cluster

commit 6f3f48d9108e24cf5b09fc76ca1084e025bc45a7
parent 4326a0238183ddf21bbdb385465c1df2a1ac21aa
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed, 12 Feb 2025 13:51:52 +0100

Improve the synapse security

Diffstat:
M
apps/base/matrix/synapse/release.yaml
 | 
68
++++++++++++++++++++++++++++++++++++++------------------------------

1 file changed, 38 insertions(+), 30 deletions(-)
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -97,11 +97,11 @@ spec:
             modules:
                 - module: matrix_invitee_server_blocker.InviteeServerBlocker
                   config:
-                      broken_servers:
-                          #- matrix.org
-                          - matrix.im
-                          - funami.tech
-                          - suicideserver.net
+                    broken_servers:
+                        #- matrix.org
+                        - matrix.im
+                        - funami.tech
+                        - suicideserver.net
         persistence:
             enabled: true
             size: 20Gi
@@ -118,7 +118,7 @@ spec:
                     capabilities:
                         drop:
                             - ALL
-                    readOnlyRootFilesystem: false
+                    readOnlyRootFilesystem: true
                     runAsNonRoot: true
                     runAsUser: 666
                 resources:
@@ -129,9 +129,13 @@ spec:
                 volumes:
                     - name: matrix-org-blocker
                       emptyDir: {}
+                    - name: pip-cache
+                      emptyDir: {}
                 volumeMounts:
                     - name: matrix-org-blocker
                       mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
+                    - name: pip-cache
+                      mountPath: /.cache/pip
                 extraCommands:
                     - ENC[AES256_GCM,data:XfRCK/sZLuScFZq7LjzlxqN306u2GKp93nt2RyZ83YBc0Mi3aK3U3zjHRJMQI7/Dj5SthCSCzie64br8Xxn2TOKWoxt4NaxPH0rMGugNJhclCwrP7zbImcYqvcfodEzQX3FlOxo2DstvuQ723Y6FJyJSqIeiGEZSFJE0cjkMXXkcIMgTVYtwNOj70K1Ntp0xJ7qyjry23Tr933KyKA==,iv:f+rPAI+6mQiIwRpb4U8f79rPnWmJeYEMWewCgNmba14=,tag:LVEBca2gHZfL4opZfmZ9qQ==,type:str]
                 extraConfig:
@@ -149,11 +153,11 @@ spec:
                     modules:
                         - module: matrix_invitee_server_blocker.InviteeServerBlocker
                           config:
-                              broken_servers:
-                                  #- matrix.org
-                                  - matrix.im
-                                  - funami.tech
-                                  - suicideserver.net
+                            broken_servers:
+                                #- matrix.org
+                                - matrix.im
+                                - funami.tech
+                                - suicideserver.net
             federation_reader:
                 resources:
                     requests:
@@ -302,7 +306,7 @@ spec:
                 capabilities:
                     drop:
                         - ALL
-                readOnlyRootFilesystem: false
+                readOnlyRootFilesystem: true
                 runAsNonRoot: true
                 runAsUser: 666
             resources:
@@ -326,12 +330,16 @@ spec:
                 httpGet:
                     path: /health
                     port: http
-            extraVolumes:
+            volumes:
                 - name: matrix-org-blocker
                   emptyDir: {}
-            extraVolumeMounts:
+                - name: pip-cache
+                  emptyDir: {}
+            volumeMounts:
                 - name: matrix-org-blocker
                   mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker
+                - name: pip-cache
+                  mountPath: /.cache/pip
             extraCommands:
                 - ENC[AES256_GCM,data:5ZAWuJzqERnMIJvCPZoCDdpKCm8+vCpgGBTQFEQHw7UcvMBn3odAoHCohUorP0iDiiGV0cVDKVYKPGVSaoLxo0wremFW8ndqSElh90peVhjTUIwvObN/ZMJN61tGUw7mdO80vjgS9D7Y15Kp2FEEkZdRkC1/dmUIr2XBn/AosgHUb6/j6q06r9qAmP6+DQWcwx+uNTR4Hol75WX1Gw==,iv:JYFsq0tGDyMEjNSxq0hAE5jLhAGaD2Yr3PuC5x/Q7DU=,tag:yQqbMkPR30ql/vXELSHWyQ==,type:str]
             annotations:
@@ -371,16 +379,16 @@ spec:
                 - matrix.midnightthoughts.space
             csPaths:
                 - backendRefs:
-                      - kind: Service
-                        name: mas
-                        port: 8080
+                    - kind: Service
+                      name: mas
+                      port: 8080
                   matches:
-                      - path:
-                            type: RegularExpression
-                            value: /_matrix/client/.*/(login|logout|refresh).*
-                      - path:
-                            type: RegularExpression
-                            value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
+                    - path:
+                        type: RegularExpression
+                        value: /_matrix/client/.*/(login|logout|refresh).*
+                    - path:
+                        type: RegularExpression
+                        value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
         ingress:
             enabled: false
 sops:
@@ -391,13 +399,13 @@ sops:
     age:
         - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
           enc: |
-              -----BEGIN AGE ENCRYPTED FILE-----
-              YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNnU2QzQxaDRUSzZweitZ
-              cGRqZ2tVbzcyaDgxK25YR3VBd05vdjErTzBzCnhoUUtLQjJNUFcvS3gwZWFHQTRX
-              SlRYbktmZHB3NUZVTGkraVpGbDFuRGsKLS0tIEhzUVp0eGFpS0x3b0Iwa0wyblha
-              aVpTQ3NvSmNTaUlkRGRBZyt3NTFIOVUKfMOuzBi39ih3KEp1e8AYxMyBFs/lfoAT
-              tBfnztH7yg4wKeey33TVfutV9fOOBsh8jH3qxPHbByqRZJUFJPWkQw==
-              -----END AGE ENCRYPTED FILE-----
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNnU2QzQxaDRUSzZweitZ
+            cGRqZ2tVbzcyaDgxK25YR3VBd05vdjErTzBzCnhoUUtLQjJNUFcvS3gwZWFHQTRX
+            SlRYbktmZHB3NUZVTGkraVpGbDFuRGsKLS0tIEhzUVp0eGFpS0x3b0Iwa0wyblha
+            aVpTQ3NvSmNTaUlkRGRBZyt3NTFIOVUKfMOuzBi39ih3KEp1e8AYxMyBFs/lfoAT
+            tBfnztH7yg4wKeey33TVfutV9fOOBsh8jH3qxPHbByqRZJUFJPWkQw==
+            -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-01-18T14:02:39Z"
     mac: ENC[AES256_GCM,data:cqQ7aC03mgh+oBcOYywJo+gqAY+SybgqRmgbCgbZ1mDs0boNfLEAVV4PjuaEutA5Wcq2046rE4gedcUDqxZJpznJquQ0Pcf1oH2pQ/qWSIiOKPf7deeWF5QjClKsg6s+LObdpHpg2QTuOzzwm45guvf40kqlwQQCSi5WVTRlu5g=,iv:lnT8jDGhm1UfrwHp11s5y1W5zkNEoddRn+j/xSq38Io=,tag:K7NfHNUev8C2KjY81QOE4g==,type:str]
     pgp: []