commit 1939d426d5d47eb093be905f046f2e7d317aa935
parent f2874637c7a950c8ebb9e60ae8d2b36707f22938
Author: MTRNord <mtrnord1@gmail.com>
Date: Fri, 25 Apr 2025 18:46:53 +0200
Actually fully update mas
Diffstat:
4 files changed, 133 insertions(+), 134 deletions(-)
diff --git a/apps/base/matrix/mas/mas_deployment.yaml b/apps/base/matrix/mas/mas_deployment.yaml
@@ -52,7 +52,7 @@ spec:
value: /config.yaml
initContainers:
- name: mas-config
- image: ghcr.io/element-hq/matrix-authentication-service:0.14.1
+ image: ghcr.io/element-hq/matrix-authentication-service:0.15.0
imagePullPolicy: Always
# Sync config
args: ["config", "sync"]
diff --git a/apps/base/matrix/synapse/kustomization.yaml b/apps/base/matrix/synapse/kustomization.yaml
@@ -10,14 +10,14 @@ configMapGenerator:
- name: rspamd-config
namespace: matrix
files:
- - actions.conf=rspamd-config/local.d/actions.conf
- - antivirus.conf=rspamd-config/local.d/antivirus.conf
- - classifier-bayes.conf=rspamd-config/local.d/classifier-bayes.conf
- - dmarc.conf=rspamd-config/local.d/dmarc.conf
- - greylist.conf=rspamd-config/local.d/greylist.conf
- - hfilter.conf=rspamd-config/local.d/hfilter.conf
- - history_redis.conf=rspamd-config/local.d/history_redis.conf
- - logging.inc=rspamd-config/local.d/logging.inc
- - options.inc=rspamd-config/local.d/options.inc
- - phishing.conf=rspamd-config/local.d/phishing.conf
- - worker-controller.inc=rspamd-config/local.d/worker-controller.inc
+ - actions.conf=rspamd-config/local.d/actions.conf
+ - antivirus.conf=rspamd-config/local.d/antivirus.conf
+ - classifier-bayes.conf=rspamd-config/local.d/classifier-bayes.conf
+ - dmarc.conf=rspamd-config/local.d/dmarc.conf
+ - greylist.conf=rspamd-config/local.d/greylist.conf
+ - hfilter.conf=rspamd-config/local.d/hfilter.conf
+ - history_redis.conf=rspamd-config/local.d/history_redis.conf
+ - logging.inc=rspamd-config/local.d/logging.inc
+ - options.inc=rspamd-config/local.d/options.inc
+ - phishing.conf=rspamd-config/local.d/phishing.conf
+ - worker-controller.inc=rspamd-config/local.d/worker-controller.inc
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -102,21 +102,21 @@ spec:
modules:
- module: matrix_invitee_server_blocker.InviteeServerBlocker
config:
- broken_servers:
- #- matrix.org
- - matrix.im
- - funami.tech
- - suicideserver.net
- - cuteness-overdose.com
- - xmr.se
- #- module: synapse_rspamd.AntispamModule
- # config:
- # dry_run: true
- # required_score_threshold: 10
- # rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2
- # rspamd_password: ENC[AES256_GCM,data:oawyHMbChq7A,iv:PwIpJFtRpWVv7EIqssmdVRFJMKeIT03J9VNoD8LcGpU=,tag:MsYaPedvIxLKz2UiD8NS1Q==,type:str]
- # local_server_address: matrix.midnightthoughts.space
- # matrix_access_token: ENC[AES256_GCM,data:39s3mP9giCwVFslygyZuMIYwvQ9FRxlv2YYkwB5fuWdmQ0ATZ61NRDlx,iv:1ypgEQXrwzbJPkvc5oqFYdDz0JV4gQf6wflYN7yqHDQ=,tag:Dfui+n0hN8jgfr+f+slfjg==,type:str]
+ broken_servers:
+ #- matrix.org
+ - matrix.im
+ - funami.tech
