commit 2b83b27dc3ce70da76b41f80c2dde5eb210c7d48
parent ae79ddac13fcedd113e7a9a1004ea3626e12cf00
Author: MTRNord <mtrnord1@gmail.com>
Date: Tue, 15 Apr 2025 16:36:27 +0200
Try to access media from the module
Diffstat:
2 files changed, 30 insertions(+), 27 deletions(-)
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -82,10 +82,10 @@ spec:
msc3861:
enabled: true
issuer: https://mas.matrix.midnightthoughts.space/
- client_id: ENC[AES256_GCM,data:N1RsgcurVtO4K3uMYxm5GmvrxfZ6Fl4dKJg=,iv:PcdO9rc0vrGN7NQhej+i9ZiyQHzDEaXmWEHj/mZCjF8=,tag:l8+pcWQlHd8AGIU9KwSPOw==,type:str]
+ client_id: ENC[AES256_GCM,data:i2Wf07anRWJoYp9bCp6Cuw0TXGSW8XyOb4E=,iv:srs12wm2f9rv6Vw9kVpLOvBgGcnj/Wsq2Kr9WA2q+g8=,tag:PA+gWzbg4l0iffBsxcvwyw==,type:str]
client_auth_method: client_secret_basic
- client_secret: ENC[AES256_GCM,data:icyAy6DtdF65EDwXhQ6kgJME1K9TxQuX0sGuqY8RlnxDZia8UTYRujxGxx9iW6xYKfkVHdi1B60VzDeHvYkVYw==,iv:idnvgpVy/4Xl2q0aroEqiCw7gcsPI48H6AcKBhmgVr0=,tag:SGvdvJnzR7rWWJJgIvXKQQ==,type:str]
- admin_token: ENC[AES256_GCM,data:Bt5PSh0KxmPb/tTQaZ8EYjPOBc6iTNoPletLTavObXU=,iv:HFryWtD0EHk/6bnDbXCZpvVuhy0qpLhdpYq0ngXtqUs=,tag:oSdfC/8duY2I1bAvK7viKQ==,type:str]
+ client_secret: ENC[AES256_GCM,data:7bQ3KjWKl7+tjcKMWZaxxAK0sKAi/ImQh48PE4qYi+VvwpXB+0uMA9FP7UnFsy/RpSUs7N6VgDAIq8GC0T/86g==,iv:KrQCwSPvf7WGfzwnE1TScfujOXjg1LuAMKeUBiEO2Ck=,tag:4Rl5gHC/+k2MZ9wmqpL2TA==,type:str]
+ admin_token: ENC[AES256_GCM,data:NQuQfaY7r5FsnIrDyPJ4x8CLNgDvkeeXoVSyoqjq1BI=,iv:qJ5n7p5+0ghYAcjuMARr3/xtCjOnuk8lBYDj5Ubyb6E=,tag:hJqzGNyTFGq6HmFe0nl6jw==,type:str]
account_management_url: https://mas.matrix.midnightthoughts.space/account
app_service_config_files:
- /data/heisenbridge.yaml
@@ -114,7 +114,9 @@ spec:
dry_run: true
required_score_threshold: 10
rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2
- rspamd_password: ENC[AES256_GCM,data:nVZtRZ52tPmM,iv:aWdVYu43nMW5maTr33dQjgkih0pUN3quJ/so0zj3M6k=,tag:0dbAjhj3piswZqGU55F+Ag==,type:str]
+ rspamd_password: ENC[AES256_GCM,data:oawyHMbChq7A,iv:PwIpJFtRpWVv7EIqssmdVRFJMKeIT03J9VNoD8LcGpU=,tag:MsYaPedvIxLKz2UiD8NS1Q==,type:str]
+ local_server_address: matrix.midnightthoughts.space
+ matrix_access_token: ENC[AES256_GCM,data:39s3mP9giCwVFslygyZuMIYwvQ9FRxlv2YYkwB5fuWdmQ0ATZ61NRDlx,iv:1ypgEQXrwzbJPkvc5oqFYdDz0JV4gQf6wflYN7yqHDQ=,tag:Dfui+n0hN8jgfr+f+slfjg==,type:str]
persistence:
enabled: true
size: 20Gi
@@ -152,12 +154,11 @@ spec:
emptyDir: {}
