commit 65d5118155e2d18dce16bdde77c1c0b420f71a47
parent ce888d475469e04636663873aa2cdc23a6fb75b4
Author: MTRNord <mtrnord1@gmail.com>
Date: Sun, 2 Apr 2023 14:36:48 +0200
Add media-repo
Diffstat:
10 files changed, 327 insertions(+), 0 deletions(-)
diff --git a/apps/base/matrix-helm/kustomization.yaml b/apps/base/matrix-helm/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: matrix
+resources:
+ - namespace.yaml
+ - repository.yaml
diff --git a/apps/base/matrix-helm/namespace.yaml b/apps/base/matrix-helm/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: matrix
diff --git a/apps/base/matrix-helm/repository.yaml b/apps/base/matrix-helm/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: ananace-charts
+ namespace: matrix
+spec:
+ interval: 5m
+ url: https://ananace.gitlab.io/charts
diff --git a/apps/base/media-repo/kustomization.yaml b/apps/base/media-repo/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: matrix
+resources:
+ - ../matrix-helm
+ - release.yaml
diff --git a/apps/base/media-repo/release.yaml b/apps/base/media-repo/release.yaml
@@ -0,0 +1,207 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: matrix-media-repo
+ namespace: matrix
+spec:
+ releaseName: matrix-media-repo
+ chart:
+ spec:
+ chart: matrix-media-repo
+ sourceRef:
+ kind: HelmRepository
+ name: ananace-charts
+ interval: 50m
+ install:
+ remediation:
+ retries: 3
+ values:
+ replicaCount: 1
+ image:
+ repository: coreharbor.kubernetes.midnightthoughts.space/turt2live/matrix-media-repo
+ tag: latest
+ pullPolicy: Always
+ config:
+ datastores:
+ - type: file
+ enabled: true
+ forKinds: ["all"]
+ opts:
+ path: /media
+ federation:
+ backoffAt: 20
+ timeouts:
+ urlPreviewTimeoutSeconds: 10
+ federationTimeoutSeconds: 120
+ clientServerTimeoutSeconds: 30
+ featureSupport:
+ MSC2448:
+ enabled: true
+ maxWidth: 1024
+ maxHeight: 1024
+ thumbWidth: 64
+ thumbHeight: 64
+ xComponents: 4
+ yComponents: 3
+ punch: 1
+ quarantine:
+ replaceThumbnails: true
+ replaceDownloads: false
+ thumbnailPath: ""
+ allowLocalAdmins: true
+ identicons:
+ enabled: true
+ thumbnails:
+ maxSourceBytes: 1048576000
+ numWorkers: 10
+ maxPixels: 1048576000
+ sizes:
+ - width: 32
+ height: 32
+ - width: 96
+ height: 96
+ - width: 320
+ height: 240
+ - width: 640
+ height: 480
+ - width: 768
+ height: 240
+ - width: 800
+ height: 600
+ - width: 1000000
+ height: 1000000
+ dynamicSizing: true
+ types:
+ - "image/jpeg"
+ - "image/jpg"
+ - "image/png"
+ - "image/gif"
+ - "image/heif"
+ - "image/webp"
+ - "image/svg+xml"
+ - "audio/mpeg"
+ - "audio/ogg"
+ - "audio/wav"
+ - "audio/flac"
+ - "video/mp4"
+ allowAnimated: true
+ defaultAnimated: true
+ maxAnimateSizeBytes: 10485760
+ stillFrame: 0.5
+ expireAfterDays: 0
+ urlPreviews:
+ enabled: true
+ maxPageSizeBytes: 10485760
+ previewUnsafeCertificates: false
+ numWords: 50
+ maxLength: 200
+ numTitleWords: 30
+ maxTitleLength: 150
+ filePreviewTypes:
+ - "image/*"
+ numWorkers: 10
+ disallowedNetworks:
+ - 127.0.0.1/8
+ - 10.0.0.0/8
+ - 172.16.0.0/12
+ - 192.168.0.0/16
+ - 100.64.0.0/10
+ - 169.254.0.0/16
+ - ::1/128
+ - fe80::/64
+ - fc00::/7
+ allowedNetworks:
+ - 0.0.0.0/0
+ - "::/0"
+ expireAfterDays: 10
+ defaultLanguage: en-US,en
+ oEmbed: true
+ downloads:
+ maxBytes: 104857600
+ numWorkers: 10
+ failureCacheMinutes: 5
+ cache:
+ enabled: true
+ maxSizeBytes: 1048576000
+ maxFileSizeBytes: 1048576000
+ trackedMinutes: 30
+ minDownloads: 2
+ minCacheTimeSeconds: 300
+ minEvictedTimeSeconds: 60
+ expireAfterDays: 14
+ uploads:
