commit 635cd368547e5cbf337ae9f46c02ab9197ebf07d parent 4fdf96b9554a552b8bac1757e42571a14bbd5e68 Author: MTRNord <MTRNord@users.noreply.github.com> Date: Sun, 3 Aug 2025 20:17:20 +0200 Step 1 migrating d4all Diffstat:
12 files changed, 774 insertions(+), 48 deletions(-)
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml @@ -130,30 +130,30 @@ spec: load-balancer.hetzner.cloud/uses-proxyprotocol: "false" # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002 listeners: - - name: https-draupnir-midnightthoughts - protocol: HTTPS - hostname: "draupnir.midnightthoughts.space" - port: 443 - allowedRoutes: - namespaces: - from: "All" - tls: - mode: Terminate - certificateRefs: - - kind: Secret - name: draupnir.midnightthoughts.space-tls - - name: https-matrix-draupnir-midnightthoughts - protocol: HTTPS - hostname: "matrix.draupnir.midnightthoughts.space" - port: 443 - allowedRoutes: - namespaces: - from: "All" - tls: - mode: Terminate - certificateRefs: - - kind: Secret - name: matrix.draupnir.midnightthoughts.space-tls + # - name: https-draupnir-midnightthoughts + # protocol: HTTPS + # hostname: "draupnir.midnightthoughts.space" + # port: 443 + # allowedRoutes: + # namespaces: + # from: "All" + # tls: + # mode: Terminate + # certificateRefs: + # - kind: Secret + # name: draupnir.midnightthoughts.space-tls + # - name: https-matrix-draupnir-midnightthoughts + # protocol: HTTPS + # hostname: "matrix.draupnir.midnightthoughts.space" + # port: 443 + # allowedRoutes: + # namespaces: + # from: "All" + # tls: + # mode: Terminate + # certificateRefs: + # - kind: Secret + # name: matrix.draupnir.midnightthoughts.space-tls - name: https-docuseal-midnightthoughts protocol: HTTPS hostname: "docuseal.midnightthoughts.space" diff --git a/apps/talos_cluster/draupnir-synapse/keydb.yaml b/apps/talos_cluster/draupnir-synapse/keydb.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: draupnir-synapse-keydb +spec: + replicas: 1 + selector: + matchLabels: + app: draupnir-synapse-keydb + template: + metadata: + labels: + app: draupnir-synapse-keydb + spec: + containers: + - name: draupnir-synapse-keydb + image: eqalpha/keydb:latest + imagePullPolicy: Always + command: ["keydb-server"] + args: ["/etc/keydb/keydb.conf", "--protected-mode", "no"] + ports: + - containerPort: 6379 + resources: + requests: + memory: "128Mi" + cpu: "100m" + limits: {} + tolerations: + - key: arch + operator: Equal + value: arm64 + effect: NoSchedule + livenessProbe: + exec: + command: + - sh + - -c + - keydb-cli ping + initialDelaySeconds: 10 + timeoutSeconds: 5 + readinessProbe: + exec: + command: + - sh + - -c + - keydb-cli ping + initialDelaySeconds: 10 + timeoutSeconds: 5 +--- +apiVersion: v1 +kind: Service +metadata: + name: draupnir-synapse-keydb +spec: + selector: + app: draupnir-synapse-keydb + ports: + - name: redis + protocol: TCP + port: 6379 + targetPort: 6379 diff --git a/apps/talos_cluster/draupnir-synapse/kustomization.yaml b/apps/talos_cluster/draupnir-synapse/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: matrix +resources: + - repository.yaml + - release.yaml + - podmonitor.yaml + - keydb.yaml diff --git a/apps/talos_cluster/draupnir-synapse/podmonitor.yaml b/apps/talos_cluster/draupnir-synapse/podmonitor.yaml @@ -0,0 +1,23 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: draupnir-synapse + labels: + instance: draupnir4all +spec: + jobLabel: "app.kubernetes.io/component" + namespaceSelector: + matchNames: + - "matrix" + selector: + matchLabels: + app.kubernetes.io/instance: draupnir-synapse + app.kubernetes.io/name: matrix-synapse + podMetricsEndpoints: + - port: metrics + path: "/_synapse/metrics" + interval: 5s + relabelings: + - sourceLabels: + - "__meta_kubernetes_pod_label_app_kubernetes_io_instance" + targetLabel: instance diff --git a/apps/talos_cluster/draupnir-synapse/release.yaml b/apps/talos_cluster/draupnir-synapse/release.yaml @@ -0,0 +1,406 @@ +apiVersion: helm.toolkit.fluxcd.io/v2beta2 +kind: HelmRelease +metadata: + name: draupnir-synapse + namespace: matrix +spec: + chart: + spec: + chart: matrix-synapse + sourceRef: + kind: HelmRepository + name: ananace-charts + version: 3.12.x + interval: 60m + install: + remediation: + retries: 3 + values: + extraConfig: + opentracing: + enabled: false + homeserver_whitelist: + - matrix.midnightthoughts.space + jaeger_config: + local_agent: + reporting_host: tempo.monitoring.svc.cluster.local + use_presence: false + app_service_config_files: + - /data/draupnir-registration.yaml + notify_appservices_from_worker: appservices + stream_writers: + events: event_persister + run_background_tasks_on: background_worker + presence: + enabled: false + federation_sender_instances: + - federation-sender-1 + - federation-sender-2 + event_cache_size: 10K + caches: + global_factor: 10 + expire_caches: true + cache_entry_ttl: 240m + cache_autotuning: + max_cache_memory_usage: 2048M + target_cache_memory_usage: 1024M + min_cache_ttl: 5m + wellknown: + enabled: true + client: + m.homeserver: + base_url: https://matrix.draupnir.midnightthoughts.space + extraData: + support: + admins: + - email_address: support@midnightthoughts.space + role: admin + image: + tag: "v1.128.0" + pullSecrets: + - name: ghcr-pull + persistence: + size: 2Gi + existingClaim: draupnir-synapse-matrix-synapse-v2 + volumePermissions: + enabled: true + workers: + default: + podSecurityContext: + fsGroup: 666 + runAsGroup: 666 + runAsUser: 666 + securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 666 + volumeMounts: + - name: matrix-org-blocker + mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker + - name: pip-cache + mountPath: /.cache/pip + - name: tmp + mountPath: /tmp + - name: local + mountPath: /.local + - name: media-nonesense + mountPath: /synapse/data + - name: configs + mountPath: /data + readOnly: true + volumes: + - name: matrix-org-blocker + emptyDir: {} + - name: pip-cache + emptyDir: {} + - name: tmp + emptyDir: {} + - name: local + emptyDir: {} + - name: media-nonesense + emptyDir: {} + - name: configs + secret: + secretName: ENC[AES256_GCM,data:m7x2Z3oCmA6xIRqbkrccx91eNA==,iv:TsKqYTJLDiFtnH0TmLOsFLlwEdNg1r8hJYZdkhtWOGo=,tag:0SXGKKpLh0yUSHcqQ+aKcg==,type:str] + extraConfig: + opentracing: + enabled: false + homeserver_whitelist: + - matrix.midnightthoughts.space + jaeger_config: + local_agent: + reporting_host: tempo.monitoring.svc.cluster.local + notify_appservices_from_worker: appservices + event_cache_size: 30K + caches: + global_factor: 10 + expire_caches: true + cache_entry_ttl: 1080m + sync_response_cache_duration: 2m + cache_autotuning: + max_cache_memory_usage: 4069M + target_cache_memory_usage: 2048M + min_cache_ttl: 5m + generic_frontend: + resources: + requests: + cpu: 101m + memory: 500Mi + limits: {} + replicaCount: 1 + enabled: true + generic: true + listeners: + - client + csPaths: + # Sync requests + - /_matrix/client/(r0|v3)/sync$ + - /_matrix/client/(api/v1|r0|v3)/events$ + - /_matrix/client/(api/v1|r0|v3)/initialSync$ + - /_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ + # Client API requests + - /_matrix/client/(api/v1|r0|v3|unstable)/createRoom$ + - /_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$ + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$ + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$ + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$ + #- /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$ + - /_matrix/client/v1/rooms/.