- name: local
emptyDir: {}
- - name: media
- persistentVolumeClaim:
- claimName: matrix-synapse-v2
+ - name: media-nonesense
+ emptyDir: {}
- name: configs
secret:
- secretName: ENC[AES256_GCM,data:hE1N/AbvFSqjXFLz,iv:A3ES2chrmdZ2qyGzERuX+7E+XbqJcv5juMrH5Vo0alk=,tag:RKKBhOb8Vz1n8vmkFCL5tw==,type:str]
+ secretName: ENC[AES256_GCM,data:BRWm8EuHGNm6f1zo,iv:+Ntd/LiZOvuhx9b3PkmuWnj9uo1wPEmUFg2vcDGZtw0=,tag:TnvbjDY3tkjvr/NKU+1s+w==,type:str]
volumeMounts:
- name: matrix-org-blocker
mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
@@ -171,15 +172,15 @@ spec:
mountPath: /tmp
- name: local
mountPath: /.local
- - name: media
+ - name: media-nonesense
mountPath: /synapse/data
- name: configs
mountPath: /data
readOnly: true
extraCommands:
- - ENC[AES256_GCM,data:8AWqrf1X7Vu0pV3wfkd2eUxlHNSixETNbdnhTnLK7v1wp/DOX3TFVLS767SrrVzwDpzgGCLA1iY/hnxt8lpGv1wtKXZpH9ex3QZ37Rll06toCVVBXAdUiYT8AI9xSSrjiIvIHkU7GohRRzGEMoEDd0EEBsMhoT+DbnZLW3QAyjKc1XxwIvOgGzAPE1FHkcHXkxmDffU76SdkWy3Dgg==,iv:wPrUCylF7qRYUihukibkw8XFyqB5Vfn1DykmlmquDCU=,tag:HTurgVLkbAoMBoDtQo76HQ==,type:str]
- - ENC[AES256_GCM,data:SUFKuu8FeJtEF/JDV4+YDOY=,iv:D6FP8M12fAAbwSuvSsYriyQamiXbCL2Pq6F5u1cRK3g=,tag:xGZ1JtH1AQVDI9Q761lENA==,type:str]
- - ENC[AES256_GCM,data:PcWxjeVQcnowtCiFgyVcfFKvvDrBW3xwUKYC+kvK9iR+DOuPcddF1YvLQ02biaw8DFoC+O6hYSmjHbIQvjwV/HaSHUapM8VReCnK10tIe91w3E07jJJraA+rvB09,iv:sBPEzjQDoO6nOlZ61om90TNQO7MWqIl/lvigh5EJfDk=,tag:2HM2ELxf6RUJawBWsDHxsA==,type:str]
+ - ENC[AES256_GCM,data:bCYAEssl4oRuk0IxrljTw/Jr37sPdxsQz4aJeGsdyea0Qfv2gvVT4Kb4kS9tBxRS07zu+KzJW6MrZNWmTT9rJDl7e/qkbrihZmaDaaQIIfFeetDpV/96mxrs+mM0IntZieXI5iKIwbYqTv2H7Oq14l37RtHoO7i0ZIIWOReKUtv7idBFHx0UJgJ6i5NywuWoxAcbd1Yn76W4LJfwLQ==,iv:QOjOS/qBjThjEKL0uc2vwSnXBvPnWF6r2FAfwzAB5x0=,tag:h52xOVZBJfw6Pd0vBQVMBw==,type:str]
+ - ENC[AES256_GCM,data:ADHhcoi8JcaVL+EwAICiJYc=,iv:IUXN7k5a651fvO7t0A9BBg6CTXGsZtcgzngkl/tsiFI=,tag:pleDz4f562Yd5GZbWIl9VA==,type:str]
+ - ENC[AES256_GCM,data:yWB1vOSpr5PlwJolSitdVq1YeZC2/IFwMLU1pDtLfe5VvNoBvllz5yhlApadtc6RTyh8GAj6zAg4bjEodkACafEasF41LnxsxMNyZLo5m0lFFERc3vGMUFeKpMcn,iv:7y2aIOOwcm6fk4ZyPM+stvAEjs7vRYs9ZA1oz1Z3b7Q=,tag:/nZUyWRPGaeS294ufr6Fiw==,type:str]
extraConfig:
#notify_appservices_from_worker: appservices
enable_authenticated_media: true
@@ -206,7 +207,9 @@ spec:
dry_run: true
required_score_threshold: 10
rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2
