410 lines
9.3 KiB
YAML
410 lines
9.3 KiB
YAML
# Matrix Synapse + Element Web
|
|
# PostgreSQL 16 + Synapse homeserver + Element Web client
|
|
# ArgoCD managed - BlueJay Lab
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: matrix
|
|
labels:
|
|
app.kubernetes.io/part-of: bluejay-infra
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: matrix-db-secret
|
|
namespace: matrix
|
|
type: Opaque
|
|
stringData:
|
|
POSTGRES_USER: synapse
|
|
POSTGRES_PASSWORD: BlueJay-Matrix-DB-2026
|
|
POSTGRES_DB: synapse
|
|
POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
|
|
---
|
|
# Synapse homeserver.yaml ConfigMap
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: synapse-config
|
|
namespace: matrix
|
|
data:
|
|
homeserver.yaml: |
|
|
server_name: "iamworkin.lan"
|
|
pid_file: /data/homeserver.pid
|
|
public_baseurl: "https://matrix.iamworkin.lan/"
|
|
listeners:
|
|
- port: 8008
|
|
tls: false
|
|
type: http
|
|
x_forwarded: true
|
|
bind_addresses: ["0.0.0.0"]
|
|
resources:
|
|
- names: [client, federation]
|
|
compress: false
|
|
database:
|
|
name: psycopg2
|
|
args:
|
|
user: synapse
|
|
password: BlueJay-Matrix-DB-2026
|
|
database: synapse
|
|
host: matrix-postgres
|
|
port: 5432
|
|
cp_min: 5
|
|
cp_max: 10
|
|
log_config: "/config/log.config"
|
|
media_store_path: /data/media_store
|
|
registration_shared_secret: "a208f2e4b260f6b7d6ff4566df49c56c8b73fa20b911ce4e617b791ee7868adc"
|
|
report_stats: false
|
|
macaroon_secret_key: "9964f398e8b48a91469ad419d293c06db4562f49df8cc6e129fb3a801fd9052d"
|
|
form_secret: "7b0a9dbaf9ee94450e0b3271c408dfc4d313a55843ce4eec2ac1bb0315ffeb76"
|
|
signing_key_path: "/data/signing.key"
|
|
trusted_key_servers:
|
|
- server_name: "matrix.org"
|
|
enable_registration: false
|
|
suppress_key_server_warning: true
|
|
log.config: |
|
|
version: 1
|
|
formatters:
|
|
precise:
|
|
format: "%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s"
|
|
handlers:
|
|
console:
|
|
class: logging.StreamHandler
|
|
formatter: precise
|
|
loggers:
|
|
synapse.storage.SQL:
|
|
level: WARNING
|
|
root:
|
|
level: WARNING
|
|
handlers: [console]
|
|
disable_existing_loggers: false
|
|
---
|
|
# PostgreSQL 16 StatefulSet
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: matrix-postgres
|
|
namespace: matrix
|
|
labels:
|
|
app: matrix-postgres
|
|
spec:
|
|
serviceName: matrix-postgres
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: matrix-postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: matrix-postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: postgres:16-alpine
|
|
ports:
|
|
- containerPort: 5432
|
|
name: postgres
|
|
envFrom:
|
|
- secretRef:
|
|
name: matrix-db-secret
|
|
volumeMounts:
|
|
- name: matrix-postgres-data
|
|
mountPath: /var/lib/postgresql/data
|
|
subPath: pgdata
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 1Gi
|
|
cpu: 500m
|
|
livenessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "synapse"]
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "synapse"]
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: matrix-postgres-data
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: matrix-postgres
|
|
namespace: matrix
|
|
spec:
|
|
selector:
|
|
app: matrix-postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
name: postgres
|
|
clusterIP: None
|
|
---
|
|
# Synapse Data PVC
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: synapse-data
|
|
namespace: matrix
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|
|
---
|
|
# Synapse init job: generate signing key if missing
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: synapse
|
|
namespace: matrix
|
|
labels:
|
|
app: synapse
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: synapse
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: synapse
|
|
spec:
|
|
initContainers:
|
|
- name: generate-signing-key
|
|
image: matrixdotorg/synapse:latest
|
|
securityContext:
|
|
runAsUser: 0
|
|
command: ["sh", "-c"]
|
|
args:
|
|
- |
|
|
if [ \! -f /data/signing.key ]; then
|
|
