commit afc1dd3ceb641deb90f6bbc4f102b8effd39c17f
parent 5f17fb0cf2863c5ef766a6758dec201a35d8de02
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 3 Apr 2023 20:33:09 +0200
Add synapse
Diffstat:
11 files changed, 448 insertions(+), 19 deletions(-)
diff --git a/README.md b/README.md
@@ -147,12 +147,12 @@ infra-controllers main@sha1:21ebd912 False True Applied revision
- [ ] Matrix
- [x] Media Repo
- [x] Move DB to DB Cluster
- - [ ] Synapse
+ - [x] Synapse
- [x] Prepare DB in DB Cluster
- - [ ] Move DB to DB Cluster
+ - [x] Move DB to DB Cluster
- [x] Sliding Proxy
- [x] Prepare DB in DB Cluster
- - [ ] Move DB to DB Cluster
+ - [x] Move DB to DB Cluster
- [ ] Mjolnir
- [ ] Bridges
- [x] Prepare DBs in DB Cluster
diff --git a/apps/base/matrix/kustomization.yaml b/apps/base/matrix/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
- ./matrix-helm
- ./media-repo
- ./sliding-proxy
+ - ./synapse
diff --git a/apps/base/matrix/synapse/kustomization.yaml b/apps/base/matrix/synapse/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: matrix
+resources:
+ - release.yaml
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -0,0 +1,259 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: matrix-synapse
+ namespace: matrix
+spec:
+ releaseName: matrix
+ chart:
+ spec:
+ chart: matrix-synapse
+ sourceRef:
+ kind: HelmRepository
+ name: ananace-charts
+ interval: 50m
+ install:
+ remediation:
+ retries: 3
+ values:
+ wellknown:
+ enabled: true
+ extraData:
+ support:
+ admins:
+ - email_address: "support@nordgedanken.dev"
+ role: "admin"
+ image:
+ pullSecrets:
+ - name: docker
+ extraConfig:
+ federation_sender_instances:
+ - federation-sender-1
+ - federation-sender-2
+ enable_metrics: true
+ federation_metrics_domains:
+ - matrix.org
+ - t2bot.io
+ - t2l.io
+ - maunium.net
+ enable_media_repo: false
+ require_auth_for_profile_requests: true
+ limit_profile_requests_to_users_who_share_rooms: false
+ allow_public_rooms_without_auth: true
+ allow_public_rooms_over_federation: true
+ experimental_features:
+ msc2409_to_device_messages_enabled: true
+ msc2716_enabled: true
+ persistence:
+ size: 30Gi
+ volumePermissions:
+ enabled: true
+
+ workers:
+ federation_reader:
+ replicaCount: 2
+ enabled: true
+ generic: true
+ listeners: [federation]
+ paths:
+ - "/_matrix/federation/v1/send/"
+
+ synchrotron:
+ enabled: true
+ generic: true
+ listeners: [client]
+ csPaths:
+ - "/_matrix/client/(v2_alpha|r0|v3)/sync"
+ - "/_matrix/client/(api/v1|v2_alpha|r0|v3)/events"
+ - "/_matrix/client/(api/v1|r0|v3)/initialSync"
+ - "/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync"
+
+ generic_worker:
+ replicaCount: 2
+ enabled: true
+ generic: true
+ listeners: [client, federation]
+ csPaths:
+ ## Sync requests
+ # - "/_matrix/client/(r0|v3)/sync$"
+ #- "/_matrix/client/(api/v1|r0|v3)/events$"
+ # - "/_matrix/client/(api/v1|r0|v3)/initialSync$"