- rspamd_password: ENC[AES256_GCM,data:2u/2kPMXwzr3,iv:xJ9qW+sFSOjGRzKvo/Wzl8SegAKzME8g60hZ/DTcJRY=,tag:Tcjr1/atx7nF7blXr976bg==,type:str]
+ rspamd_password: ENC[AES256_GCM,data:OZXUNW4g3AvV,iv:ZkNtB5dCnyDve0c9WI/E72YWqXyXtHFvnYAAf2TUz9Y=,tag:hYF/MwpEbtYMfOVe6zYlXg==,type:str]
+ local_server_address: matrix.midnightthoughts.space
+ matrix_access_token: ENC[AES256_GCM,data:MFfc6mlpCVg5KQH+ozXmTPFTX+0OjiIZjbn23cVS7SeqQuSqUhjkNxyy,iv:GUoRiYYAogBA4enHp/W+ZQvpkOyaixmd0hNm2gxp2o8=,tag:b6tDDnFpd/pYsrzXHEF0ig==,type:str]
federation_reader:
resources:
requests:
@@ -392,7 +395,7 @@ spec:
emptyDir: {}
- name: configs
secret:
- secretName: ENC[AES256_GCM,data:qwI6AM6thZmCXwj8,iv:RRKjpH+2Yl8HV+Ko1PFAB0enhtaEZMlx4uifH0kHUik=,tag:2fjwBLZ/5/PmsFBKdPNb8w==,type:str]
+ secretName: ENC[AES256_GCM,data:liAVBCfiT6zndP8J,iv:lDoxTSbrCj7BhojYqACrml8yLETtcEiBqe4dSm3KJao=,tag:Dm968GSNlyq4y8+7w6ZQXA==,type:str]
extraVolumeMounts:
- name: matrix-org-blocker
mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
@@ -408,9 +411,9 @@ spec:
mountPath: /data
readOnly: true
extraCommands:
- - ENC[AES256_GCM,data:p27dihhuwQEGmyLW3D2NWO5/C7/bx9T11be63izQzFiKqF9YcSVSXDNx++cS1iG31hD/R9qbP5Gyp4LrYOvVfvOyuFi3KdBZTGNFPxNpWKEeYRRbOLSX59t1I9ZUhnIFpDnRHt6coz1cf2cdHoDluzHMRxPzF+V6DMjVxGdkl5Y8cS4vJqlCRgksve8lnPeR6aDLYMPjQ/SAIZnUmQ==,iv:WlY/oSckkQ5bj27JMCTCOmoD9MOr+cbUvWUNYew+X9M=,tag:sbefM2P/6EOmrw8mcxa5GQ==,type:str]
- - ENC[AES256_GCM,data:ORnYmpR4lxzjWTbcs0QTe7M=,iv:CM+sy1t4CKrSKiLSthik7GpD81danZuS3LFJWnYT84k=,tag:5va2gpgepeHe9pgHDqNeSA==,type:str]
- - ENC[AES256_GCM,data:IkY3Rl6ZvayYql/s9IVQy+yPnBMOwbaUI+4EZXF4wp9DvI/t2WDI++MR23/tA8WWiqbrEQ99HLbGOSkbpwsKHVzHBeJy5VCpG8WBxcfNSCr7R6mbBbXcJNIdgPEg,iv:9NWLK7KkuVYLB/7jt5zlYhCGcH0BpGKyUenVocwAjns=,tag:9klUsA4vG4QKjkZ776C+DA==,type:str]
+ - ENC[AES256_GCM,data:j45fZpCJ8IPLDm+0xHXfxim7dqOTYwBk4Po8vJRJXxtl4SYQnSKWQdLoXtHsOaukefS2P/BZHSvUPqMneNNGrmxkNvyNb/+Sp1BCZLY9422CASYqgryzm5JGrqJfsUwgNwQdKQGr4pyDU3yGmwCMVNFOSK28veAESdV0OpAyC43y8nixbfjhUt99V1jEt4P5qv9+fYB+4wkOozf5sw==,iv:Znwx3CXw8nNQ8/zwzUGRkGP0SxqK5lxFHUwGQ2Iese8=,tag:Gx7/bghMsBamH8jrsoOfDA==,type:str]
+ - ENC[AES256_GCM,data:McWvdeDkTYojEgPz8kbovdo=,iv:ctXm59dYz1HadOJFId5oiEW4MlwJKhltnrPEKXndS+s=,tag:FhpoBOmcFdjRoR+Mb66LfQ==,type:str]
+ - ENC[AES256_GCM,data:PAP/TbUAXDrW2JhwHpixOBNmzeB+1sxkn4WEz+XnNfaaCWnCKWrAc1HGxG+etbI5RRXygwSt/WD+6oo0aJ+quReqHCUmCvfhN0Ni36MX23UEA+v63NembJ9td6F/,iv:F4viFtsu4Pr+XjD6pEAAvpqHqL9+U66IpqymfcviATc=,tag:hui34fYsrZ2CNwMktdPdvQ==,type:str]
