cluster

commit 657b672f5ab0b93adb5741c21b36b0fa040c8abf
parent 93f1bb3ff99d89c40bff294cd177cf2b2a36d581
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue, 15 Apr 2025 12:30:44 +0200

Setup a matrix rspamd

Diffstat:
M
apps/base/envoy-gateway/release.yaml
 | 
12
++++++++++++
M
apps/base/matrix/synapse/kustomization.yaml
 | 
9
+++++++++
A
apps/base/matrix/synapse/rspamd-config/local.d/classifier-bayes.conf
 | 
1
+
A
apps/base/matrix/synapse/rspamd-config/local.d/greylist.conf
 | 
1
+
A
apps/base/matrix/synapse/rspamd-config/local.d/options.inc
 | 
3
+++
A
apps/base/matrix/synapse/rspamd-config/local.d/worker-controller.inc
 | 
1
+
A
apps/base/matrix/synapse/rspamd.yaml
 | 
102
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

7 files changed, 129 insertions(+), 0 deletions(-)
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -466,6 +466,18 @@ spec:
             certificateRefs:
                 - kind: Secret
                   name: irc.midnightthoughts.space
+        - name: https-midnightthoughts-rspamd-matrix
+          protocol: HTTPS
+          hostname: "rspamd.matrix.midnightthoughts.space"
+          port: 443
+          allowedRoutes:
+            namespaces:
+                from: "All"
+          tls:
+            mode: Terminate
+            certificateRefs:
+                - kind: Secret
+                  name: rspamd.matrix.midnightthoughts.space
         - name: https-nordgedanken-root
           protocol: HTTPS
           hostname: "nordgedanken.dev"
diff --git a/apps/base/matrix/synapse/kustomization.yaml b/apps/base/matrix/synapse/kustomization.yaml
@@ -3,5 +3,14 @@ kind: Kustomization
 namespace: matrix
 resources:
     - keydb.yaml
+    - rspamd.yaml
     - release.yaml
     - podmonitor.yaml
+configMapGenerator:
+    - name: rspamd-config
+      namespace: matrix
+      files:
+          - greylist.conf=rspamd-config/local.d/greylist.conf
+          - classifier-bayes.conf=rspamd-config/local.d/classifier-bayes.conf
+          - options.inc=rspamd-config/local.d/options.inc
+          - worker-controller.inc=rspamd-config/local.d/worker-controller.inc
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/classifier-bayes.conf b/apps/base/matrix/synapse/rspamd-config/local.d/classifier-bayes.conf
@@ -0,0 +1 @@
+  servers = "matrix-synapse-keydb.matrix.svc.cluster.local";
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/greylist.conf b/apps/base/matrix/synapse/rspamd-config/local.d/greylist.conf
@@ -0,0 +1 @@
+  servers = "matrix-synapse-keydb.matrix.svc.cluster.local";
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/options.inc b/apps/base/matrix/synapse/rspamd-config/local.d/options.inc
@@ -0,0 +1,3 @@
+  dns {
+    nameserver = "8.8.8.8:53";
+  }
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/worker-controller.inc b/apps/base/matrix/synapse/rspamd-config/local.d/worker-controller.inc
@@ -0,0 +1 @@
+enable_password = "$2$ea1s7s5n5amkgb8zukzq656xyut53148$5qwo5k48fa1rzgkgr8cukdk9p4x3wip9oer48um6p8p6eerprcyb";
diff --git a/apps/base/matrix/synapse/rspamd.yaml b/apps/base/matrix/synapse/rspamd.yaml
@@ -0,0 +1,102 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+    name: rspamd-matrix
+    namespace: matrix
+spec:
+    resources:
+        requests:
+            storage: 1Gi
+    storageClassName: ceph-filesystem
+    volumeMode: Filesystem
+    accessModes:
+        - ReadWriteMany
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: rspamd-matrix
+    namespace: matrix
+spec:
+    selector:
+        matchLabels:
+            app: rspamd-matrix
+    template:
+        metadata:
+            labels:
+                app: rspamd-matrix
+        spec:
+            securityContext:
+                fsUser: 11333
+                fsGroup: 11333
+                runAsUser: 11333
+            containers:
+                - name: rspamd-matrix
+                  image: ghcr.io/rspamd/rspamd-docker:latest
+                  resources:
+                      limits:
+                          memory: "128Mi"
+                          cpu: "500m"
+                  ports:
+                      - containerPort: 11333
+                        name: rspamd-normal-worker
+                      - containerPort: 11334
+                        name: rspamd-control-worker
+                  volumeMounts:
+                      - name: rspamd-matrix
+                        mountPath: /var/lib/rspamd
+                      - name: greylist
+                        mountPath: /etc/rspamd/local.d/greylist.conf
+                        subPath: greylist.conf
+                      - name: classifier-bayes
+                        mountPath: /etc/rspamd/local.d/classifier-bayes.conf
+                        subPath: classifier-bayes.conf
+                      - name: options
+                        mountPath: /etc/rspamd/local.d/options.inc
+                        subPath: options.inc
+                      - name: worker-controller
+                        mountPath: /etc/rspamd/local.d/worker-controller.inc
+                        subPath: worker-controller.inc
+            volumes:
+                - name: rspamd-matrix
+                  persistentVolumeClaim:
+                      claimName: rspamd-matrix
+                - name: rspamd-config
+                  configMap:
+                      name: rspamd-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+    name: rspamd-matrix
+    namespace: matrix
+spec:
+    selector:
+        app: rspamd-matrix
+    ports:
+        - port: 11333
+          targetPort: 11333
+          name: rspamd-normal-worker
+        - port: 11334
+          targetPort: 11334
+          name: rspamd-control-worker
+    type: ClusterIP
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+    name: rspamd-matrix
+    namespace: matrix
+spec:
+    parentRefs:
+        - name: envoy-gateway
+          namespace: envoy-gateway
+    hostnames:
+        - rspamd.matrix.midnightthoughts.space
+    rules:
+        - backendRefs:
+              - name: rspamd-matrix
+                port: 11334
+          timeouts:
+              request: 240s
+              backendRequest: 0s