commit 8c0a814006f1fd6d4de2840f186b5bb8c8a28d7b parent 2a5c1b9fd1027ae17c0e309c60b6e6abc3bf44e4 Author: MTRNord <mtrnord1@gmail.com> Date: Thu, 22 Aug 2024 12:23:31 +0200 Cleanup Diffstat:
13 files changed, 0 insertions(+), 528 deletions(-)
diff --git a/apps/base/matrix/element-call-synapse/kustomization.yaml b/apps/base/matrix/element-call-synapse/kustomization.yaml @@ -1,7 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: element-call -resources: - - repository.yaml - - release.yaml - - podmonitor.yaml diff --git a/apps/base/matrix/element-call-synapse/podmonitor.yaml b/apps/base/matrix/element-call-synapse/podmonitor.yaml @@ -1,24 +0,0 @@ ---- -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: element-call-synapse - labels: - instance: element-call -spec: - jobLabel: "app.kubernetes.io/component" - namespaceSelector: - matchNames: - - "matrix" - selector: - matchLabels: - app.kubernetes.io/instance: element-call-synapse - app.kubernetes.io/name: matrix-synapse - podMetricsEndpoints: - - port: metrics - path: "/_synapse/metrics" - interval: 5s - relabelings: - - sourceLabels: - - "__meta_kubernetes_pod_label_app_kubernetes_io_instance" - targetLabel: instance diff --git a/apps/base/matrix/element-call-synapse/release.yaml b/apps/base/matrix/element-call-synapse/release.yaml @@ -1,185 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: element-call-synapse - namespace: element-call -spec: - chart: - spec: - chart: matrix-synapse - sourceRef: - kind: HelmRepository - name: ananace-charts - interval: 50m - install: - remediation: - retries: 3 - values: - extraConfig: - stream_writers: - events: event_persister - run_background_tasks_on: background_worker - presence: - enabled: false - #federation_sender_instances: - # - federation-sender-1 - # - federation-sender-2 - event_cache_size: 10K - caches: - global_factor: 10 - expire_caches: true - cache_entry_ttl: 240m - cache_autotuning: - max_cache_memory_usage: 2048M - target_cache_memory_usage: 1024M - min_cache_ttl: 5m - wellknown: - enabled: true - extraData: - support: - admins: - - email_address: "support@nordgedanken.dev" - role: "admin" - image: - pullSecrets: - - name: ghcr-pull - persistence: - size: 10Gi - accessMode: ReadWriteMany - volumePermissions: - enabled: true - workers: - default: - tolerations: - - key: "arch" - operator: "Equal" - value: "arm64" - effect: "NoSchedule" - extraConfig: - event_cache_size: 30K - caches: - global_factor: 10 - expire_caches: true - cache_entry_ttl: 1080m - sync_response_cache_duration: 2m - cache_autotuning: - max_cache_memory_usage: 4069M - target_cache_memory_usage: 2048M - min_cache_ttl: 5m - generic_frontend: - replicaCount: 2 - enabled: true - generic: true - listeners: [client] - csPaths: - # Client API requests - - "/_matrix/client/(api/v1|r0|v3|unstable)/createRoom$" - - "/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$" - - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$" - - "/_matrix/client/(r0|v3|unstable)/account/whoami$" - - "/_matrix/client/(r0|v3|unstable)/devices$" - - "/_matrix/client/versions$" - - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/" - - "/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$" - - # Encryption requests - - "/_matrix/client/(r0|v3|unstable)/keys/query$" - - "/_matrix/client/(r0|v3|unstable)/keys/changes$" - - "/_matrix/client/(r0|v3|unstable)/keys/claim$" - - "/_matrix/client/(r0|v3|unstable)/room_keys/" - - "/_matrix/client/(r0|v3|unstable)/keys/upload/" - - # Registration/login requests - - "/_matrix/client/(r0|v3|unstable)/register$" - - "/_matrix/client/(r0|v3|unstable)/register/available$" - - # Event sending requests - - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact" - - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send" - - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/" - - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$" - - "/_matrix/client/(api/v1|r0|v3|unstable)/join/" - - "/_matrix/client/(api/v1|r0|v3|unstable)/profile/" - federation_reader: - replicaCount: 2 - enabled: false - generic: true - listeners: [federation] - paths: - - "/_matrix/federation/v1/send/" - appservice: - enabled: false - name: appservices - generic: true - federation_sender_1: - labels: - synapse-component: federation-sender - app: federation_sender - name: federation-sender-1 - enabled: false - federation_sender_2: - labels: - synapse-component: federation-sender - app: federation_sender - name: federation-sender-2 - enabled: false - background_worker: - name: background_worker - replicaCount: 1 - enabled: true - generic: true - event_persister: - name: event_persister - replicaCount: 1 - enabled: true - generic: true - listeners: [replication] - synapse: - tolerations: - - key: "arch" - operator: "Equal" - value: "arm64" - effect: "NoSchedule" - ## Liveness probe configuration to use - ## - livenessProbe: - timeoutSeconds: 60 - failureThreshold: 5 - httpGet: - path: /health - port: http - - ## Readiness probe configuration to use - ## - readinessProbe: - timeoutSeconds: 60 - failureThreshold: 5 - httpGet: - path: /health - port: http - - extraCommands: [] - annotations: - prometheus.io/scrape: "true" - prometheus.io/path: "/_synapse/metrics" - prometheus.io/port: "9090" - - redis: - architecture: standalone - # master: - # tolerations: - # - key: "arch" - # operator: "Equal" - # value: "arm64" - # effect: "NoSchedule" - postgresql: - enabled: false - externalPostgresql: - #host: postgres.internal.midnightthoughts.space - host: matrix-postgres-cluster.matrix-postgres-cluster.svc.cluster.local - port: 5432 - - ## Password key to be retrieved from existing secret - existingSecretPasswordKey: password - sslmode: require diff --git a/apps/base/matrix/element-call-synapse/repository.yaml b/apps/base/matrix/element-call-synapse/repository.yaml @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: ananace-charts - namespace: element-call -spec: - interval: 5m - url: https://ananace.gitlab.io/charts diff --git a/apps/base/matrix/element-call/ingress_livekit.yaml b/apps/base/matrix/element-call/ingress_livekit.yaml @@ -1,36 +0,0 @@ ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: wss-header - namespace: element-call -spec: - headers: - customRequestHeaders: - Connection: keep-alive, Upgrade - Upgrade: WebSocket ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - annotations: - cert-manager.io/cluster-issuer: letsencrypt-http - traefik.ingress.kubernetes.io/router.middlewares: element-call-wss-header@kubernetescrd - name: element-call-livekit - namespace: element-call -spec: - rules: - - host: call-livekit.midnightthoughts.space - http: - paths: - - backend: - service: - name: element-call-livekit-server - port: - number: 80 - path: / - pathType: ImplementationSpecific - tls: - - hosts: - - call-livekit.midnightthoughts.space - secretName: call-livekit.midnightthoughts.space-tls diff --git a/apps/base/matrix/element-call/kustomization.yaml b/apps/base/matrix/element-call/kustomization.yaml @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: element-call -resources: - - repository.yaml - - release.yaml - - ingress_livekit.yaml - - s3_ingress.yaml - - s3_certs.yaml diff --git a/apps/base/matrix/element-call/release.yaml b/apps/base/matrix/element-call/release.yaml @@ -1,108 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta2 -kind: HelmRelease -metadata: - name: element-call - namespace: element-call -spec: - interval: 5m - chart: - spec: - version: 0.1.14 - chart: element-call - sourceRef: - kind: HelmRepository - name: element-call - interval: 60m - install: - crds: Create - timeout: 25m - upgrade: - timeout: 25m - crds: CreateReplace - # Force recreation due to Helm not properly patching Deployment with e.g. added port, - # causing spurious drift detection - force: true - values: - livekit_key: ENC[AES256_GCM,data:fglX2DfmpXedsW27/2YA9enDf09r9nzNpF2LKcK8PhhGgSPfb4wtK0S+uDgy2dGX7w+8EvXdVbL1cXhF4KONiA==,iv:/uyme29YIO3kpSqna5WAva/vUamRmk/SOB8GnunCyFw=,tag:FD0ejGd4zrJmxm7V8Ta6Pg==,type:str] - livekit_secret: ENC[AES256_GCM,data:YxGjXPk0SmyYerr1wg0GD7xoGncH0bCTv0GovzdnYx70mITOqKsDZHEULbDydIO3UaryVDi2lE4YX4THeX7agA==,iv:GAncts/+LGpU+quFxItn6D5B6QR/ObhEpUZbKDMg9/g=,tag:gLX1RWDOWYmdUNX4doxpHA==,type:str] - livekit_ws: wss://call-livekit.midnightthoughts.space - livekit_mgmt: - ingress: - enabled: true - annotations: - cert-manager.io/cluster-issuer: letsencrypt-http - hosts: - - host: call-jwt.midnightthoughts.space - paths: - - path: / - pathType: ImplementationSpecific - tls: - - secretName: call-jwt.midnightthoughts.space-tls - hosts: - - call-jwt.midnightthoughts.space - element_call: - replicaCount: 1 - config: - eula: https://example.com - homeserver: - base_url: https://matrix-call.midnightthoughts.space - server_name: matrix-call.midnightthoughts.space - livekit: - livekit_service_url: https://call-jwt.midnightthoughts.space - ingress: - enabled: true - annotations: - cert-manager.io/cluster-issuer: letsencrypt-http - hosts: - - host: call.midnightthoughts.space - paths: - - path: / - pathType: ImplementationSpecific - tls: - - secretName: call.midnightthoughts.space-tls - hosts: - - call.midnightthoughts.space - livekit-server: - podHostNetwork: false - livekit: - keys: - bQXMwwlTCTbxDd6xRHYaaK5gzOzyb1gzS5E89vrJ96ONp3kEH4Ljh9su5L3BQc33: ENC[AES256_GCM,data:kvlVmkY/M/cIjFJslzxJK3SI8/iuXyMHEN3lziTyU6e0o+ueNt1oJvYgOslDyqg77YVFTSfGQJZepSt2ldwaEQ==,iv:kaJET9e1A6RulFaJwHAU22GLdGxJmj8goswuViBWuH4=,tag:OKTqpA1tZxWHO3Ynz2Ou7w==,type:str] - iHMQVcTZSmUek9m55nFcvpGWaAR1nGpQggvEmvKyWqWbu099EjSZ2sQkU1ZMpR1h: ENC[AES256_GCM,data:En41ewiUltFAKDubaVNjGFJ+Kb2uDwhgklMIbUrWrh4GS5SA7GNaIwsrm/KLGSRAyri7U+r2EWsy9XEQRaHWHg==,iv:18lvUvXYDFGTb7zt+QGQPnrwIpgUyXkH6IjByAMoq4E=,tag:/pCQ7/QD9FO0/yh8hKkgfQ==,type:str] - redis: - address: element-call-redis-master:6379 - db: 0 - password: ENC[AES256_GCM,data:jr1xgd18hAaFi8KjhpRR1SbzqL5NjdifnO1LMbVjzgSIQ5EFWThiwPUk+Oe5dCQ2PVD+mwM5GsJruJCLLMIDzA==,iv:xY6wExgj/IpYWbWQSaNKBQjw3NgKgiGHaawj7jF6ajU=,tag:/bqQQLTwz94mzKD1hUdb7w==,type:str] - redis: - auth: - password: ENC[AES256_GCM,data:apw3XudxGeiSRqVyMxpZsV34WP3CNtiarcgzE5dp8f7TWNf6QpxHFlimwbv3KeYzLzLS9GeW21pppDFPyeSbTA==,iv:qF5bvFZD4wZUudRd5ucXzeE4lX9Q9xrmGLg/LyoFE5w=,tag:yRnZlM4YDNyBs7xTTT7xZg==,type:str] - egress: - egress: - backup_storage: /tmp - api_key: ENC[AES256_GCM,data:Npnx9guq8UNmY2K29eajog+juq8uUnsfF+rB7OxA2iJE46EGWKZdSU976ygVRZ4qpXEsczjc4JWp0pw259ZGKw==,iv:uYGX0tkIg7fkiJ4GCDViWbFJOaoulnhe2NB34g4MoRM=,tag:t4icI6W0BB1MPGIJuF+OsA==,type:str] - api_secret: ENC[AES256_GCM,data:nTHsxTJ4J/wjSEJyw7w/sVgqbKfHyOLoWN3WbcgTk8ZwgPrYuJHAaxccL7AIxf5NGzvJC1T+QlAgxVCL+Ii7ew==,iv:+h4RBDI07RTWJhrMXzv0rR/o9/jkCJCpT0MzghWSTvg=,tag:FMEm2ZZivoOx6dPBR+GGSA==,type:str] - ws_url: wss://call-livekit.midnightthoughts.space - insecure: true - redis: - address: element-call-redis-master:6379 - password: ENC[AES256_GCM,data:CS6oemsT2Pn7Oe6mog/jqlyIsC+0OgKbHchteUiaWVCYq5hspqR6YGenXf+c67H/XtMtwBSVcL7S1oQw9ZYMIA==,iv:hF1n148GtwH+bWfdMIFOzqKCv+r25MwrP2uhWzw6xFs=,tag:CXqC5lbs/PIlIK97T6HGNg==,type:str] - db: 0 -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5T3FhdEdLQ0lsUTRJSnUz - TzZOZHBoOHlzVGc4K21tbWxjYUNweGJQTW1JCkZxYU5ubnZJNGJBNURUN3BXRU9U - SzBwWXQyWVkyQitpVUVaZzNGM1VPdjAKLS0tIHRQQWxackJzVGczMitGL2RSS25y - ang5RlI2RXF0SFB6d2h3emNJOVlCTHMKZYZfLfO9Jbs5WqhNjNGekvhGYlvSoLFp - dfvpk33aHJMqJYmkWdXsPBcflpLuxR49Q5UnSPSWKtRkJ6fn73gPLg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-03-06T14:39:53Z" - mac: ENC[AES256_GCM,data:XQSu6tfNYJLENJqMD+WhrWMMN/8WvENkn9e6jELiQlRNdkA9NAMLDyyCRR7X9CxJA7iroYNBOHv7inmQ5TMzk03K1g8pzi+IWW+qhZlK2QqOsNS6R/8TpW0DrUsE8ongWUkm3O32HMAuT5B70moLVCXyMrPdEaDpL8YwYkjmyJ8=,iv:pL5UCdQ+6d3yZUbk+MfnqauvuwH1SH1RYLb+azdNaHs=,tag:Sh3OMmH2ZDGi1V9Rx1bL4w==,type:str] - pgp: [] - encrypted_regex: ^(api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$ - version: 