commit e35951ad1c02ffad455080efa9a71457b189b694
parent 30738735620d934931b1af805904a4b5ae71c23c
Author: MTRNord <mtrnord1@gmail.com>
Date: Sun, 2 Apr 2023 19:19:07 +0200
Migrate sliding sync proxy
Diffstat:
12 files changed, 208 insertions(+), 20 deletions(-)
diff --git a/apps/base/matrix-helm/repository.yaml b/apps/base/matrix-helm/repository.yaml
@@ -1,3 +1,4 @@
+---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
@@ -6,3 +7,12 @@ metadata:
spec:
interval: 5m
url: https://ananace.gitlab.io/charts
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+ name: sliding-proxy
+ namespace: matrix
+spec:
+ image: ghcr.io/matrix-org/sliding-sync
+ interval: 1m0s
diff --git a/apps/base/sliding-proxy/deployment.yaml b/apps/base/sliding-proxy/deployment.yaml
@@ -0,0 +1,60 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: sliding-proxy-midnightthoughts
+ namespace: matrix
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: sliding-proxy-midnightthoughts
+ template:
+ metadata:
+ labels:
+ app: sliding-proxy-midnightthoughts
+ spec:
+ containers:
+ - image: ghcr.io/matrix-org/sliding-sync:v0.99.1 # {"$imagepolicy": "matrix:sliding-proxy"}
+ imagePullPolicy: Always
+ livenessProbe:
+ httpGet:
+ path: /client/server.json
+ port: 8888
+ initialDelaySeconds: 60
+ periodSeconds: 30
+ name: sliding-proxy-midnightthoughts-container
+ envFrom:
+ - secretRef:
+ name: sliding-proxy-env
+ env:
+ - name: SYNCV3_BINDADDR
+ value: "0.0.0.0:8888"
+ ports:
+ - containerPort: 8888
+ name: http
+ readinessProbe:
+ httpGet:
+ path: /client/server.json
+ port: 8888
+ initialDelaySeconds: 60
+ periodSeconds: 30
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: true
+ #runAsNonRoot: true
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+ name: sliding-proxy
+ namespace: matrix
+spec:
+ imageRepositoryRef:
+ name: sliding-proxy
+ policy:
+ semver:
+ range: ">=v0.99.1 <v1.0.0"
diff --git a/apps/base/sliding-proxy/kustomization.yaml b/apps/base/sliding-proxy/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: matrix
+resources:
+ - ../matrix-helm
+ - deployment.yaml
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -8,6 +8,8 @@ resources:
- ../base/rook
- ../base/postgres-operator
- ../base/media-repo
+ - ../base/sliding-proxy
+ - sliding-proxy-ingress.yaml
patchesStrategicMerge:
- cosign-values.yaml
- vaultwarden-values.yaml
@@ -15,3 +17,4 @@ patchesStrategicMerge:
- kube-prometheus-stack-values.yaml
- postgres-operator-values.yaml
- media-repo-values.yaml
+ - sliding-proxy-values.yaml
diff --git a/apps/production/media-repo-values.yaml b/apps/production/media-repo-values.yaml
@@ -59,7 +59,7 @@ spec:
host: matrix-postgres-cluster.matrix-postgres-cluster.svc.cluster.local
port: 5432
username: matrix_media_repo
- password: ENC[AES256_GCM,data:4P7ZUwB5B1ec9gfCJJgw2LITBbD97Ko/gCJmg7btD1fvE7TCZKEvTr5QQ3ATfGWQqD2rOliKj8MQFmadZjGfLw==,iv:TuYPCoFPPxwXsDXIstYWA8Q3BHnzjdF66fsd/yjE/bY=,tag:tyggRBSdYZIOjzWIURICzQ==,type:str]
+ password: ENC[AES256_GCM,data:jIL7w09cV50OU1lB4y97cPzL3Im0ficSRS66WgGwK+j+jCfn/pE4CZCfpNkKGFYhPgRCVik3TrkY5L4w59YDKQ==,iv:hfzpxlGmNPJRroPiJTx3UfQZclxUNqxwqsH/fPtnmQg=,tag:jjwMYspnLiH6f8UCFKEF3Q==,type:str]
database: matrix_media_repo
sslMode: require
persistence:
@@ -75,14 +75,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjaUl4c1RLaHltdER4c1g3
- OTJDQ0lzVkpmc2dRYkFpMi85Q3JKcmovcEdzCkNyZ2RyVlB6WW54Z3V6RHord1k0