+ # - "/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$"
+
+ ## Client API requests
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/createRoom$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$"
+ - "/_matrix/client/v1/rooms/.*/hierarchy$"
+ - "/_matrix/client/unstable/org.matrix.msc2716/rooms/.*/batch_send$"
+ - "/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$"
+ - "/_matrix/client/(r0|v3|unstable)/account/3pid$"
+ - "/_matrix/client/(r0|v3|unstable)/account/whoami$"
+ - "/_matrix/client/(r0|v3|unstable)/devices$"
+ - "/_matrix/client/versions$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/search$"
+
+ ## Encryption requests
+ - "/_matrix/client/(r0|v3|unstable)/keys/query$"
+ - "/_matrix/client/(r0|v3|unstable)/keys/changes$"
+ - "/_matrix/client/(r0|v3|unstable)/keys/claim$"
+ - "/_matrix/client/(r0|v3|unstable)/room_keys/"
+
+ ## Registration/login requests
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/login$"
+ - "/_matrix/client/(r0|v3|unstable)/register$"
+ - "/_matrix/client/v1/register/m.login.registration_token/validity$"
+
+ ## Event sending requests
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/join/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/profile/"
+
+ ## User directory search requests
+ #- "/_matrix/client/(r0|v3|unstable)/user_directory/search"
+
+ ## Worker event streams
+ ## See https://matrix-org.github.io/synapse/latest/workers.html#stream-writers
+ ##
+
+ ## The typing event stream
+ # - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/typing"
+
+ ## The to_device event stream
+ # - "/_matrix/client/(r0|v3|unstable)/sendToDevice/"
+
+ ## The account_data event stream
+ # - "/_matrix/client/(r0|v3|unstable)/.*/tags"
+ # - "/_matrix/client/(r0|v3|unstable)/.*/account_data"
+
+ ## The receipts event stream
+ # - "/_matrix/client/(r0|v3|unstable)/rooms/.*/receipt"
+ # - "/_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers"
+
+ ## The presence event stream
+ # - "/_matrix/client/(api/v1|r0|v3|unstable)/presence/"
+
+ paths:
+ ## Federation requests
+ - "/_matrix/federation/v1/event/"
+ - "/_matrix/federation/v1/state/"
+ - "/_matrix/federation/v1/state_ids/"
+ - "/_matrix/federation/v1/backfill/"
+ - "/_matrix/federation/v1/get_missing_events/"
+ - "/_matrix/federation/v1/publicRooms"
+ - "/_matrix/federation/v1/query/"
+ - "/_matrix/federation/v1/make_join/"
+ - "/_matrix/federation/v1/make_leave/"
+ - "/_matrix/federation/(v1|v2)/send_join/"
+ - "/_matrix/federation/(v1|v2)/send_leave/"
+ - "/_matrix/federation/(v1|v2)/invite/"
+ - "/_matrix/federation/v1/event_auth/"
+ - "/_matrix/federation/v1/exchange_third_party_invite/"
+ - "/_matrix/federation/v1/user/devices/"
+ - "/_matrix/key/v2/query"
+ - "/_matrix/federation/v1/hierarchy/"
+
+ ## Inbound federation transaction request
+ #- "/_matrix/federation/v1/send/"
+
+ pusher:
+ enabled: true
+ appservice:
+ enabled: true