*/hierarchy$ + - /_matrix/client/(v1|unstable)/rooms/.*/relations/.* + - /_matrix/client/v1/rooms/.*/threads$ + - /_matrix/client/unstable/im.nheko.summary/summary/.*$ + - /_matrix/client/(r0|v3|unstable)/account/3pid$ + - /_matrix/client/(r0|v3|unstable)/account/whoami$ + - /_matrix/client/(r0|v3|unstable)/devices$ + - /_matrix/client/versions$ + - /_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/.* + - /_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ + - /_matrix/client/v1/rooms/.*/timestamp_to_event$ + - /_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases.* + - /_matrix/client/(api/v1|r0|v3|unstable)/search$ + - /_matrix/client/(r0|v3|unstable)/user/.*/filter(/.*|$) + - /_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ + - /_matrix/client/(r0|v3|unstable)/capabilities$ + - /_matrix/client/(r0|v3|unstable)/notifications$ + # Encryption requests + - /_matrix/client/(r0|v3|unstable)/keys/query$ + - /_matrix/client/(r0|v3|unstable)/keys/changes$ + - /_matrix/client/(r0|v3|unstable)/keys/claim$ + - /_matrix/client/(r0|v3|unstable)/room_keys/.* + - /_matrix/client/(r0|v3|unstable)/keys/upload/.* + # Registration/login requests are done by MAS. + # Event sending requests + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact.* + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send.* + #- /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/.* + - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ + - /_matrix/client/(api/v1|r0|v3|unstable)/join/.* + - /_matrix/client/(api/v1|r0|v3|unstable)/knock/.* + - /_matrix/client/(api/v1|r0|v3|unstable)/profile/.* + # # User directory search requests + - /_matrix/client/(r0|v3|unstable)/user_directory/search$ + # Worker event streams + # See https://matrix-org.github.io/synapse/latest/workers.html#stream-writers + # hopefully no stream + - ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events.* + # The pushrules event stream + # - ^/_matrix/client/(api/v1|r0|v3|unstable)/pushrules/ + # The account_data event stream + # - /_matrix/client/(r0|v3|unstable)/.*/tags + # - /_matrix/client/(r0|v3|unstable)/.*/account_data + # The receipts event stream + # - /_matrix/client/(r0|v3|unstable)/rooms/.*/receipt + # - /_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers + # The presence event stream + # - /_matrix/client/(api/v1|r0|v3|unstable)/presence/ + federation_reader: + resources: + requests: + cpu: 17m + memory: 153Mi + limits: {} + replicaCount: 1 + enabled: true + generic: true + listeners: + - federation + paths: + - /_matrix/federation/v1/send/.* + - /_matrix/federation/v1/event/.* + - /_matrix/federation/v1/state/.* + - /_matrix/federation/v1/state_ids/.* + - /_matrix/federation/v1/backfill/.* + - /_matrix/federation/v1/get_missing_events/.* + - /_matrix/federation/v1/publicRooms.* + - /_matrix/federation/v1/query/.* + - /_matrix/federation/v1/make_join/.* + - /_matrix/federation/v1/make_leave/.* + - /_matrix/federation/(v1|v2)/send_join/.* + - /_matrix/federation/(v1|v2)/send_leave/.* + - /_matrix/federation/v1/make_knock/.* + - /_matrix/federation/v1/send_knock/.* + - /_matrix/federation/(v1|v2)/invite/.* + - /_matrix/federation/v1/event_auth/.* + - /_matrix/federation/v1/timestamp_to_event/.