commit 4d139687556473e4dde41fbfafa8f1928b185e6e
parent 4774b4f63c465bb662b48f8cb2343c3ec7905389
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 6 May 2024 00:04:57 +0200
Move synapse and add authentik to new cluster
Diffstat:
6 files changed, 111 insertions(+), 229 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -1,6 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
+ - ../base/authentik
- ../base/victoria-metrics-k8s-stack
- ../base/traefik
- ../base/postgres-operator
@@ -8,6 +9,7 @@ resources:
- ../base/matrix/matrix-helm
- ../base/matrix/draupnir-synapse
- ../base/matrix/draupnir4all
+ - ../base/matrix/synapse
- ../base/matrix/draupnir-fluffy
- ../base/matrix/draupnir-freifunk
patchesStrategicMerge:
diff --git a/apps/base/authentik/release.yaml b/apps/base/authentik/release.yaml
@@ -51,7 +51,7 @@ spec:
value: "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fe80::/10,::1/128,10.244.0.0/16,fc00:0::/96,fd00::/7"
ingress:
annotations:
- cert-manager.io/cluster-issuer: letsencrypt-http
+ cert-manager.io/cluster-issuer: letsencrypt-dns
enabled: true
hosts:
- auth.midnightthoughts.space
diff --git a/apps/base/matrix/draupnir-synapse/release.yaml b/apps/base/matrix/draupnir-synapse/release.yaml
@@ -10,6 +10,7 @@ spec:
sourceRef:
kind: HelmRepository
name: ananace-charts
+ version: 3.9.x
interval: 50m
install:
remediation:
diff --git a/apps/base/matrix/kustomization.yaml b/apps/base/matrix/kustomization.yaml
@@ -5,4 +5,4 @@ resources:
- ./matrix-helm
- ./media-repo
- ./sliding-proxy
- - ./synapse
+ #- ./synapse
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -1,4 +1,3 @@
----
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
@@ -11,22 +10,41 @@ spec:
sourceRef:
kind: HelmRepository
name: ananace-charts
+ version: 3.9.x
interval: 50m
install:
remediation:
retries: 3
values:
+ signingkey:
+ job:
+ enabled: false
+ existingSecret: matrix-synapse-signingkey
+ existingSecretKey: signing.key
+ serverName: midnightthoughts.space
+ publicServerName: matrix.midnightthoughts.space
+ config:
+ reportStats: true
+ enableRegistration: false
+ trustedKeyServers:
+ - server_name: matrix.org
wellknown:
enabled: true
+ client:
+ m.homeserver:
+ base_url: https://matrix.midnightthoughts.space
+ org.matrix.msc3575.proxy:
+ url: https://sliding.matrix.midnightthoughts.space
extraData:
support:
contacts:
- - email_address: "support@nordgedanken.dev"
- role: "admin"
+ - email_address: support@nordgedanken.dev
+ role: admin
image:
pullSecrets:
- name: docker
extraConfig:
+ registration_shared_secret: ENC[AES256_GCM,data:OaaLMNdLTnVsaiOKFqo6WVSwXebszYcfHBLzJejBNnJIU9NfO8iJk35ZzU5DLIEQVVZlUu0iW38fXrlr0Wtl8Q==,iv:FVweLwsqimASD4zGhcpqpUIRzHwGT0k9c3kLhylILWc=,tag:3XIp1WCjkwgWAIby+g/XqA==,type:str]
stream_writers:
events: event_persister
run_background_tasks_on: background_worker
@@ -63,19 +81,8 @@ spec:
existingClaim: matrix-synapse-v2
volumePermissions:
enabled: false
-
workers:
default:
- tolerations:
- - key: "arch"
- operator: "Equal"
- value: "arm64"
- effect: "NoSchedule"
- # extraEnv:
- #- name: LD_PRELOAD
- # value: /usr/lib/x86_64-linux-gnu/libjemalloc.so.2
- #- name: SYNAPSE_ASYNC_IO_REACTOR
- # value: "true"
extraConfig:
event_cache_size: 30K
caches:
@@ -88,101 +95,92 @@ spec:
target_cache_memory_usage: 2048M
min_cache_ttl: 5m
federation_reader:
- replicaCount: 2
+ replicaCount: 1
enabled: true
generic: true
- listeners: [federation]
+ listeners:
+ - federation
paths:
- - "/_matrix/federation/v1/send/"
+ - /_matrix/federation/v1/send/
event_persister:
name: event_persister
replicaCount: 1
enabled: true
generic: true
- listeners: [replication]
-
+ listeners:
+ - replication
background_worker:
name: background_worker
replicaCount: 1
enabled: true
generic: true
-
generic_frontend:
- replicaCount: 2
+ replicaCount: 1