+ federation_sender_1:
+ app: federation_sender
+ name: federation-sender-1
+ enabled: true
+ federation_sender_2:
+ app: federation_sender
+ name: federation-sender-2
+ enabled: true
+ #federation_sender_3:
+ # app: federation_sender
+ # name: federation-sender-3
+ # enabled: true
+ # federation_sender_4:
+ # app: federation_sender
+ # name: federation-sender-4
+ # enabled: true
+ # federation_sender_5:
+ # app: federation_sender
+ # name: federation-sender-5
+ # enabled: true
+ # federation_sender_6:
+ # app: federation_sender
+ # name: federation-sender-6
+ # enabled: true
+ user_dir:
+ enabled: true
+ listeners: [client]
+ csPaths:
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/user_directory/search$"
+ frontend_proxy:
+ enabled: true
+ listeners: [client]
+ csPaths:
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/keys/upload"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status"
+
+ annotations:
+ prometheus.io/scrape: "true"
+ prometheus.io/path: "/_synapse/metrics"
+ prometheus.io/port: "9090"
+ extraEnv:
+ - name: LD_PRELOAD
+ value: /usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+ - name: SYNAPSE_CACHE_FACTOR
+ value: "1.0"
+
+ synapse:
+ ## Liveness probe configuration to use
+ ##
+ livenessProbe:
+ timeoutSeconds: 60
+ failureThreshold: 5
+ httpGet:
+ path: /health
+ port: http
+
+ ## Readiness probe configuration to use
+ ##
+ readinessProbe:
+ timeoutSeconds: 60
+ failureThreshold: 5
+ httpGet:
+ path: /health
+ port: http
+
+ extraCommands: []
+ extraEnv:
+ - name: LD_PRELOAD
+ value: /usr/lib/x86_64-linux-gnu/libjemalloc.so.2
+ - name: SYNAPSE_CACHE_FACTOR
+ value: "2"
+ annotations:
+ prometheus.io/scrape: "true"
+ prometheus.io/path: "/_synapse/metrics"
+ prometheus.io/port: "9090"
+
+ redis:
+ architecture: replication
+ postgresql:
+ enabled: false
+ externalPostgresql:
+ host: matrix-postgres-cluster.matrix-postgres-cluster.svc.cluster.local
+ port: 5432
+
+ ## Password key to be retrieved from existing secret
+ existingSecretPasswordKey: password
+ sslmode: require
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -17,3 +17,4 @@ patchesStrategicMerge:
- postgres-operator-values.yaml
- media-repo-values.yaml
- sliding-proxy-values.yaml
+ - synapse-midnightthoughts.yaml
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -8,3 +8,4 @@ resources:
- grafana-secret.yaml
- matrix-media-repo-postgresql-secret.yaml
- sliding-proxy-secret.yaml
+ - synapse-midnightthoughts-secret.yaml
diff --git a/apps/production/secrets/matrix-media-repo-postgresql-secret.yaml b/apps/production/secrets/matrix-media-repo-postgresql-secret.yaml
@@ -5,8 +5,8 @@ metadata:
namespace: matrix
type: Opaque
stringData:
- password: ENC[AES256_GCM,data:YSsxMh4DcpT/xYynfKRl8iO/x9c9IRw2HLKuAvhp01j26ErPWac1QG6gvVZBeNo95DTVFwITqRPARKfL3cXuxQ==,iv:RTthkqDZwsu5qRj5eHYnsOobm8oYC2IFP4Xiz+87x6U=,tag:49y7rp0/vinr/xvKnT/nhQ==,type:str]