+ - suicideserver.net
+ - cuteness-overdose.com
+ - xmr.se
+ #- module: synapse_rspamd.AntispamModule
+ # config:
+ # dry_run: true
+ # required_score_threshold: 10
+ # rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2
+ # rspamd_password: ENC[AES256_GCM,data:oawyHMbChq7A,iv:PwIpJFtRpWVv7EIqssmdVRFJMKeIT03J9VNoD8LcGpU=,tag:MsYaPedvIxLKz2UiD8NS1Q==,type:str]
+ # local_server_address: matrix.midnightthoughts.space
+ # matrix_access_token: ENC[AES256_GCM,data:39s3mP9giCwVFslygyZuMIYwvQ9FRxlv2YYkwB5fuWdmQ0ATZ61NRDlx,iv:1ypgEQXrwzbJPkvc5oqFYdDz0JV4gQf6wflYN7yqHDQ=,tag:Dfui+n0hN8jgfr+f+slfjg==,type:str]
persistence:
enabled: true
size: 20Gi
@@ -158,7 +158,7 @@ spec:
emptyDir: {}
- name: configs
secret:
- secretName: ENC[AES256_GCM,data:BRWm8EuHGNm6f1zo,iv:+Ntd/LiZOvuhx9b3PkmuWnj9uo1wPEmUFg2vcDGZtw0=,tag:TnvbjDY3tkjvr/NKU+1s+w==,type:str]
+ secretName: ENC[AES256_GCM,data:BRWm8EuHGNm6f1zo,iv:+Ntd/LiZOvuhx9b3PkmuWnj9uo1wPEmUFg2vcDGZtw0=,tag:TnvbjDY3tkjvr/NKU+1s+w==,type:str]
volumeMounts:
- name: matrix-org-blocker
mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
@@ -197,19 +197,19 @@ spec:
modules:
- module: matrix_invitee_server_blocker.InviteeServerBlocker
config:
- broken_servers:
- #- matrix.org
- - matrix.im
- - funami.tech
- - suicideserver.net
- #- module: synapse_rspamd.AntispamModule
- # config:
- # dry_run: true
- # required_score_threshold: 10
- # rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2
- # rspamd_password: ENC[AES256_GCM,data:OZXUNW4g3AvV,iv:ZkNtB5dCnyDve0c9WI/E72YWqXyXtHFvnYAAf2TUz9Y=,tag:hYF/MwpEbtYMfOVe6zYlXg==,type:str]
- # local_server_address: matrix.midnightthoughts.space
- # matrix_access_token: ENC[AES256_GCM,data:MFfc6mlpCVg5KQH+ozXmTPFTX+0OjiIZjbn23cVS7SeqQuSqUhjkNxyy,iv:GUoRiYYAogBA4enHp/W+ZQvpkOyaixmd0hNm2gxp2o8=,tag:b6tDDnFpd/pYsrzXHEF0ig==,type:str]
+ broken_servers:
+ #- matrix.org
+ - matrix.im
+ - funami.tech
+ - suicideserver.net
+ #- module: synapse_rspamd.AntispamModule
+ # config:
+ # dry_run: true
+ # required_score_threshold: 10
+ # rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2
+ # rspamd_password: ENC[AES256_GCM,data:OZXUNW4g3AvV,iv:ZkNtB5dCnyDve0c9WI/E72YWqXyXtHFvnYAAf2TUz9Y=,tag:hYF/MwpEbtYMfOVe6zYlXg==,type:str]
+ # local_server_address: matrix.midnightthoughts.space
+ # matrix_access_token: ENC[AES256_GCM,data:MFfc6mlpCVg5KQH+ozXmTPFTX+0OjiIZjbn23cVS7SeqQuSqUhjkNxyy,iv:GUoRiYYAogBA4enHp/W+ZQvpkOyaixmd0hNm2gxp2o8=,tag:b6tDDnFpd/pYsrzXHEF0ig==,type:str]
federation_reader:
resources:
requests:
@@ -395,7 +395,7 @@ spec:
emptyDir: {}
- name: configs
secret:
- secretName: ENC[AES256_GCM,data:liAVBCfiT6zndP8J,iv:lDoxTSbrCj7BhojYqACrml8yLETtcEiBqe4dSm3KJao=,tag:Dm968GSNlyq4y8+7w6ZQXA==,type:str]
+ secretName: ENC[AES256_GCM,data:liAVBCfiT6zndP8J,iv:lDoxTSbrCj7BhojYqACrml8yLETtcEiBqe4dSm3KJao=,tag:Dm968GSNlyq4y8+7w6ZQXA==,type:str]
extraVolumeMounts:
- name: matrix-org-blocker
mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
@@ -451,16 +451,16 @@ spec:
- matrix.midnightthoughts.space
csPaths:
- backendRefs:
- - kind: Service
- name: mas
- port: 8080
+ - kind: Service
+ name: mas
+ port: 8080
matches:
- - path:
- type: RegularExpression
- value: /_matrix/client/.*/(login|logout|refresh).*
- - path:
- type: RegularExpression
- value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
+ - path:
+ type: RegularExpression
+ value: /_matrix/client/.*/(login|logout|refresh).*
+ - path:
+ type: RegularExpression
+ value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
ingress:
enabled: false
sops:
@@ -471,13 +471,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXU3VtVlk1bW5UMXZSODhF
- M3diS2pJTW9DSHN5TEhTNUx1Mk1UQmR0dldBCkJuaVMwRkZwOHpMbXBpZWQxZXVZ
- RW9nWk9PTGFTK25NZVE0WHM3dlJpaDgKLS0tIGVhamZzVE1XeThIaUtqZ2Z6WW9i
- T0FvR2UxYnlHODh2ZFcyYnJaamJJUEkKLTvc5HOerlSqlTkzoc3HkyZ/798q5f4/
- Hqe+nGSWkNAOeZVRj+Y3vt1HLnzcm17xd2gRkaA1JAVDCY7yRnguaA==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXU3VtVlk1bW5UMXZSODhF
+ M3diS2pJTW9DSHN5TEhTNUx1Mk1UQmR0dldBCkJuaVMwRkZwOHpMbXBpZWQxZXVZ
+ RW9nWk9PTGFTK25NZVE0WHM3dlJpaDgKLS0tIGVhamZzVE1XeThIaUtqZ2Z6WW9i
+ T0FvR2UxYnlHODh2ZFcyYnJaamJJUEkKLTvc5HOerlSqlTkzoc3HkyZ/798q5f4/
+ Hqe+nGSWkNAOeZVRj+Y3vt1HLnzcm17xd2gRkaA1JAVDCY7yRnguaA==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-04-15T14:35:11Z"
mac: ENC[AES256_GCM,data:LqgYl93u5Jq3bxijiHfUoEC6jmrlT30XySfGGQOSgLYg9RVDQNimCj4sibUbPz65KBgSfhR90R2uaE0112W2NCQY4QdOZZviEhW31XVQfTCrSaBwzZQ8/yJ5a1AV1EtwnbspuX9BRQxMtr4S/2xd+Nj+tcAmF3eIT0LhuLmkIXo=,iv:eWn0qIolTocOCnoy3lH836OU2fxPqc2rtwHJMEsKv8s=,tag:OryIGctRAmflHGH960WCnw==,type:str]
pgp: []
diff --git a/apps/base/matrix/synapse/rspamd.yaml b/apps/base/matrix/synapse/rspamd.yaml
@@ -44,95 +44,94 @@ spec:
- name: rspamd-clamav
image: clamav/clamav-debian:1.4_base
resources:
- requests:
- memory: "1000Mi"
- cpu: "500m"
- limits:
- memory: "4000Mi"
- cpu: "500m"
+ requests:
+ memory: "1000Mi"
+ cpu: "500m"
+ limits:
+ memory: "4000Mi"
+ cpu: "500m"
ports:
- - containerPort: 3310
- name: clamav
+ - containerPort: 3310
+ name: clamav
volumeMounts:
- - name: run-clamav
- mountPath: /run/clamav
- - name: rspamd-clamav
- mountPath: /var/lib/clamav
+ - name: run-clamav
+ mountPath: /run/clamav
+ - name: rspamd-clamav
+ mountPath: /var/lib/clamav
env:
- - name: CLAMAV_NO_MILTERD
- value: "true"
+ - name: CLAMAV_NO_MILTERD
+ value: "true"
readinessProbe:
- exec:
- command:
- - "/usr/local/bin/clamdcheck.sh"
- initialDelaySeconds: 15
- periodSeconds: 10
- failureThreshold: 10
+ exec:
+ command:
+ - "/usr/local/bin/clamdcheck.sh"
+ initialDelaySeconds: 15
+ periodSeconds: 10
+ failureThreshold: 10
livenessProbe:
- exec:
- command:
- - "/usr/local/bin/clamdcheck.sh"
- initialDelaySeconds: 15
- periodSeconds: 10
- failureThreshold: 10
-
+ exec:
+ command:
+ - "/usr/local/bin/clamdcheck.sh"
+ initialDelaySeconds: 15
+ periodSeconds: 10
+ failureThreshold: 10
- name: rspamd-matrix
image: ghcr.io/rspamd/rspamd-docker:latest
resources:
