commit b7e536f4cfa318b854d050280f06b777d6338c8e
parent e228cfd2118fd6139f42a752340904a9748b88af
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 6 Mar 2024 12:40:50 +0100
Add element-call synapse
Diffstat:
10 files changed, 307 insertions(+), 11 deletions(-)
diff --git a/apps/base/matrix/element-call-synapse/kustomization.yaml b/apps/base/matrix/element-call-synapse/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: element-call
+resources:
+ - release.yaml
+ - podmonitor.yaml
diff --git a/apps/base/matrix/element-call-synapse/podmonitor.yaml b/apps/base/matrix/element-call-synapse/podmonitor.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+ name: element-call-synapse
+ labels:
+ instance: element-call
+spec:
+ jobLabel: "app.kubernetes.io/component"
+ namespaceSelector:
+ matchNames:
+ - "matrix"
+ selector:
+ matchLabels:
+ app.kubernetes.io/instance: element-call-synapse
+ app.kubernetes.io/name: matrix-synapse
+ podMetricsEndpoints:
+ - port: metrics
+ path: "/_synapse/metrics"
+ interval: 5s
+ relabelings:
+ - sourceLabels:
+ - "__meta_kubernetes_pod_label_app_kubernetes_io_instance"
+ targetLabel: instance
diff --git a/apps/base/matrix/element-call-synapse/release.yaml b/apps/base/matrix/element-call-synapse/release.yaml
@@ -0,0 +1,185 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: element-call-synapse
+ namespace: element-call
+spec:
+ chart:
+ spec:
+ chart: matrix-synapse
+ sourceRef:
+ kind: HelmRepository
+ name: ananace-charts
+ interval: 50m
+ install:
+ remediation:
+ retries: 3
+ values:
+ extraConfig:
+ stream_writers:
+ events: event_persister
+ run_background_tasks_on: background_worker
+ presence:
+ enabled: false
+ federation_sender_instances:
+ - federation-sender-1
+ - federation-sender-2
+ event_cache_size: 10K
+ caches:
+ global_factor: 10
+ expire_caches: true
+ cache_entry_ttl: 240m
+ cache_autotuning:
+ max_cache_memory_usage: 2048M
+ target_cache_memory_usage: 1024M
+ min_cache_ttl: 5m
+ wellknown:
+ enabled: true
+ extraData:
+ support:
+ admins:
+ - email_address: "support@nordgedanken.dev"
+ role: "admin"
+ image:
+ pullSecrets:
+ - name: docker
+ persistence:
+ size: 10Gi
+ accessMode: ReadWriteMany
+ volumePermissions:
+ enabled: true
+ workers:
+ default:
+ tolerations:
+ - key: "arch"
+ operator: "Equal"
+ value: "arm64"
+ effect: "NoSchedule"
+ extraConfig:
+ event_cache_size: 30K
+ caches:
+ global_factor: 10
+ expire_caches: true
+ cache_entry_ttl: 1080m
+ sync_response_cache_duration: 2m
+ cache_autotuning:
+ max_cache_memory_usage: 4069M
+ target_cache_memory_usage: 2048M
+ min_cache_ttl: 5m
+ generic_frontend:
+ replicaCount: 2
+ enabled: true
+ generic: true
+ listeners: [client]
+ csPaths:
+ # Client API requests
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/createRoom$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$"
+ - "/_matrix/client/(r0|v3|unstable)/account/whoami$"
+ - "/_matrix/client/(r0|v3|unstable)/devices$"
+ - "/_matrix/client/versions$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$"
+
+ # Encryption requests
+ - "/_matrix/client/(r0|v3|unstable)/keys/query$"
+ - "/_matrix/client/(r0|v3|unstable)/keys/changes$"
+ - "/_matrix/client/(r0|v3|unstable)/keys/claim$"
+ - "/_matrix/client/(r0|v3|unstable)/room_keys/"
+ - "/_matrix/client/(r0|v3|unstable)/keys/upload/"
+
+ # Registration/login requests
+ - "/_matrix/client/(r0|v3|unstable)/register$"
+ - "/_matrix/client/(r0|v3|unstable)/register/available$"
+
+ # Event sending requests
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/join/"
+ - "/_matrix/client/(api/v1|r0|v3|unstable)/profile/"
+ federation_reader:
+ replicaCount: 2
+ enabled: true
+ generic: true
+ listeners: [federation]
+ paths:
+ - "/_matrix/federation/v1/send/"
+ appservice:
+ enabled: true
+ name: appservices
+ generic: true
+ federation_sender_1:
+ labels:
+ synapse-component: federation-sender
+ app: federation_sender
+ name: federation-sender-1
+ enabled: true
+ federation_sender_2:
+ labels:
+ synapse-component: federation-sender
+ app: federation_sender
+ name: federation-sender-2
+ enabled: true
+ background_worker:
+ name: background_worker
+ replicaCount: 1
+ enabled: true
+ generic: true
+ event_persister:
+ name: event_persister
+ replicaCount: 1
+ enabled: true
+ generic: true
+ listeners: [replication]
+ synapse:
+ tolerations:
+ - key: "arch"
+ operator: "Equal"
+ value: "arm64"
+ effect: "NoSchedule"
+ ## Liveness probe configuration to use
+ ##
+ livenessProbe:
+ timeoutSeconds: 60
+ failureThreshold: 5
+ httpGet:
+ path: /health
+ port: http
+
+ ## Readiness probe configuration to use
+ ##
+ readinessProbe:
+ timeoutSeconds: 60
+ failureThreshold: 5
+ httpGet:
+ path: /health
+ port: http
+
+ extraCommands: []
+ annotations:
+ prometheus.io/scrape: "true"
+ prometheus.io/path: "/_synapse/metrics"
+ prometheus.io/port: "9090"
+
+ redis:
+ architecture: standalone
+ # master:
+ # tolerations:
+ # - key: "arch"
+ # operator: "Equal"
+ # value: "arm64"
+ # effect: "NoSchedule"
+ postgresql:
+ enabled: false
+ externalPostgresql:
+ #host: postgres.internal.midnightthoughts.space
+ host: matrix-postgres-cluster.matrix-postgres-cluster.svc.cluster.local
+ port: 5432
+
+ ## Password key to be retrieved from existing secret
+ element-call-postgresql: password
+ sslmode: require
diff --git a/apps/base/matrix/kustomization.yaml b/apps/base/matrix/kustomization.yaml
@@ -9,3 +9,5 @@ resources:
- ./draupnir-synapse
- ./draupnir4all
- ./draupnir-fluffy
+ - ./element-call
+ - ./element-call-synapse
diff --git a/apps/base/matrix/matrix-helm/repository.yaml b/apps/base/matrix/matrix-helm/repository.yaml
@@ -8,6 +8,15 @@ spec:
interval: 5m
url: https://ananace.gitlab.io/charts
---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: ananace-charts
+ namespace: element-call
+spec:
+ interval: 5m
+ url: https://ananace.gitlab.io/charts
+---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -30,7 +30,6 @@ resources:
- ../base/authentik
- ../base/chaosmesh
- ../base/calendar
- - ../base/matrix/element-call
patchesStrategicMerge:
- cosign-values.yaml
- vaultwarden-values.yaml
@@ -47,3 +46,4 @@ patchesStrategicMerge:
- synapse-draupnir.yaml
- forgejo.yaml
- vector-values.yaml
+ - synapse-element-call.yaml
diff --git a/apps/production/secrets/draupnir-midnightthoughts-secret.yaml b/apps/production/secrets/draupnir-midnightthoughts-secret.yaml
@@ -5,7 +5,7 @@ metadata:
namespace: matrix
type: Opaque
stringData:
- password: ENC[AES256_GCM,data:AqN1jWaOWjN7m/6n8rWsni61zSqCqa72OMLiT2BT1qHg4cWXQmh8+6C8kHW/f9YKWuHJ+AEIMnOn2K0exLVeUw==,iv:icqT+RXsPj7nRmAWRgCCiuDiE4d6S6VfgLXncVAfyK0=,tag:6yZ7+DXuYQZloWNy2KNW8A==,type:str]
+ password: ENC[AES256_GCM,data:DPAGSrnwubIhJ9ltRsGedhoO5jkhkMQBb2b1C0PtiqdLLYuCCN/U6cvjl+JPuLrbS9h8w9s4mV9PfuTb7Rb5bA==,iv:w51h3Umx6MX1H2naMcpLi5HT7e+qP2Hc6eu1qQE3qs0=,tag:MbGIFOsO3J4gx4RYuTdnqw==,type:str]
sops:
kms: []
gcp_kms: []
@@ -15,14 +15,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVUMzMFR5WEtwZjdxTHdq
- Zkw0ekwwd0lJMGdRbU1IMDVnSnhRUGs4d3dvClJkZ0NvSEJJaWk3b0RoNHROVWVB
- NXU1OXM5T3lJSTdHdDdJVVovdEp6ZjgKLS0tIDdtTDk3NzhKVUozSDcrNTQreTFB
- T3NnSmJkSzA1UGFCM3kvZUNDRys3YkEKJkskjXJQsgEI97zmH+sBVTDt8desWsHw
- d9+puyUSW3un1BtVRTFlhrXjtI1XaXNxRbZC0n+czYs57cYMzfEKzA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDL0FJcjBBS3lTZ2RoRUpa
+ NkRJb1VSRFpudVFOeU8rVnpkbkVtRFJYb3hFCmsza005WDlUNFUzQ3Ixcm84Slhn
+ M1AzOGJBYXBEWHkyTVFEajJHWkovTFkKLS0tIHBsaVhiRndNR3F6c1FxTDhTMW1k