enabled: true
generic: true
- listeners: [client]
+ listeners:
+ - client
csPaths:
# Sync requests
- - "/_matrix/client/(r0|v3)/sync$"
- - "/_matrix/client/(api/v1|r0|v3)/events$"
- - "/_matrix/client/(api/v1|r0|v3)/initialSync$"
- - "/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$"
-
+ - /_matrix/client/(r0|v3)/sync$
+ - /_matrix/client/(api/v1|r0|v3)/events$
+ - /_matrix/client/(api/v1|r0|v3)/initialSync$
+ - /_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$
# Client API requests
- - "/_matrix/client/(api/v1|r0|v3|unstable)/createRoom$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$"
- - "/_matrix/client/v1/rooms/.*/hierarchy$"
- - "/_matrix/client/(v1|unstable)/rooms/.*/relations/"
- - "/_matrix/client/v1/rooms/.*/threads$"
- - "/_matrix/client/unstable/org.matrix.msc2716/rooms/.*/batch_send$"
- - "/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$"
- - "/_matrix/client/(r0|v3|unstable)/account/3pid$"
- - "/_matrix/client/(r0|v3|unstable)/account/whoami$"
- - "/_matrix/client/(r0|v3|unstable)/devices$"
- - "/_matrix/client/versions$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$"
- - "/_matrix/client/v1/rooms/.*/timestamp_to_event$"
- - "/_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/search$"
- - "/_matrix/client/(r0|v3|unstable)/user/.*/filter(/|$)"
-
+ - /_matrix/client/(api/v1|r0|v3|unstable)/createRoom$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$
+ - /_matrix/client/v1/rooms/.*/hierarchy$
+ - /_matrix/client/(v1|unstable)/rooms/.*/relations/
+ - /_matrix/client/v1/rooms/.*/threads$
+ - /_matrix/client/unstable/org.matrix.msc2716/rooms/.*/batch_send$
+ - /_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$
+ - /_matrix/client/(r0|v3|unstable)/account/3pid$
+ - /_matrix/client/(r0|v3|unstable)/account/whoami$
+ - /_matrix/client/(r0|v3|unstable)/devices$
+ - /_matrix/client/versions$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/
+ - /_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$
+ - /_matrix/client/v1/rooms/.*/timestamp_to_event$
+ - /_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases
+ - /_matrix/client/(api/v1|r0|v3|unstable)/search$
+ - /_matrix/client/(r0|v3|unstable)/user/.*/filter(/|$)
# Encryption requests
- - "/_matrix/client/(r0|v3|unstable)/keys/query$"
- - "/_matrix/client/(r0|v3|unstable)/keys/changes$"
- - "/_matrix/client/(r0|v3|unstable)/keys/claim$"
- - "/_matrix/client/(r0|v3|unstable)/room_keys/"
- - "/_matrix/client/(r0|v3|unstable)/keys/upload/"
-
+ - /_matrix/client/(r0|v3|unstable)/keys/query$
+ - /_matrix/client/(r0|v3|unstable)/keys/changes$
+ - /_matrix/client/(r0|v3|unstable)/keys/claim$
+ - /_matrix/client/(r0|v3|unstable)/room_keys/
+ - /_matrix/client/(r0|v3|unstable)/keys/upload/
# Registration/login requests
- - "/_matrix/client/(api/v1|r0|v3|unstable)/login$"
- - "/_matrix/client/(r0|v3|unstable)/register$"
- - "/_matrix/client/(r0|v3|unstable)/register/available$"
- - "/_matrix/client/v1/register/m.login.registration_token/validity$"
-
+ - /_matrix/client/(api/v1|r0|v3|unstable)/login$
+ - /_matrix/client/(r0|v3|unstable)/register$
+ - /_matrix/client/(r0|v3|unstable)/register/available$
+ - /_matrix/client/v1/register/m.login.registration_token/validity$
# Event sending requests
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/"
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send
+ - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/
# - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$"
# - "/_matrix/client/(api/v1|r0|v3|unstable)/join/"
# - "/_matrix/client/(api/v1|r0|v3|unstable)/knock/"
- - "/_matrix/client/(api/v1|r0|v3|unstable)/profile/"
-
+ - /_matrix/client/(api/v1|r0|v3|unstable)/profile/
# # User directory search requests
# - /_matrix/client/(r0|v3|unstable)/user_directory/search$
-