- limits:
- memory: "1000Mi"
- cpu: "500m"
+ limits:
+ memory: "1000Mi"
+ cpu: "500m"
ports:
- - containerPort: 11333
- name: normal-worker
- - containerPort: 11334
- name: control-worker
+ - containerPort: 11333
+ name: normal-worker
+ - containerPort: 11334
+ name: control-worker
volumeMounts:
- - name: rspamd-matrix
- mountPath: /var/lib/rspamd
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/actions.conf
- subPath: actions.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/antivirus.conf
- subPath: antivirus.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/classifier-bayes.conf
- subPath: classifier-bayes.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/dmarc.conf
- subPath: dmarc.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/greylist.conf
- subPath: greylist.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/hfilter.conf
- subPath: hfilter.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/history_redis.conf
- subPath: history_redis.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/logging.inc
- subPath: logging.inc
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/options.inc
- subPath: options.inc
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/phishing.conf
- subPath: phishing.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/worker-controller.inc
- subPath: worker-controller.inc
+ - name: rspamd-matrix
+ mountPath: /var/lib/rspamd
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/actions.conf
+ subPath: actions.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/antivirus.conf
+ subPath: antivirus.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/classifier-bayes.conf
+ subPath: classifier-bayes.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/dmarc.conf
+ subPath: dmarc.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/greylist.conf
+ subPath: greylist.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/hfilter.conf
+ subPath: hfilter.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/history_redis.conf
+ subPath: history_redis.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/logging.inc
+ subPath: logging.inc
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/options.inc
+ subPath: options.inc
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/phishing.conf
+ subPath: phishing.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/worker-controller.inc
+ subPath: worker-controller.inc
volumes:
- name: rspamd-matrix
persistentVolumeClaim:
- claimName: rspamd-matrix
+ claimName: rspamd-matrix
- name: rspamd-clamav
persistentVolumeClaim:
- claimName: rspamd-clamav
+ claimName: rspamd-clamav
- name: rspamd-config
configMap:
- name: rspamd-config
+ name: rspamd-config
- name: run-clamav
emptyDir: {}
---
@@ -166,8 +165,8 @@ spec:
- rspamd.matrix.midnightthoughts.space
rules:
- backendRefs:
- - name: rspamd-matrix
- port: 11334
+ - name: rspamd-matrix
+ port: 11334
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