* + - /_matrix/federation/v1/exchange_third_party_invite/.* + - /_matrix/federation/v1/user/devices/.* + - /_matrix/key/v2/query.* + - /_matrix/federation/v1/hierarchy/.* + appservice: + resources: + requests: + cpu: 18m + memory: 120Mi + limits: {} + enabled: true + name: appservices + generic: true + federation_sender_1: + resources: + requests: + cpu: 24m + memory: 131Mi + limits: {} + labels: + synapse-component: federation-sender + name: federation-sender-1 + enabled: true + generic: true + federation_sender_2: + resources: + requests: + cpu: 24m + memory: 131Mi + limits: {} + labels: + synapse-component: federation-sender + name: federation-sender-2 + enabled: true + generic: true + background_worker: + resources: + requests: + cpu: 22m + memory: 116Mi + limits: {} + name: background_worker + replicaCount: 1 + enabled: true + generic: true + event_persister: + resources: + requests: + cpu: 32m + memory: 201Mi + limits: {} + name: event_persister + replicaCount: 1 + enabled: true + generic: true + listeners: + - replication + synapse: + podSecurityContext: + fsGroup: 666 + runAsGroup: 666 + runAsUser: 666 + securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 666 + resources: + requests: + cpu: 14m + memory: 150Mi + limits: {} + extraVolumeMounts: + - name: configs + mountPath: /data + readOnly: true + - name: matrix-org-blocker + mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker + - name: pip-cache + mountPath: /.cache/pip + - name: local + mountPath: /.local + extraVolumes: + - name: matrix-org-blocker + emptyDir: {} + - name: pip-cache + emptyDir: {} + - name: local + emptyDir: {} + - name: configs + secret: + secretName: ENC[AES256_GCM,data:aVOK2h6KTIKNX8Ypa+AF2UOITA==,iv:PIyZ94Tfr84QUqut2oFu09bYRGwJiKpEpfBmWtQZNXE=,tag:QZflZ3hovkN5a1Bs5S4oMg==,type:str] + ## Liveness probe configuration to use + ## + livenessProbe: + timeoutSeconds: 60 + failureThreshold: 5 + httpGet: + path: /health + port: http + ## Readiness probe configuration to use + ## + readinessProbe: + timeoutSeconds: 60 + failureThreshold: 5 + httpGet: + path: /health + port: http + extraCommands: [] + annotations: + prometheus.io/scrape: "true" + prometheus.io/path: /_synapse/metrics + prometheus.io/port: "9090" + externalRedis: + host: draupnir-synapse-keydb.matrix.svc.cluster.local + port: 6379 + password: null + redis: + enabled: false + usePassword: false + password: null + auth: + enabled: false + password: null + postgresql: + enabled: false + externalPostgresql: + host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local + port: 5432 + sslmode: require + database: draupnir_synapse + username: draupnir_synapse + password: ENC[AES256_GCM,data:AKyUY8U2Yv4P9eGE35GeinMk2mutkhmqJtD2LbyNXY1FczzC82m4oguktEouOsrdCmPTugokdzQuDB/VODsAwQ==,iv:An2J8dC74tnGFq1zrTho0SeSjrIJxsF2wZjIJiiAnAs=,tag:WaWLRBU8xzsmOgcm4g8kYA==,type:str] + signingkey: + job: + enabled: false + serverName: draupnir.midnightthoughts.space + publicServerName: matrix.draupnir.midnightthoughts.space + config: + reportStats: true + enableRegistration: false + extraMainListenerTypes: + - media + gateway: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway + enabled: true + timeouts: + request: 60s + backendRequest: 60s + hosts: + - draupnir.midnightthoughts.space + - matrix.draupnir.midnightthoughts.space + ingress: + enabled: false +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dFpjM1lmcllpR0RKdXdv + bTAydDBWbVRoRXhDUjRwc0FxcjdNU1VNalNJCjcwWE9mQnUydU9QdGZNVWRvSk5k + NWRiY1diZy9XRkgxaEgycVp5ZHgyQlkKLS0tIFNtbFJRdm5lMklZUS9FL0xrMW5F + RUwrQmhKTlRLVjk3QlRxQ3pUb3pEMHcKRT/WEzTcOmlzlvMT5ddT82d8inRAgvyQ + qom+xJO9SM2jcej4kl+0cMJ8zqsrXmw7PukTLjKXOh6egmw+p6qMpQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-01-18T16:41:05Z" + mac: ENC[AES256_GCM,data:bejkU903B5B+O8+zzTa0Rypwfq29N94yWBw9/kOf/XByJZYdsCtC6kYX6G/QLwPRRvKuONYEozAxqFbiTqkR1NVyzqDf8Oj+KEXtQBf3P0SY334yCmaeajHLlKm6kanD5NnpVSmX3BcuVfTGwQK3jZ+Kab+cDNu4/AGqw+6Vnxg=,iv:vg1mrpIUNny4WqqS666kM4yvZpI0TuL7ViSP+ib7HVM=,tag:JF0OdVZino0cP0+Bmx+slw==,type:str] + pgp: [] + encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ + version: 3.9.1 diff --git a/apps/talos_cluster/draupnir-synapse/repository.yaml b/apps/talos_cluster/draupnir-synapse/repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1beta2 +kind: HelmRepository +metadata: + name: ananace-charts + namespace: matrix +spec: + interval: 5m + url: https://ananace.gitlab.io/charts diff --git a/apps/talos_cluster/draupnir4all/deployment.yaml b/apps/talos_cluster/draupnir4all/deployment.yaml @@ -0,0 +1,162 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: d4all-persistent-storage + namespace: matrix +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: draupnir4all + namespace: matrix + labels: + app.kubernetes.io/component: appservice + app.kubernetes.io/instance: main-process + app.kubernetes.io/name: draupnir4all +spec: + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 25% + type: RollingUpdate + selector: + matchLabels: + app: draupnir4all + template: + metadata: + labels: + app: draupnir4all + app.kubernetes.io/component: appservice + app.kubernetes.io/instance: main-process + app.kubernetes.io/name: draupnir4all + spec: + imagePullSecrets: + - name: ghcr-pull + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app + operator: In + values: + - draupnir4all + topologyKey: "kubernetes.io/hostname" + containers: + - name: draupnir4all + #image: gnuxie/draupnir:develop + #imagePullPolicy: Always + image: ghcr.io/mtrnord/draupnir:latest + imagePullPolicy: Always + # env: + # - name: TRACING_ENABLED + # value: "true" + # - name: TRACING_DIAG_ENABLED + # value: "false" + # - name: TRACING_DIAG_VERBOSE + # value: "true" + # - name: TRACING_TRACE_URL + # value: http://tempo.monitoring.svc.cluster.local:4318/v1/traces + # - name: TRACING_METRIC_URL + # value: http://tempo.monitoring.svc.cluster.local:4318/v1/metrics + env: + - name: NODE_OPTIONS + value: "--trace-warnings" + command: ["./draupnir-entrypoint.sh"] + args: ["appservice", "-c", "/data/config/config.appservice.yaml", "-f", "/data/config/draupnir-registration.yaml", + "--draupnir-config", "/data/config/draupnir-config.yaml", "-p", "9000"] + resources: + limits: {} + requests: + memory: "344Mi" + cpu: "252m" + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + readOnlyRootFilesystem: true + ports: + - containerPort: 9001 + name: api + protocol: TCP + - containerPort: 9000 + name: appservice + protocol: TCP + volumeMounts: + - name: configs + mountPath: "/data/config" + readOnly: true + - mountPath: /data/storage + name: storage + - mountPath: /tmp + name: tmp + livenessProbe: + httpGet: + path: /healthz + port: appservice + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 10 + startupProbe: + httpGet: + path: /healthz + port: appservice + initialDelaySeconds: 15 + failureThreshold: 30 + periodSeconds: 10 + - name: draupnir4all-web + image: ghcr.io/mtrnord/draupnir4all-web:latest + imagePullPolicy: Always + env: + - name: SESSION_SECRET + valueFrom: + secretKeyRef: + name: draupnir4all-web + key: session-secret + - name: D4ALL_INSTANCE_ADDRESS + value: "http://localhost:9001" + resources: + limits: {} + requests: + memory: "344Mi" + cpu: "252m" + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + readOnlyRootFilesystem: true + ports: + - containerPort: 3000 + name: web + protocol: TCP + volumeMounts: + - mountPath: /tmp + name: tmp + livenessProbe: + httpGet: + path: / + port: web + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 10 + startupProbe: + httpGet: + path: / + port: web + initialDelaySeconds: 15 + failureThreshold: 30 + periodSeconds: 10 + volumes: + - name: configs + secret: + secretName: draupnir-appservice + - name: storage + persistentVolumeClaim: + claimName: d4all-persistent-storage + - name: tmp + emptyDir: + sizeLimit: 2048Mi diff --git a/apps/talos_cluster/draupnir4all/kustomization.yaml b/apps/talos_cluster/draupnir4all/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: matrix +resources: + - deployment.yaml + - service.yaml + - metrics.yaml diff --git a/apps/talos_cluster/draupnir4all/metrics.yaml b/apps/talos_cluster/draupnir4all/metrics.yaml @@ -0,0 +1,11 @@ +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: draupnir4all + namespace: matrix +spec: + selector: + matchLabels: + app: draupnir4all + endpoints: + - port: appservice diff --git a/apps/talos_cluster/draupnir4all/service.yaml b/apps/talos_cluster/draupnir4all/service.yaml @@ -0,0 +1,39 @@ +apiVersion: v1 +kind: Service +metadata: + name: draupnir4all + namespace: matrix + labels: + app: draupnir4all +spec: + selector: + app: draupnir4all + ports: + - port: 9000 + targetPort: appservice + protocol: TCP + name: appservice + - port: 9001 + targetPort: api + protocol: TCP + name: api + - port: 3000 + targetPort: web + protocol: TCP + name: web +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: draupnir4all-web + namespace: matrix +spec: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway + hostnames: + - draupnir.midnightthoughts.space + rules: + - backendRefs: + - name: draupnir4all + port: 3000 diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml @@ -139,30 +139,30 @@ spec: certificateRefs: - kind: Secret name: grafana.midnightthoughts.space-tls - # - name: https-draupnir-midnightthoughts - # protocol: HTTPS - # hostname: "draupnir.midnightthoughts.space" - # port: 443 - # allowedRoutes: - # namespaces: - # from: "All" - # tls: - # mode: Terminate - # certificateRefs: - # - kind: Secret - # name: draupnir.midnightthoughts.space-tls - # - name: https-matrix-draupnir-midnightthoughts - # protocol: HTTPS - # hostname: "matrix.draupnir.midnightthoughts.space" - # port: 443 - # allowedRoutes: - # namespaces: - # from: "All" - # tls: - # mode: Terminate - # certificateRefs: - # - kind: Secret - # name: matrix.draupnir.midnightthoughts.space-tls + - name: https-draupnir-midnightthoughts + protocol: HTTPS + hostname: "draupnir.midnightthoughts.space" + port: 443 + allowedRoutes: + namespaces: + from: "All" + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: draupnir.midnightthoughts.space-tls + - name: https-matrix-draupnir-midnightthoughts + protocol: HTTPS + hostname: "matrix.draupnir.midnightthoughts.space" + port: 443 + allowedRoutes: + namespaces: + from: "All" + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: matrix.draupnir.midnightthoughts.space-tls # - name: https-docuseal-midnightthoughts # protocol: HTTPS # hostname: "docuseal.midnightthoughts.space" diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml @@ -5,3 +5,4 @@ resources: - ./monitoring-stack - ./externaldns - ./authentik + - ./draupnir-synapse