+ maxBytes: 1048576000
+ minBytes: 100
+ reportedMaxBytes: 0
+
+ postgresql:
+ sslMode: disable
+ volumePermissions:
+ enabled: true
+
+ primary:
+ persistence:
+ size: 16G
+ extendedConfiguration: |
+ # Connectivity
+ max_connections = 40
+ superuser_reserved_connections = 3
+ # Memory Settings
+ shared_buffers = '16384 MB'
+ work_mem = '64 MB'
+ maintenance_work_mem = '620 MB'
+ huge_pages = try # NB! requires also activation of huge pages via kernel params, see here for more: https://www.postgresql.org/docs/current/static/kernel-resources.html#LINUX-HUGE-PAGES
+ effective_cache_size = '45 GB'
+ effective_io_concurrency = 200 # concurrent IO only really activated if OS supports posix_fadvise function
+ random_page_cost = 1.25 # speed of random disk access relative to sequential access (1.0)
+ # Monitoring
+ shared_preload_libraries = 'pg_stat_statements' # per statement resource usage stats
+ track_io_timing=on # measure exact block IO times
+ track_functions=pl # track execution times of pl-language procedures if any
+ # Replication
+ wal_level = replica # consider using at least 'replica'
+ max_wal_senders = 0
+ synchronous_commit = off
+ # Checkpointing:
+ checkpoint_timeout = '15 min'
+ checkpoint_completion_target = 0.9
+ max_wal_size = '1024 MB'
+ min_wal_size = '512 MB'
+ # WAL writing
+ wal_compression = on
+ wal_buffers = -1 # auto-tuned by Postgres till maximum of segment size (16MB by default)
+ # Background writer
+ bgwriter_delay = 200ms
+ bgwriter_lru_maxpages = 100
+ bgwriter_lru_multiplier = 2.0
+ bgwriter_flush_after = 0
+ # Parallel queries:
+ max_worker_processes = 6
+ max_parallel_workers_per_gather = 3
+ max_parallel_maintenance_workers = 3
+ max_parallel_workers = 6
+ parallel_leader_participation = on
+ # Advanced features
+ enable_partitionwise_join = on
+ enable_partitionwise_aggregate = on
+ jit = on
+ max_slot_wal_keep_size = '1000 MB'
+ track_wal_io_timing = on
+ maintenance_io_concurrency = 200
+ wal_recycle = on
+ extraRepo:
+ useForwardedHost: false
+
+ redis:
+ architecture: replication
+ auth:
+ enabled: false
+ commonConfiguration: |-
+ # Enable AOF https://redis.io/topics/persistence#append-only-file
+ appendonly yes
+ # Disable RDB persistence, AOF persistence already enabled.
+ save ""
+ # Set maxmemory
+ maxmemory 1gb
+ # Make sure we clear stuff properly
+ maxmemory-policy allkeys-lfu
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -7,9 +7,11 @@ resources:
- ../base/kube-prometheus-stack
- ../base/rook
- ../base/postgres-operator
+ - ../base/media-repo
patchesStrategicMerge:
- cosign-values.yaml
- vaultwarden-values.yaml
- woodpecker-values.yaml
- kube-prometheus-stack-values.yaml
- postgres-operator-values.yaml
+ - media-repo-values.yaml
diff --git a/apps/production/media-repo-values.yaml b/apps/production/media-repo-values.yaml
@@ -0,0 +1,62 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: matrix-media-repo
+ namespace: matrix
+spec:
+ chart:
+ spec:
+ version: "2.0.x"
+ values:
+ config:
+ admins:
+ - "@lexi:midnightthoughts.space"
+ ## Per-domain configuration.
+ ## Ref: https://github.com/turt2live/matrix-media-repo/blob/master/docs/config.md
+ ##
+ homeservers:
+ midnightthoughts.space:
+ csApi: "https://matrix.midnightthoughts.space"
+ backoffAt: 10
+ adminApiKind: "synapse"
+ identicons:
+ enabled: true
+ art.midnightthoughts.space:
+ csApi: "https://matrix.art.midnightthoughts.space"
+ backoffAt: 10
+ adminApiKind: "synapse"
+ identicons:
+ enabled: true
+ ## Ingress configuration.