+ UjJQZmhxVStrZWhReFl6R3IyUWpiVjQKJLcTOqIacHo6Xg6chc7vELwdfnmCsLHa
+ eHO+eHVSafUXfM4GL+Gobp9wFK03t+GlgcGTKryiDEoJdkK1zS9u6A==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-06-25T10:44:11Z"
- mac: ENC[AES256_GCM,data:5ahjfZCIfyIohJ/Z9SYnBuUdXlW0CN2EG7lIp0UA99sg9yA1EqT8NPJK8d4zVOM51aHUVnrWBHpIuzhpQ3xiYZRFXlAzPZPWUPRch95QHSm0+W+r4aSl+Fa4ZjNf8oXyB/Vvrlnkl4StNs/EXYKcENVV68TeBjsph6IVnpE/Qy0=,iv:pVF225ILjzFcolxpQQWNpuZN9069Y2fIEaJU5JD9OBs=,tag:c+3Efj0ehfHAzxHXwiFk1w==,type:str]
+ lastmodified: "2024-03-06T11:33:38Z"
+ mac: ENC[AES256_GCM,data:0cPRXB1ySWeq6v15m/8DnouRuSuelDaVs863rZQ2cJDzm637xLjzsKVrxeKecReU0WjFwNRVlwuNExz509d+StDP++haELZYZMp2BapmYAldoCi+TJklvqU408sSdAWNZwE20Ens3RzPS3n+ToCjUhfz0RJ6JxQLZPAPpydwnkE=,iv:Ow9/ndKQ3Z2abOCkpl9kNMZ4g14eFDGhQ9+PebILess=,tag:cuRtNM53ouiApdidUqkvyg==,type:str]
pgp: []
- encrypted_regex: ^(data|stringData|password|postgresPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
- version: 3.7.3
+ encrypted_regex: ^(api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+ version: 3.8.1
diff --git a/apps/production/secrets/element-call-synapse-secret.yaml b/apps/production/secrets/element-call-synapse-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: element-call-postgresql
+ namespace: element-call
+type: Opaque
+stringData:
+ password: ENC[AES256_GCM,data:moBwWfk8BLo5S+6QxQ+CfQ0nB2/3YZyw2x9HBc6+5d16xh7n7BceS8yBpNBkevvWqEoVaP0ylUwChoqbDT5HDQ==,iv:kWOMDHX+K5Bk8/BmtLBAT6maL9c2S5Rt6X31G1H5c2I=,tag:/pi1b1CRiFVyiy+V1Qyl0A==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRlhyeEd0azhaaXhwblAw
+ NGlxeGVrVGV2WFJCZ04wU2NkM3l5RHJ0TUg0Ci9RV3UrNlk3aDN1RVZmMzhUUnYr
+ UC9sVmVGdFB4ZHVaL3VXS29yNkozSkUKLS0tIC8xMlFkdFpDUlh0ZW1UZks2cS9z
+ Uk5OZFdzSm9sdVpVUVJlTEdyTTQxTUkKLsAV3C9Xnh0FHLPIX3Hm/7/fbIiraoaT
+ 1R1RzAE8xT+n1pwwq/Y7uhsLoi5IEc6IanqKo/kKjYBT74ZuQQpRkQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2024-03-06T11:39:35Z"
+ mac: ENC[AES256_GCM,data:dwQyHPqscXLZdELXswQfOCdfMTocYi2ofoRSbyIWAgSgLi06t4vhsggkEPoQIw+4x4/LLGqTXX7VjfcaMU59HPw8usIPIdAsyx+DbbEqr8RpdmvZDFHE1zx6Fuj3CeHcUdqTLujfKa2FEsn7z84agHpnIbk6MHjXybfz5un39Mk=,iv:eYgy6G3pVHnerPYtkdOHjWKarKDcK8SKxbteOgo5b80=,tag:zhia8By8ZqfgYCBzUtM/lw==,type:str]
+ pgp: []
+ encrypted_regex: ^(api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+ version: 3.8.1
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -18,3 +18,4 @@ resources:
- zuul-secrets.yaml
- draupnir-fluffy-config.yaml
- umami.yaml
+ - element-call-synapse-secret.yaml
diff --git a/apps/production/synapse-element-call.yaml b/apps/production/synapse-element-call.yaml
@@ -0,0 +1,41 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: element-call-synapse
+ namespace: element-call
+spec:
+ chart:
+ spec:
+ version: 3.7.x
+ values:
+ signingkey:
+ job:
+ enabled: true
+ serverName: matrix-call.midnightthoughts.space
+ publicServerName: matrix-call.midnightthoughts.space
+ wellknown:
+ client:
+ m.homeserver:
+ base_url: https://matrix-call.midnightthoughts.space
+ config:
+ reportStats: true
+ enableRegistration: false
+ extraConfig:
+ use_presence: false
+ ingress:
+ traefikPaths: true
+ hosts:
+ - matrix-call.midnightthoughts.space
+ tls:
+ - hosts:
+ - matrix-call.midnightthoughts.space
+ secretName: matrix-call-midnightthoughts-synapse-tls-secret
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-http
+ traefik.ingress.kubernetes.io/router.tls: "true"
+ traefik.ingress.kubernetes.io/router.middlewares: default-hsts@kubernetescrd,default-compress@kubernetescrd,default-redirect-https@kubernetescrd
+ externalPostgresql:
+ username: element_call_synapse
+ ## The name of an existing secret with postgresql credentials
+ existingSecret: element-call-postgresql
+ database: element_call_synapse