annotations:
prometheus.io/scrape: "true"
prometheus.io/path: /_synapse/metrics
@@ -434,7 +437,7 @@ spec:
sslmode: require
username: synapse
database: synapse
- password: ENC[AES256_GCM,data:gnXQs/jP4XK48Awi2eZ8fwyRFgMDAsLq6mcSGwOI09ZgcWtWEz57VSj3Zr1R1k9R5R+YoInwyQQz7cQ0BtwP2Q==,iv:vNwR/ZKkxRVlG5Ux4oWq2qOzCvu/uu0n3VRkmcNNl4E=,tag:MSxc0fHKRXKh3yGhh/lbrg==,type:str]
+ password: ENC[AES256_GCM,data:EZXG4Bd/lPMmOfcw9s2wurlpnmhnRORKCXBtXBeaDEumHiu+9vPF3BhQ75qBGVdJ3/OYECsCd9LmpdsjAG2suA==,iv:+RHRgEy9uZnNQJZCblXc+1cqMsPspv3yMvuv1gY3EmI=,tag:rNbJsBhM4ZXKgCfTSUZn/Q==,type:str]
gateway:
parentRefs:
- name: envoy-gateway
@@ -469,14 +472,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbDVTZmx3V1Y5UlRWZTE3
- Q0ViK0hGVmxpZGwwUXFQbWtiajlybVZaZWxJCjkrVFVxalpRR2ZLaGVXaC8wSjl1
- TitmeUpTTFJHelZzUS9neGJ5ZHBFZFUKLS0tIHdiUVpoSTVuLytMRXZ1NGNYVFFR
- T3R1dWd6RHBBTE4ySVdLSVhGZDlTUGMKGGMUco+38W7lwVjoavuXDLhBsZChmLoC
- boKs8DHN2iZo6N/bJjLLDmpmj5tTI4z3VavuaM/boj4gNKDDO+MWcQ==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXU3VtVlk1bW5UMXZSODhF
+ M3diS2pJTW9DSHN5TEhTNUx1Mk1UQmR0dldBCkJuaVMwRkZwOHpMbXBpZWQxZXVZ
+ RW9nWk9PTGFTK25NZVE0WHM3dlJpaDgKLS0tIGVhamZzVE1XeThIaUtqZ2Z6WW9i
+ T0FvR2UxYnlHODh2ZFcyYnJaamJJUEkKLTvc5HOerlSqlTkzoc3HkyZ/798q5f4/
+ Hqe+nGSWkNAOeZVRj+Y3vt1HLnzcm17xd2gRkaA1JAVDCY7yRnguaA==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-04-15T12:24:10Z"
- mac: ENC[AES256_GCM,data:AcjuvvVDrG5cxxdE9fboTgN9SEvGepLVWZu5UPRbvbxEco9V4zzWZZw7S9VVEHYWXXRSjVxr4g1TWn9R6LDWj0zkAAkl8WmRSq4/kQGOGnGO+WSt9nc+a4OafqEhm1fHHgkMrGUP56XBLBtuKYmWwZtQ1DLJW9NqhbATc31c7dc=,iv:0jdf66I3HxeIjTnUY7oJt37F7qw42y4rwSkUOb9HNTM=,tag:/AN1XxF7Jw6d3P0YS5xzGQ==,type:str]
+ lastmodified: "2025-04-15T14:35:11Z"
+ mac: ENC[AES256_GCM,data:LqgYl93u5Jq3bxijiHfUoEC6jmrlT30XySfGGQOSgLYg9RVDQNimCj4sibUbPz65KBgSfhR90R2uaE0112W2NCQY4QdOZZviEhW31XVQfTCrSaBwzZQ8/yJ5a1AV1EtwnbspuX9BRQxMtr4S/2xd+Nj+tcAmF3eIT0LhuLmkIXo=,iv:eWn0qIolTocOCnoy3lH836OU2fxPqc2rtwHJMEsKv8s=,tag:OryIGctRAmflHGH960WCnw==,type:str]
pgp: []
- encrypted_regex: ^(root_password|rspamd_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/encrypt.sh b/encrypt.sh
@@ -2,5 +2,5 @@
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(root_password|rspamd_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
+ --encrypted-regex '^(root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
--in-place "$1"