+ ##
+ ingress:
+ enabled: false
+ className: traefik
+ annotations:
+ # traefik.ingress.kubernetes.io/router.tls: "true"
+ # traefik.ingress.kubernetes.io/router.middlewares: default-hsts@kubernetescrd,default-redirect-https@kubernetescrd
+ traefik.ingress.kubernetes.io/router.middlewares: redirect-media@kubernetescrd
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ hosts:
+ - host: matrix.midnightthoughts.space
+ paths:
+ - "/_matrix/media"
+ tls:
+ - secretName: midnightthoughts-tls-secret
+ hosts:
+ - matrix.midnightthoughts.space
+ - midnightthoughts.space
+ postgresql:
+ enabled: true
+ auth:
+ existingSecret: matrix-media-repo-postgresql
+ username: matrix_media_repo
+ database: matrix_media_repo
+ primary:
+ persistence:
+ existingClaim: local-data-matrix-media-repo-postgresql-1
+
+ persistence:
+ existingClaim: local-matrix-media-repo
+ redis:
+ enabled: true
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
- woodpecker-secret.yaml
- alertmanager-secret.yaml
- grafana-secret.yaml
+ - matrix-media-repo-postgresql-secret.yaml
diff --git a/apps/production/secrets/matrix-media-repo-postgresql-secret.yaml b/apps/production/secrets/matrix-media-repo-postgresql-secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: matrix-media-repo-postgresql
+ namespace: matrix
+type: Opaque
+stringData:
+ password: ENC[AES256_GCM,data:1Ms+bNNrEvvgrTHLK1Q0+5DSSe1dFmTss0qnX6dWhX3EV33TVXzOLR/epHQHpg7sPwqWNWMGBmghO0+/jKgGSw==,iv:HEz247gMt7L36+Q+B8aOGqzsNwbnvDoVPNmUQWLvkQU=,tag:RGYe5xfjHzxlZbhTpb/Xsw==,type:str]
+ postgres-password: ENC[AES256_GCM,data:I8ivYe6z667Q8BFfhLWy722mDGcSem6aOxx9wf2MJltbE2dqQyJExDYol1nDewcch2WD5+hCjKbPn+TJGa7u/w==,iv:XW1zfPgtgGmTgV0XnQJtorgAvXg3HBinb28cQQAjCM0=,tag:ojy9CSxb/LxqDI5/41otUA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcnBvaTgvc1J5RGJ3em1l
+ MlhiS2xWdGhnS28zYWd6MnhjcUl4V1VtOFc4Cmgyb3c0Q09kaHpNNmRUR08zT3Vp
+ dDhCdmpUaUpuTkFtV2JrWVBnSFl4MzAKLS0tIFV1M3VFc1JaS2VwOFBRVjM2VXZC
+ Wk1SYW5HVFBnNEVnY25MRlFCQ05kdE0KijTDcdbdmlh0l0l9FeOZylnsJpRqSY1L
+ MLG8H+Bbi/dx5hcUppCPrnUZ9h5YqEY49bcbb0lk6Lxj5Icw6PupxA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-02T12:36:27Z"
+ mac: ENC[AES256_GCM,data:qCc7FLMWxXhfLeaTY7zjCjNp+5pDL8tkuvzkA2TgcfMg3lxE7kdCAIWpIYX69o2jn+T15exnQlo+pFM/p+/9anckChYo6o+m3glceCw+X0Jbdivzilt2oF03BpA0A5BOcxKtlDQeSpRXrMdGkWDrmFo1h0KcEwMuQuuVAEB1xp0=,iv:I0wKP3t0dyTJaMT2ntXWiu8h2FC06OSSsvEs8ob1m9s=,tag:m55E+cPR40XJ/u6jQ2Deig==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData)$
+ version: 3.7.3
diff --git a/infrastructure/configs/postgres-clusters.yaml b/infrastructure/configs/postgres-clusters.yaml
@@ -15,6 +15,7 @@ spec:
allowedSourceRanges: []
databases:
synapse: synapse
+ matrix_media_repo: matrix_media_repo
enableConnectionPooler: false
enableReplicaConnectionPooler: false
numberOfInstances: 2
@@ -32,6 +33,7 @@ spec:
teamId: matrix
users:
synapse: []
+ matrix_media_repo: []
volume:
iops: 3000
size: 10Gi
