.0"]
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
user: __DB_USER__
|
||||
password: __DB_PASSWORD__
|
||||
database: synapse
|
||||
host: matrix-postgres
|
||||
port: 5432
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
log_config: "/config/log.config"
|
||||
media_store_path: /data/media_store
|
||||
registration_shared_secret: "a208f2e4b260f6b7d6ff4566df49c56c8b73fa20b911ce4e617b791ee7868adc"
|
||||
report_stats: false
|
||||
macaroon_secret_key: "9964f398e8b48a91469ad419d293c06db4562f49df8cc6e129fb3a801fd9052d"
|
||||
form_secret: "7b0a9dbaf9ee94450e0b3271c408dfc4d313a55843ce4eec2ac1bb0315ffeb76"
|
||||
signing_key_path: "/data/signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
enable_registration: false
|
||||
suppress_key_server_warning: true
|
||||
log.config: |
|
||||
version: 1
|
||||
formatters:
|
||||
precise:
|
||||
format: "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s"
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: precise
|
||||
loggers:
|
||||
synapse.storage.SQL:
|
||||
level: WARNING
|
||||
root:
|
||||
level: WARNING
|
||||
handlers: [console]
|
||||
disable_existing_loggers: false
|
||||
---
|
||||
# PostgreSQL 16 StatefulSet
|
||||
# Credentials from 1Password-synced matrix-credentials secret
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: matrix-postgres
|
||||
namespace: matrix
|
||||
labels:
|
||||
app: matrix-postgres
|
||||
spec:
|
||||
serviceName: matrix-postgres
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: matrix-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: matrix-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres:16-alpine
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-User
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-Password
|
||||
- name: POSTGRES_DB
|
||||
value: synapse
|
||||
- name: POSTGRES_INITDB_ARGS
|
||||
value: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
|
||||
volumeMounts:
|
||||
- name: matrix-postgres-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
subPath: pgdata
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ["pg_isready", "-U", "synapse"]
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["pg_isready", "-U", "synapse"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: matrix-postgres-data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: matrix-postgres
|
||||
namespace: matrix
|
||||
spec:
|
||||
selector:
|
||||
app: matrix-postgres
|
||||
ports:
|
||||
- port: 5432
|
||||
targetPort: 5432
|
||||
name: postgres
|
||||
clusterIP: None
|
||||
---
|
||||
# Synapse Data PVC
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: synapse-data
|
||||
namespace: matrix
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
# Synapse Deployment
|
||||
# Init container injects DB credentials from 1Password secret into homeserver.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: synapse
|
||||
namespace: matrix
|
||||
labels:
|
||||
app: synapse
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: synapse
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: synapse
|
||||
spec:
|
||||
initContainers:
|
||||
- name: generate-signing-key
|
||||
image: matrixdotorg/synapse:latest
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
if [ \! -f /data/signing.key ]; then
|
||||
python -m synapse.app.homeserver --generate-keys --config-path /config-template/homeserver.yaml.template 2>/dev/null || true
|
||||
# If key generation fails with template, create a minimal config for key gen
|
||||
if [ \! -f /data/signing.key ]; then
|
||||
echo server_name: iamworkin.lan > /tmp/minimal.yaml
|
||||
echo signing_key_path: /data/signing.key >> /tmp/minimal.yaml
|
||||
python -c "from signedjson.key import generate_signing_key, write_signing_keys; import sys; key = generate_signing_key(a_auto); write_signing_keys(open(/data/signing.key,w), [key])" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
chown 991:991 /data/signing.key 2>/dev/null || true
|
||||
chmod 644 /data/signing.key 2>/dev/null || true
|
||||
mkdir -p /data/media_store
|
||||
chown -R 991:991 /data 2>/dev/null || true
|
||||
volumeMounts:
|
||||
- name: synapse-data
|
||||
mountPath: /data
|
||||
- name: synapse-config-template
|
||||
mountPath: /config-template
|
||||
- name: inject-credentials
|
||||
image: busybox:latest
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
# Copy template and substitute DB credentials from 1Password secret
|
||||
cp /config-template/log.config /config/log.config
|
||||
sed -e "s/__DB_PASSWORD__/${DB_PASSWORD}/g" \
|
||||
-e "s/__DB_USER__/${DB_USER}/g" \
|
||||
/config-template/homeserver.yaml.template > /config/homeserver.yaml
|
||||
echo "Credentials injected into homeserver.yaml"
|
||||
env:
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-Password
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-User
|
||||
volumeMounts:
|
||||
- name: synapse-config-template
|
||||