# Worker event streams
# See https://matrix-org.github.io/synapse/latest/workers.html#stream-writers
#
-
# The account_data event stream
# - /_matrix/client/(r0|v3|unstable)/.*/tags
# - /_matrix/client/(r0|v3|unstable)/.*/account_data
-
# The receipts event stream
# - /_matrix/client/(r0|v3|unstable)/rooms/.*/receipt
# - /_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers
-
# The presence event stream
# - /_matrix/client/(api/v1|r0|v3|unstable)/presence/
-
pusher:
enabled: true
appservice:
@@ -201,13 +199,7 @@ spec:
app: federation_sender
name: federation-sender-2
enabled: true
-
synapse:
- tolerations:
- - key: "arch"
- operator: "Equal"
- value: "arm64"
- effect: "NoSchedule"
## Liveness probe configuration to use
##
livenessProbe:
@@ -216,7 +208,6 @@ spec:
httpGet:
path: /health
port: http
-
## Readiness probe configuration to use
##
readinessProbe:
@@ -225,20 +216,11 @@ spec:
httpGet:
path: /health
port: http
-
extraCommands: []
- extraEnv:
- #- name: LD_PRELOAD
- # value: /usr/lib/x86_64-linux-gnu/libjemalloc.so.2
- #- name: SYNAPSE_CACHE_FACTOR
- # value: "20"
- #- name: SYNAPSE_ASYNC_IO_REACTOR
- # value: "true"
annotations:
prometheus.io/scrape: "true"
- prometheus.io/path: "/_synapse/metrics"
+ prometheus.io/path: /_synapse/metrics
prometheus.io/port: "9090"
-
externalRedis:
host: matrix-synapse-keydb.matrix.svc.cluster.local
port: 6379
@@ -253,9 +235,41 @@ spec:
postgresql:
enabled: false
externalPostgresql:
- host: matrix-postgres-cluster.matrix-postgres-cluster.svc.cluster.local
+ host: postgres-cluster.postgres-cluster.svc.cluster.local
port: 5432
-
- ## Password key to be retrieved from existing secret
- existingSecretPasswordKey: password
sslmode: require
+ username: synapse
+ database: synapse
+ password: ENC[AES256_GCM,data:FeVzqxvKZuPY0HCrjS4OR3FyAi4WLXNSAgEzh95v5SINmIlfHdqlpSUvj0OQZPRlKs3cdm36DHXhb5xp5AC3oQ==,iv:CFcxmdcz4t9eWVF0PT8dXmN/seCyfB7hB1FFcDE671k=,tag:5xjPXTwVTuWzZz2o0u6Ldg==,type:str]
+ ingress:
+ traefikPaths: true
+ hosts:
+ - midnightthoughts.space
+ - matrix.midnightthoughts.space
+ tls:
+ - hosts:
+ - midnightthoughts.space
+ - matrix.midnightthoughts.space
+ secretName: midnightthoughts-synapse-tls-secret
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTajZERDFhUlBpZTdzc0k1
+ MnltMWxZMW45eFFQdzBENS9xd0E2UEI3ZlNrCm9lSnpsYURMV1g0M3ZOUUJSUWZC
+ ck05VHMzbWZiRDZUTlViZGQ4Q25VaU0KLS0tIHBBL3k1cTVLY1pVZSsxYWl5eE9D
+ K29Gc1A0YmZCc1hEa2Jkc0ttYTIwaUEK9wXYaG2BVLwKSaBSN3tgH1LyUYwt82XD
+ IF1doFIr7JdL6ZQPXdMgHPsYf6nEoqJ7lLmJSXjPeve2pIa0+9b5ug==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2024-05-05T11:10:15Z"
+ mac: ENC[AES256_GCM,data:qT82NWymlJv+vhQpv0a4kIObi6SO7SlI0O6x5HEp4ekUhr3JFgDC743MgbBzST/psJQVCPhMP+7AwVXhPNfhRHdazIzjXBK8mZGBai2pPQN80grfgUpJzBN9Z6njfxLZmQ5x3J4nmlk1G52vORb2t19ku3n+WQKzSX3zSPdIf8E=,iv:8qHsducftSH9/kfC7SR8TXSB3yrK/TO4q+Gwvki9G4o=,tag:CsHia++7reNtEIOZhgHlyA==,type:str]
+ pgp: []
+ encrypted_regex: ^(clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|PASSWD|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+ version: 3.8.1
diff --git a/apps/production/synapse-midnightthoughts.yaml b/apps/production/synapse-midnightthoughts.yaml
@@ -1,135 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta2
-kind: HelmRelease
-metadata:
- name: matrix-synapse
- namespace: matrix
-spec:
- releaseName: matrix-synapse
- chart:
- spec:
- version: 3.9.x
- values:
- signingkey:
- job:
- enabled: false
- existingSecret: matrix-synapse-signingkey
- existingSecretKey: signing.key
- # image:
- # repository: ghcr.io/matrix-org/synapse
- # # TODO update properly again
- # tag: v1.89.0
- # #pullPolicy: Always
- serverName: midnightthoughts.space
- publicServerName: matrix.midnightthoughts.space
- wellknown:
- client:
- m.homeserver:
- base_url: https://matrix.midnightthoughts.space
- org.matrix.msc3575.proxy:
- url: https://sliding.matrix.midnightthoughts.space
- config:
- reportStats: true
- enableRegistration: false
- trustedKeyServers:
- - server_name: matrix.org
- extraConfig:
- registration_shared_secret: ENC[AES256_GCM,data:vJWUobTSBoVr6RVCLBjNT2aLrw8DdvRfSMuzEJA0b/rfX+BbZ1x6HIawL91O//3EDQGt1GO4W5/o7tWxcs2OCQ==,iv:5x8BiguScH+rLpXFXk2UucM8JsI12lJRkZgU5d8vWRQ=,tag:pG/LN66BcoNyZOHr80FrrQ==,type:str]
- # app_service_config_files:
- # - /data/whatsapp-registration.yaml
- # - /data/instagram-registration.yaml
- # - /data/signal-registration.yaml
- # - /data/hookshot-registration.yaml
- ingress:
- traefikPaths: true
- hosts:
- - midnightthoughts.space
- - matrix.midnightthoughts.space
- tls:
- - hosts:
- - midnightthoughts.space
- - matrix.midnightthoughts.space
- secretName: midnightthoughts-synapse-tls-secret
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-http
- traefik.ingress.kubernetes.io/router.tls: "true"
- traefik.ingress.kubernetes.io/router.middlewares: default-hsts@kubernetescrd,default-compress@kubernetescrd,default-redirect-https@kubernetescrd
- # workers:
- # default:
- # volumeMounts:
- # - mountPath: /data/whatsapp-registration.yaml
- # subPath: registration.yaml
- # name: whatsapp-config-volume
- # - mountPath: /data/instagram-registration.yaml
- # subPath: registration.yaml
- # name: instagram-config-volume
- # - mountPath: /data/signal-registration.yaml
- # subPath: registration.yaml
- # name: signal-config-volume
- # - mountPath: /data/hookshot-registration.yaml
- # subPath: registration.yaml
- # name: hookshot-config-volume
- # volumes:
- # - name: whatsapp-config-volume
- # configMap:
- # name: whatsapp-bridge-config
- # - name: instagram-config-volume
- # configMap:
- # name: instagram-bridge-config
- # - name: signal-config-volume
- # configMap:
- # name: signal-bridge-config
- # - name: hookshot-config-volume
- # configMap:
- # name: hookshot-config
- # synapse:
- # extraVolumeMounts:
- # - mountPath: /data/whatsapp-registration.yaml
- # subPath: registration.yaml
- # name: whatsapp-config-volume
- # - mountPath: /data/instagram-registration.yaml
- # subPath: registration.yaml
- # name: instagram-config-volume
- # - mountPath: /data/signal-registration.yaml
- # subPath: registration.yaml
- # name: signal-config-volume
- # - mountPath: /data/hookshot-registration.yaml
- # subPath: registration.yaml
- # name: hookshot-config-volume
- # extraVolumes:
- # - name: whatsapp-config-volume
- # configMap:
- # name: whatsapp-bridge-config
- # - name: instagram-config-volume
- # configMap:
- # name: instagram-bridge-config
- # - name: signal-config-volume
- # configMap:
- # name: signal-bridge-config
- # - name: hookshot-config-volume
- # configMap:
- # name: hookshot-config
- externalPostgresql:
- username: synapse
- ## The name of an existing secret with postgresql credentials
- existingSecret: synapse-midnightthoughts-postgresql
- database: synapse
-sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUcW9iMFdwZkdLYjhWckR3
- c2RoWW9Pd2thNjhDQ1kzR2hJRi9Ma3VJV2lnCjI5ZU1OVC9ERGswWEcweVVyYjh1
- KzVYMFBEZ1dKRkZnbTRlaU8vNU1hOEUKLS0tIEI5WTQ3S3pHRWc3a0JyTGIrWTJy
- T1BNT25UOFZNZUVPVlREU2JVU3VSZ00K/1uxN8igWMi1P98snDXJaYdeyUxxUahd
- mUM/XbVzke4DGV2jAXbFVtqcsg+RIJXFy2U1wi6wB7IVtpwZnJPLjg==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-08-22T13:04:50Z"
- mac: ENC[AES256_GCM,data:11it1Ndjurv1IuYVEf6nh2cExr3XRko4DDqZAOwI0lHYvJufh86K+as52uY1TfRor9UMciFIPmiq5CUpKWsx4qav4crJ8PWTm8mPyla9yjRDIw1EtZiqlB2e77aoevx87aXbHojnMcm2NQyOtcUtUO5y1yODsTA6M5eJD2BnkLY=,iv:yinHghT5bqLkteIODPh/C8sgA4DBfJbRnNhdl3YBBO8=,tag:Ha9VJ1Gtpz7BLAT39K9mag==,type:str]
- pgp: []
- encrypted_regex: ^(privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
- version: 3.7.3