- postgres-password: ENC[AES256_GCM,data:97ZcxhBzkBWcEM8y1dpBVKbIJ/UaZ/xxS0LQ1xea9RaLbO+xJxSs4ax20Eg4y3o+DHRcC1g0YNIv/9BDU0sFGg==,iv:LwOrN1mzvhsHtUNKc+MPlZcWJGHA4EbX0tDQ0JpPtmA=,tag:3Tk5Gh/AWneEjfkMQHNzNg==,type:str]
+ password: ENC[AES256_GCM,data:3iqTi1u8oatr2vBy25fHshGgUd1Whc1c6w8iUny7F06d1TvZgwVfdbMgKFo6DVcLh5foaL15wlbYDuLapxgoNw==,iv:Hjh0Mqqj8umosionVy6hcmnjkquUY3Ywp3HBGxeOEmM=,tag:r1p5S7HLMM5mt+YSFAiH6A==,type:str]
+ postgres-password: ENC[AES256_GCM,data:PQodVy44S1uelc3ZFAF6Q5V5nXqdgGGuPwU7pHOwV6hkv8PLoxSc99v+zdYoEFh27R4UD+JdBj6qEHLKBWMILg==,iv:uuAHmhnFT/C4YVijPuxgpzcRICs/cUh5b7Cw/y9ldLQ=,tag:Y8CmrHbaN/34a+ln8fusMQ==,type:str]
sops:
kms: []
gcp_kms: []
@@ -15,15 +15,15 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnSDVIaERrYkMrQlgxd05S
- dUZILzlmVUp1TWFEQW5wTjlWdTFSa2RHbm1BCnd6MjhjSjZFSGdlUndvdGVwcDZt
- ZVUybitUTXlhSG1tcG0zOGRTYjBGWDQKLS0tIEllNHluR09pK0RYTWtIaWUwTnpG
- aGlnUGFOOHZ5dnNHQ2JtU05jdU9nK3cKCri+E8mSXYUynIPvfbKU/9lkWLH2DwDh
- Zy0nupBRMwI12K6MEXzlVqpfMbaDN9wjNJjEnFW7Rxx0UZcd5leTRQ==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-04-03T17:13:45Z"
- mac: ENC[AES256_GCM,data:Rn3JDFaarRKCl7z97cqbqlYJCzD77SUdryweqQBei0Yxp6jXX9o9bK69n7t429EwaA+NUwkgFBbppD5sJ5ucYfwKJuWq1d0ZqXhfhxlwI6nYWVT4KtSgVPasttv7hl5SZEYGbTazg83GQ2jovgAiCytR/PS5SlPIDN7Coj6Zw8Y=,iv:+NX4LBFjAZ77z7EjX+/tGqKRBSdTXX/K52RIQzEggsw=,tag:HAAwTf+X8lUiCrmprHOSRA==,type:str]
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVUlWOEtWa1gycVh4WWZI
+ U3dxcnIvanI5R0VOeVNNNTkyL24ralp4R2pnClJ6bDlMYU4zQm1rMGlyRGpidCtv
+ UEZDZVNrSUhtT1YzbzNiNjdGMGFpSkEKLS0tICtJdkoyaDZrNFJldWViRCtiZUdy
+ VE93UlF5eVgwRmFFQUxKU0NFSkN1bncKiBXvVRsXSSxo9HlgbIe+OThYhveC6pLn
+ A3VcN7JcGovcJiOifFsIfyYffK/z5HaZorahxJKmzaY87adbI0RS1g==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-03T18:30:22Z"
+ mac: ENC[AES256_GCM,data:IeNZ02AZJ/jnPBr2USK7L9xNNXBMARXejscZ1O8Y2n8+kgv0nBVPknlKBin/OmLhH2SmZY2aH4kfIyXlKDwzO/Q371S2B9//b/wFRMM7eaxqLhIkvDdOB68280m/DNyfZU0c8xjRYIoqkCETZSPwHM9chsOgwOoJVOJ+qswPwzc=,iv:cHg85UlOK0mXplDaxvOktS3El3J1sLQOVj3BWd7OUgc=,tag:Hz0hxMmHNuA4XSFptvDyjw==,type:str]
pgp: []
- encrypted_regex: ^(data|stringData|password)$
+ encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
version: 3.7.3
diff --git a/apps/production/secrets/synapse-midnightthoughts-secret.yaml b/apps/production/secrets/synapse-midnightthoughts-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: synapse-midnightthoughts-postgresql
+ namespace: matrix
+type: Opaque
+stringData:
+ password: ENC[AES256_GCM,data:Hwi0XfZFgPLHgOFyPhPwndfo7IsHXyJLpZzU3hS4ZUZAnOVg5fQQX5mUJ9+uj0s6QiEb0UoVcJpr47VN/MkpxA==,iv:jsk/Sc+MsK5V50WbO7bOAo0vPpBGu7sTD1hhcwsjRbA=,tag:G5FUaHdiakdD+5vHdK2Yxw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4bHRUemR4QmdxQVJGejdu
+ R2RZUG94eFF1U28waUpiL01rZFZxUG9RQTBJCkhTTHVpZHB5Zm12M1VMQlk2ZWE3
+ WFRjdkw1YUQ5ODVXVW5WVTdadHFzbnMKLS0tIDZLM3hBU21CZEdaTUdPWUxKamtD
+ OG5iYXQvVFpmTFRRdUpPemh3VlJyQ1UKoFtgDmm0OA1U7jV0ugkJosgt9qSWbwqi