mountPath: /config-template
|
||||
- name: synapse-config-rendered
|
||||
mountPath: /config
|
||||
containers:
|
||||
- name: synapse
|
||||
image: matrixdotorg/synapse:latest
|
||||
ports:
|
||||
- containerPort: 8008
|
||||
name: http
|
||||
env:
|
||||
- name: SYNAPSE_CONFIG_DIR
|
||||
value: /config
|
||||
- name: SYNAPSE_CONFIG_PATH
|
||||
value: /config/homeserver.yaml
|
||||
volumeMounts:
|
||||
- name: synapse-data
|
||||
mountPath: /data
|
||||
- name: synapse-config-rendered
|
||||
mountPath: /config
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 200m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: "1"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8008
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8008
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: synapse-data
|
||||
persistentVolumeClaim:
|
||||
claimName: synapse-data
|
||||
- name: synapse-config-template
|
||||
configMap:
|
||||
name: synapse-config
|
||||
- name: synapse-config-rendered
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: synapse
|
||||
namespace: matrix
|
||||
spec:
|
||||
selector:
|
||||
app: synapse
|
||||
ports:
|
||||
- port: 8008
|
||||
targetPort: 8008
|
||||
name: http
|
||||
---
|
||||
# Element Web ConfigMap
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: element-web-config
|
||||
namespace: matrix
|
||||
data:
|
||||
config.json: |
|
||||
{
|
||||
"default_server_config": {
|
||||
"m.homeserver": {
|
||||
"base_url": "https://matrix.iamworkin.lan",
|
||||
"server_name": "iamworkin.lan"
|
||||
}
|
||||
},
|
||||
"brand": "BlueJay Chat",
|
||||
"disable_guests": true,
|
||||
"disable_3pid_login": true
|
||||
}
|
||||
---
|
||||
# Element Web Deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: element-web
|
||||
namespace: matrix
|
||||
labels:
|
||||
app: element-web
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: element-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: element-web
|
||||
spec:
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: element-web
|
||||
image: vectorim/element-web:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: element-config
|
||||
mountPath: /app/config.json
|
||||
subPath: config.json
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 80
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 80
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: element-config
|
||||
configMap:
|
||||
name: element-web-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: element-web
|
||||
namespace: matrix
|
||||
spec:
|
||||
selector:
|
||||
app: element-web
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
name: http
|
||||
---
|
||||
# TLS Certificates via cert-manager
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: matrix-tls
|
||||
namespace: matrix
|
||||
spec:
|
||||
secretName: matrix-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- matrix.iamworkin.lan
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: element-tls
|
||||
namespace: matrix
|
||||
spec:
|
||||
secretName: element-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- element.iamworkin.lan
|
||||
---
|
||||
# Traefik IngressRoute - Synapse
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: synapse
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`matrix.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: synapse
|
||||
port: 8008
|
||||
tls:
|
||||
secretName: matrix-tls
|
||||
---
|
||||
# Traefik IngressRoute - Element Web
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: element-web
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`element.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: element-web
|
||||
port: 80
|
||||
tls:
|
||||
secretName: element-tls
|
||||
---
|
||||
# 1Password secret sync — creates matrix-credentials K8s Secret
|
||||
# Fields: DB-User, DB-Password, Registration-Secret, username, password, URL
|
||||
apiVersion: onepassword.com/v1
|
||||
kind: OnePasswordItem
|
||||
metadata:
|
||||
name: matrix-credentials
|
||||
namespace: matrix
|
||||
spec:
|
||||
itemPath: vaults/IAmWorkin/items/Matrix Synapse
|
||||
---
|
||||
# Public IngressRoute - Element Web (flowercore.io with Cloudflare origin cert)
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: element-public
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`element.flowercore.io`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: element-web
|
||||
port: 80
|
||||
tls:
|
||||
secretName: cf-origin-flowercore-io
|
||||
---
|
||||
# Public IngressRoute - Synapse (flowercore.io with Cloudflare origin cert)
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: synapse-public
|
||||
namespace: matrix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`matrix.flowercore.io`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: synapse
|
||||
port: 8008
|
||||
tls:
|
||||
secretName: cf-origin-flowercore-io
|
||||
|
||||
Reference in New Issue
Block a user