cluster

commit 42d14390d64c7aedd272c80e1f408ade7f75669a
parent 7c071a353b696fa546b528f5512ab1911c1c94df
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed, 12 Feb 2025 14:42:39 +0100

Improve the synapse security

Diffstat:
M
apps/base/matrix/draupnir-synapse/release.yaml
 | 
73
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------

1 file changed, 64 insertions(+), 9 deletions(-)
diff --git a/apps/base/matrix/draupnir-synapse/release.yaml b/apps/base/matrix/draupnir-synapse/release.yaml
@@ -71,14 +71,45 @@ spec:
             enabled: true
         workers:
             default:
+                podSecurityContext:
+                    fsGroup: 666
+                    runAsGroup: 666
+                    runAsUser: 666
+                securityContext:
+                    capabilities:
+                        drop:
+                            - ALL
+                    readOnlyRootFilesystem: true
+                    runAsNonRoot: true
+                    runAsUser: 666
                 volumeMounts:
+                    - name: matrix-org-blocker
+                      mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
+                    - name: pip-cache
+                      mountPath: /.cache/pip
+                    - name: tmp
+                      mountPath: /tmp
+                    - name: local
+                      mountPath: /.local
+                    - name: media-nonesense
+                      mountPath: /synapse/data
                     - name: configs
                       mountPath: /data
                       readOnly: true
                 volumes:
+                    - name: matrix-org-blocker
+                      emptyDir: {}
+                    - name: pip-cache
+                      emptyDir: {}
+                    - name: tmp
+                      emptyDir: {}
+                    - name: local
+                      emptyDir: {}
+                    - name: media-nonesense
+                      emptyDir: {}
                     - name: configs
                       secret:
-                        secretName: ENC[AES256_GCM,data:m7x2Z3oCmA6xIRqbkrccx91eNA==,iv:TsKqYTJLDiFtnH0TmLOsFLlwEdNg1r8hJYZdkhtWOGo=,tag:0SXGKKpLh0yUSHcqQ+aKcg==,type:str]
+                          secretName: ENC[AES256_GCM,data:m7x2Z3oCmA6xIRqbkrccx91eNA==,iv:TsKqYTJLDiFtnH0TmLOsFLlwEdNg1r8hJYZdkhtWOGo=,tag:0SXGKKpLh0yUSHcqQ+aKcg==,type:str]
                 extraConfig:
                     opentracing:
                         enabled: false
@@ -201,19 +232,43 @@ spec:
                 listeners:
                     - replication
         synapse:
+            podSecurityContext:
+                fsGroup: 666
+                runAsGroup: 666
+                runAsUser: 666
+            securityContext:
+                capabilities:
+                    drop:
+                        - ALL
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
+                runAsUser: 666
             resources:
                 requests:
                     cpu: 14m
                     memory: 150Mi
                 limits: {}
+
             extraVolumeMounts:
                 - name: configs
                   mountPath: /data
                   readOnly: true
+                - name: matrix-org-blocker
+                  mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
+                - name: pip-cache
+                  mountPath: /.cache/pip
+                - name: local
+                  mountPath: /.local
             extraVolumes:
+                - name: matrix-org-blocker
+                  emptyDir: {}
+                - name: pip-cache
+                  emptyDir: {}
+                - name: local
+                  emptyDir: {}
                 - name: configs
                   secret:
-                    secretName: ENC[AES256_GCM,data:aVOK2h6KTIKNX8Ypa+AF2UOITA==,iv:PIyZ94Tfr84QUqut2oFu09bYRGwJiKpEpfBmWtQZNXE=,tag:QZflZ3hovkN5a1Bs5S4oMg==,type:str]
+                      secretName: ENC[AES256_GCM,data:aVOK2h6KTIKNX8Ypa+AF2UOITA==,iv:PIyZ94Tfr84QUqut2oFu09bYRGwJiKpEpfBmWtQZNXE=,tag:QZflZ3hovkN5a1Bs5S4oMg==,type:str]
             ## Liveness probe configuration to use
             ##
             livenessProbe:
@@ -284,13 +339,13 @@ sops:
     age:
         - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
           enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dFpjM1lmcllpR0RKdXdv
-            bTAydDBWbVRoRXhDUjRwc0FxcjdNU1VNalNJCjcwWE9mQnUydU9QdGZNVWRvSk5k
-            NWRiY1diZy9XRkgxaEgycVp5ZHgyQlkKLS0tIFNtbFJRdm5lMklZUS9FL0xrMW5F
-            RUwrQmhKTlRLVjk3QlRxQ3pUb3pEMHcKRT/WEzTcOmlzlvMT5ddT82d8inRAgvyQ
-            qom+xJO9SM2jcej4kl+0cMJ8zqsrXmw7PukTLjKXOh6egmw+p6qMpQ==
-            -----END AGE ENCRYPTED FILE-----
+              -----BEGIN AGE ENCRYPTED FILE-----
+              YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dFpjM1lmcllpR0RKdXdv
+              bTAydDBWbVRoRXhDUjRwc0FxcjdNU1VNalNJCjcwWE9mQnUydU9QdGZNVWRvSk5k
+              NWRiY1diZy9XRkgxaEgycVp5ZHgyQlkKLS0tIFNtbFJRdm5lMklZUS9FL0xrMW5F
+              RUwrQmhKTlRLVjk3QlRxQ3pUb3pEMHcKRT/WEzTcOmlzlvMT5ddT82d8inRAgvyQ
+              qom+xJO9SM2jcej4kl+0cMJ8zqsrXmw7PukTLjKXOh6egmw+p6qMpQ==
+              -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-01-18T16:41:05Z"
     mac: ENC[AES256_GCM,data:bejkU903B5B+O8+zzTa0Rypwfq29N94yWBw9/kOf/XByJZYdsCtC6kYX6G/QLwPRRvKuONYEozAxqFbiTqkR1NVyzqDf8Oj+KEXtQBf3P0SY334yCmaeajHLlKm6kanD5NnpVSmX3BcuVfTGwQK3jZ+Kab+cDNu4/AGqw+6Vnxg=,iv:vg1mrpIUNny4WqqS666kM4yvZpI0TuL7ViSP+ib7HVM=,tag:JF0OdVZino0cP0+Bmx+slw==,type:str]
     pgp: []