+ tKEi1bLOnbdm5Frg5go94KNtsSiEruBgrRzADlvmiJ1r/Hr43yicWA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-03T18:30:29Z"
+ mac: ENC[AES256_GCM,data:YrcJCNo8lk4RfqryPrgc7qpqGvP5EFWIRHwiR5OLEy3IJxwqjWcOqNgJhMHnQ6x6R391awvz6ASENEdR7jI5fLnxIEhQKccpLOvernVuh3yacskrTovz2AkP784nmtGFtarf+Prqhow9pZfwus29ufBD7DIW1TI6DE6XpebKf+Q=,iv:XKcHPzqoSs3TOcCoFpuzMf2hkckLB0M1wpt2BqeDXQ0=,tag:0tDINd5tr/gdjFdG0qMY2A==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
+ version: 3.7.3
diff --git a/apps/production/synapse-midnightthoughts.yaml b/apps/production/synapse-midnightthoughts.yaml
@@ -0,0 +1,134 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: matrix-synapse
+ namespace: matrix
+spec:
+ chart:
+ spec:
+ version: 3.0.x
+ values:
+ signingkey:
+ job:
+ enabled: false
+ existingSecret: matrix-synapse-signingkey
+ existingSecretKey: signing.key
+ image:
+ repository: coreharbor.kubernetes.midnightthoughts.space/matrixdotorg/synapse
+ # TODO update properly again
+ tag: 48969d50
+ serverName: midnightthoughts.space
+ publicServerName: matrix.midnightthoughts.space
+ wellknown:
+ client:
+ m.homeserver:
+ base_url: https://matrix.midnightthoughts.space
+ org.matrix.msc3575.proxy:
+ url: https://sliding.matrix.midnightthoughts.space
+ config:
+ reportStats: true
+ enableRegistration: false
+ trustedKeyServers:
+ - server_name: matrix.org
+ extraConfig:
+ registration_shared_secret: ENC[AES256_GCM,data:0dWtir4RJk2RpoiZOHnoCpUbb398CtM6/HWlgAQ+pwozAXs9/L2NwOnf9LLM9dKhvnRrQoQIJjo/6NZItg4qKg==,iv:Y6qPy317YF/zxIMznJxUDwN256Sj1s9AHOTGs6UEo2E=,tag:/RrDo1H3X64RztOY/75V5A==,type:str]
+ app_service_config_files:
+ - /data/whatsapp-registration.yaml
+ - /data/instagram-registration.yaml
+ - /data/signal-registration.yaml
+ - /data/hookshot-registration.yaml
+ modules:
+ - module: shared_secret_authenticator.SharedSecretAuthProvider
+ config:
+ shared_secret: ENC[AES256_GCM,data:a1usH1y0NLBfz2GisYUwHrLkEHohmJp4kGjck1r9HTasRSgDHtrrdKH9cynyx+nsjgfsfVvBWyBzvD+2rLwEdg==,iv:hHziDd2zSs3kZb7sBCKB080oldfHIwWyUDO4yyIgViY=,tag:wDcx2WlWUSI/VGwdHUQmew==,type:str]
+ ingress:
+ traefikPaths: true
+ tls:
+ - hosts:
+ - midnightthoughts.space
+ - matrix.midnightthoughts.space
+ secretName: midnightthoughts-synapse-tls-secret
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ traefik.ingress.kubernetes.io/router.tls: "true"
+ traefik.ingress.kubernetes.io/router.middlewares: default-hsts@kubernetescrd,default-compress@kubernetescrd,default-redirect-https@kubernetescrd
+ workers:
+ default:
+ volumeMounts:
+ - mountPath: /data/whatsapp-registration.yaml
+ subPath: registration.yaml
+ name: whatsapp-config-volume
+ - mountPath: /data/instagram-registration.yaml
+ subPath: registration.yaml
+ name: instagram-config-volume
+ - mountPath: /data/signal-registration.yaml
+ subPath: registration.yaml
+ name: signal-config-volume
+ - mountPath: /data/hookshot-registration.yaml