python -m synapse.app.homeserver --generate-keys --config-path /config/homeserver.yaml
|
|
fi
|
|
chown 991:991 /data/signing.key 2>/dev/null || true
|
|
chmod 644 /data/signing.key 2>/dev/null || true
|
|
mkdir -p /data/media_store
|
|
chown -R 991:991 /data 2>/dev/null || true
|
|
volumeMounts:
|
|
- name: synapse-data
|
|
mountPath: /data
|
|
- name: synapse-config
|
|
mountPath: /config
|
|
containers:
|
|
- name: synapse
|
|
image: matrixdotorg/synapse:latest
|
|
ports:
|
|
- containerPort: 8008
|
|
name: http
|
|
env:
|
|
- name: SYNAPSE_CONFIG_DIR
|
|
value: /config
|
|
- name: SYNAPSE_CONFIG_PATH
|
|
value: /config/homeserver.yaml
|
|
volumeMounts:
|
|
- name: synapse-data
|
|
mountPath: /data
|
|
- name: synapse-config
|
|
mountPath: /config
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 200m
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: "1"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8008
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: 8008
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 5
|
|
volumes:
|
|
- name: synapse-data
|
|
persistentVolumeClaim:
|
|
claimName: synapse-data
|
|
- name: synapse-config
|
|
configMap:
|
|
name: synapse-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: synapse
|
|
namespace: matrix
|
|
spec:
|
|
selector:
|
|
app: synapse
|
|
ports:
|
|
- port: 8008
|
|
targetPort: 8008
|
|
name: http
|
|
---
|
|
# Element Web ConfigMap
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: element-web-config
|
|
namespace: matrix
|
|
data:
|
|
config.json: |
|
|
{
|
|
"default_server_config": {
|
|
"m.homeserver": {
|
|
"base_url": "https://matrix.iamworkin.lan",
|
|
"server_name": "iamworkin.lan"
|
|
}
|
|
},
|
|
"brand": "BlueJay Chat",
|
|
"disable_guests": true,
|
|
"disable_3pid_login": true
|
|
}
|
|
---
|
|
# Element Web Deployment
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: element-web
|
|
namespace: matrix
|
|
labels:
|
|
app: element-web
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: element-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: element-web
|
|
spec:
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: element-web
|
|
image: vectorim/element-web:latest
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
volumeMounts:
|
|
- name: element-config
|
|
mountPath: /app/config.json
|
|
subPath: config.json
|
|
resources:
|
|
requests:
|
|
memory: 32Mi
|
|
cpu: 10m
|
|
limits:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 80
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 80
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
volumes:
|
|
- name: element-config
|
|
configMap:
|
|
name: element-web-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: element-web
|
|
namespace: matrix
|
|
spec:
|
|
selector:
|
|
app: element-web
|
|
ports:
|
|
- port: 80
|
|
targetPort: 80
|
|
name: http
|
|
---
|
|
# TLS Certificates via cert-manager
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: matrix-tls
|
|
namespace: matrix
|
|
spec:
|
|
secretName: matrix-tls
|
|
issuerRef:
|
|
name: step-ca-acme
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- matrix.iamworkin.lan
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: element-tls
|
|
namespace: matrix
|
|
spec:
|
|
secretName: element-tls
|
|
issuerRef:
|
|
name: step-ca-acme
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- element.iamworkin.lan
|
|
---
|
|
# Traefik IngressRoute - Synapse
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: synapse
|
|
namespace: matrix
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`matrix.iamworkin.lan`)
|
|
kind: Rule
|
|
services:
|
|
- name: synapse
|
|
port: 8008
|
|
tls:
|
|
secretName: matrix-tls
|
|
---
|
|
# Traefik IngressRoute - Element Web
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: element-web
|
|
namespace: matrix
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`element.iamworkin.lan`)
|
|
kind: Rule
|
|
services:
|
|
- name: element-web
|
|
port: 80
|
|
tls:
|
|
secretName: element-tls
|