3.8.1 diff --git a/apps/base/matrix/element-call/repository.yaml b/apps/base/matrix/element-call/repository.yaml @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: element-call - namespace: element-call -spec: - interval: 5m - url: https://mtrnord.github.io/element-call-helm diff --git a/apps/base/matrix/element-call/s3_certs.yaml b/apps/base/matrix/element-call/s3_certs.yaml @@ -1,28 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: console.call-s3.midnightthoughts.space - namespace: element-call -spec: - commonName: console.call-s3.midnightthoughts.space - secretName: console.call-s3.midnightthoughts.space-tls - dnsNames: - - console.call-s3.midnightthoughts.space - issuerRef: - name: letsencrypt-http - kind: ClusterIssuer ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: call-s3.midnightthoughts.space - namespace: element-call -spec: - commonName: call-s3.midnightthoughts.space - secretName: call-s3.midnightthoughts.space-tls - dnsNames: - - call-s3.midnightthoughts.space - issuerRef: - name: letsencrypt-http - kind: ClusterIssuer diff --git a/apps/base/matrix/element-call/s3_ingress.yaml b/apps/base/matrix/element-call/s3_ingress.yaml @@ -1,32 +0,0 @@ ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRouteTCP -metadata: - name: element-call-tenant-console - namespace: element-call -spec: - entryPoints: - - websecure - routes: - - match: HostSNI(`console.call-s3.midnightthoughts.space`) - services: - - name: element-call-console - port: 9443 - tls: - passthrough: true ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRouteTCP -metadata: - name: element-call-tenant-s3 - namespace: element-call -spec: - entryPoints: - - websecure - routes: - - match: HostSNI(`call-s3.midnightthoughts.space`) - services: - - name: minio - port: 443 - tls: - passthrough: true diff --git a/apps/base/matrix/kustomization.yaml b/apps/base/matrix/kustomization.yaml @@ -3,6 +3,3 @@ kind: Kustomization namespace: matrix resources: - ./matrix-helm - #- ./media-repo - - ./sliding-proxy - #- ./synapse diff --git a/apps/base/matrix/sliding-proxy/deployment.yaml b/apps/base/matrix/sliding-proxy/deployment.yaml @@ -1,74 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: sliding-proxy-midnightthoughts - namespace: matrix - annotations: - checkov.io/skip1: CKV_K8S_35=False positive. - checkov.io/skip2: CKV_K8S_40=Too late too change. - checkov.io/skip3: CKV_K8S_23=Too late too change. -spec: - replicas: 1 - selector: - matchLabels: - app: sliding-proxy-midnightthoughts - template: - metadata: - labels: - app: sliding-proxy-midnightthoughts - container.kubeaudit.io/sliding-proxy-midnightthoughts-container.allow-run-as-root: "" - spec: - securityContext: - seccompProfile: - type: RuntimeDefault - automountServiceAccountToken: false - containers: - - image: ghcr.io/matrix-org/sliding-sync:v0.99.10 # {"$imagepolicy": "matrix:sliding-proxy"} - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /client/server.json - port: 8888 - initialDelaySeconds: 60 - periodSeconds: 30 - name: sliding-proxy-midnightthoughts-container - envFrom: - - secretRef: - name: sliding-proxy-env - env: - - name: SYNCV3_BINDADDR - value: "0.0.0.0:8888" - ports: - - containerPort: 8888 - name: http - readinessProbe: - httpGet: - path: /client/server.json - port: 8888 - initialDelaySeconds: 60 - periodSeconds: 30 - securityContext: - seccompProfile: - type: RuntimeDefault - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - privileged: false - runAsNonRoot: false - resources: {} - strategy: {} ---- -apiVersion: image.toolkit.fluxcd.io/v1beta2 -kind: ImagePolicy -metadata: - name: sliding-proxy - namespace: matrix -spec: - imageRepositoryRef: - name: sliding-proxy - policy: - semver: - range: ">=v0.99.1 <v1.0.0" diff --git a/apps/base/matrix/sliding-proxy/kustomization.yaml b/apps/base/matrix/sliding-proxy/kustomization.yaml @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: matrix -resources: - - deployment.yaml