+ subPath: registration.yaml
+ name: hookshot-config-volume
+ volumes:
+ - name: whatsapp-config-volume
+ configMap:
+ name: whatsapp-bridge-config
+ - name: instagram-config-volume
+ configMap:
+ name: instagram-bridge-config
+ - name: signal-config-volume
+ configMap:
+ name: signal-bridge-config
+ - name: hookshot-config-volume
+ configMap:
+ name: hookshot-config
+ synapse:
+ extraVolumeMounts:
+ - mountPath: /data/whatsapp-registration.yaml
+ subPath: registration.yaml
+ name: whatsapp-config-volume
+ - mountPath: /data/instagram-registration.yaml
+ subPath: registration.yaml
+ name: instagram-config-volume
+ - mountPath: /data/signal-registration.yaml
+ subPath: registration.yaml
+ name: signal-config-volume
+ - mountPath: /data/hookshot-registration.yaml
+ subPath: registration.yaml
+ name: hookshot-config-volume
+ extraVolumes:
+ - name: whatsapp-config-volume
+ configMap:
+ name: whatsapp-bridge-config
+ - name: instagram-config-volume
+ configMap:
+ name: instagram-bridge-config
+ - name: signal-config-volume
+ configMap:
+ name: signal-bridge-config
+ - name: hookshot-config-volume
+ configMap:
+ name: hookshot-config
+ externalPostgresql:
+ username: synapse
+ ## The name of an existing secret with postgresql credentials
+ existingSecret: synapse-midnightthoughts-postgresql
+ database: synapse
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuRWI4Y1NmclB0Y1dJNGFO
+ NVVwWktDOFlWVzJKQzBkakQxQ3RtVXlhSW5nCmNsWlFYTmVWM0t1ckRXKzhXTjFw
+ SldDUnp3TWx4RU9laEVZNjExdHpPeEkKLS0tICtRY3doZU1iVlgwMFVxMHNBaHBG
+ S1F4K0RtZFVuQUNadHl2SlFyVi84M28K0KGVf10oakWcRWHAzG6DsRpqELwK6v68
+ /qYHBMUSnqz0PedIIADbbQKG58rD8fUMgfGyItAsKVMDYmRd9cg0TA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-03T18:32:34Z"
+ mac: ENC[AES256_GCM,data:vSYvXj11IRlCepz35YUyo1EANW69GpYvuwh8zDxRN5KBMmkmqC+jgGLR4JyyIIENiguI9gkDBNB2BlD98xXKblazIpEuEI7FHWIXixsoulRyUxbggFHY5sDWqRDM/oiAkz3ws4MuuQGImjQ8hUL5LjtVWeG3qGOr57oTlXuanAQ=,iv:q1iuW8dVBhKRMzmnzDQEt3MsvXurLcTKZ+qZ+hOvLFA=,tag:7/5dfmOyZdPUBZvQ+biJrQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
+ version: 3.7.3
diff --git a/decrypt.sh b/decrypt.sh
@@ -1,4 +1,4 @@
#!/bin/bash
export SOPS_AGE_KEY_FILE="$(pwd)/age.agekey"
-sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --decrypt --encrypted-regex '^(data|stringData|password)$' --in-place "$1"
-\ No newline at end of file
+sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --decrypt --encrypted-regex '^(data|stringData|password|registration_shared_secret|shared_secret)$' --in-place "$1"
+\ No newline at end of file
diff --git a/encrypt.sh b/encrypt.sh
@@ -1,3 +1,3 @@
#!/bin/bash
-sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(data|stringData|password)$' --in-place "$1"
-\ No newline at end of file
+sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(data|stringData|password|registration_shared_secret|shared_secret)$' --in-place "$1"
+\ No newline at end of file