- eHhocGM3U0k0cW1CVjNtd0VYVzZiT0EKLS0tIE9TUHZ2K2xHQ2w1Mk1VUTlWS1Bo
- amh0QnQ0QUQzU1VwMU9sSWZFNGlhd2cKO5eSMHKaT9K6zP9ThldxfNDzXtBzXv4U
- wEcgxEBJsrS6KmTyN26eVynnB8OJB5P9vYx+Ff8S6iXYMmCmcQglTA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3YXBwZjlXVk5HUWNsWHBx
+ MG80OTRSeHhicTBieFpHQnNtMEg4Wkw4RVFjCjB5UlhvUTRidjhEdTBHWHF5UC9k
+ RHRxMElLYkx4bEs3Q2d3RnEyZW5hNUkKLS0tIHV0UEdvajV6aVZyVDIxRFZ4UlNo
+ alhlT3lZR3pFZmRPSTdUeFlOWCt4bkUKQljK17JOBA+Evv0WHf2mE+msklIQJ09E
+ B3Hk6tlZSC9/lyyTIW3UaQOQQotd6DcbmrITl5kGSNz70SupCbzahA==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-04-02T14:43:23Z"
- mac: ENC[AES256_GCM,data:cJIvmFR+N7MFdrc1cMpF7xDi9w39/+UBZtDyZClQwwei4wgrljlA+TVq5X7Ug4aXsFqjQJz6fZRr81om7xe3LzvP741hVBLno/iuNOicE425hI4DAvt2hq2GWEJjJl6T4QLdkTZwIRfgaXBExqAuYIAlP5jRLfnM32XsWbyli04=,iv:plcMhRL7MdSV77fOq0W+wM4TsDxsZBub++vwu2QaiAQ=,tag:MezS807sZg+KacpNlrKzqA==,type:str]
+ lastmodified: "2023-04-02T17:03:03Z"
+ mac: ENC[AES256_GCM,data:lWUhKDJ1EO7gqlmMpcjbFd0lXX8MWASjOn8wvLesBzlxfRr81vJPx47rCES0WIg/Pt2ugVl/BbRpDdvXRlG2hcCSSf2Gui3fmUEBoGY+O7t/3X6M0qmdjKzXDZld6eUyzQk/HqKvdqksjujhpo3goq3x8dJivQF7frtnOm2z29A=,iv:sVUYjtWa3W2nbSmADiMvFZYaa1taRzGjCzxq88cNxSk=,tag:L07VzbaxH1wStDxdDfEfgA==,type:str]
pgp: []
encrypted_regex: ^(data|stringData|password)$
version: 3.7.3
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
- alertmanager-secret.yaml
- grafana-secret.yaml
- matrix-media-repo-postgresql-secret.yaml
+ - sliding-proxy-secret.yaml
diff --git a/apps/production/secrets/matrix-media-repo-postgresql-secret.yaml b/apps/production/secrets/matrix-media-repo-postgresql-secret.yaml
@@ -5,8 +5,8 @@ metadata:
namespace: matrix
type: Opaque
stringData:
- password: ENC[AES256_GCM,data:BK8YSfr0sj8re6Jm9w42jZaCTtsISjX/0Rs9rLZry1l4JSgxOFWJAMAli8UIusHtmVd6bHELRih4fOtQ8AIHuQ==,iv:SOVPmmGcvGkT25C0i7rIyVCBo+P9VxSbSnwNOcMiNCo=,tag:CTT8eflctZ8O2FPMy5Q17Q==,type:str]
- postgres-password: ENC[AES256_GCM,data:htG52vlSXRd2Ql3hSV3yRCLdjTsgQ2aq+7wHdDdy/CmwUnL5cIhCSRyFV0oWoL5L8jW8JVCoySk/2FdJomKHig==,iv:zSpXOVC+JuD3KduCdEZmmoUmj1j6mkJiyBUWTs9kXB4=,tag:MF51DBXFFl9qlmaCqRruJA==,type:str]
+ password: ENC[AES256_GCM,data:VGOFlImFAeoHc+cEKRRrkMgDYMu4ydq9BzNlz83XhDKEXWyP2k554ZSsRlNa6Cudn9wJtWD1VapkRdDuAJCu6Q==,iv:z14+tv0oM85a3FYzIqYBdEG7JSGL7IX10lY1285JZ9M=,tag:OTDQ1JGDY0xbXcIkjWRNTA==,type:str]
+ postgres-password: ENC[AES256_GCM,data:tcwjHzWOL6OiuU5LvVXf5jUjOgZ7g6jeus3qxY0ByWYhCLfXGfpB+xVVE3ajtx1nQ3Dqbl3P2oRTeOMNgLTL2w==,iv:Epnwt+ciAwCh30snF1XEgnU05y82mYzOmN4jnUnIf1A=,tag:bl2yAkN2sWfPNHjMlWKQvQ==,type:str]
sops:
kms: []
gcp_kms: []
@@ -15,15 +15,15 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMHE5YU84d3QzVlcrTnE2
- OGQ4aGpUTVlnZ04vam9LYll4WnVoRGdiTWpnCmpyVnladUFIYVNpbFltTVZZS05I
- cno5L2JNcWtZaWsxcVR5NCtaOXNMaW8KLS0tIHREWnpkNzAzSFRSVEtuTDQxQnIy
- b0NGOWFNR0YwNFhhSU5DTmRJT05xNkkKkfYvfVOMlMDjOBd5vLJFMgo/YGpUAusI
- ofRdEoeeMTjk70F3hVOpPHCbjKxKBnteGQJsWPBLJLTfNPq9yCJnDA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2023-04-02T13:05:59Z"
- mac: ENC[AES256_GCM,data:3G1LMzW9tIEhxdLR+JPuZubX5ZxSm5m5hmDE6eNe1ROTfccsIVWjOef7GJvZWYvh10eK3oPRlN1W5LlJJnw6aJWlCx9u7znuRHkiaUuel6XVnVwYOCGA//tn6BzG1MghcbA9vrTzLKp6WVysvplo0kVvRXHFrT+jVFqFPqNlmus=,iv:cB5lLXqB+lMrR8IRFFW8nChFEOPGEUpV1SGocKOMfA8=,tag:4OvvaBBLfGWgh2IgqCD8Mg==,type:str]
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBISk9HczdOUGNxUTB3THJX
+ VVBtVGdyQTlwVzM1cHZZTUhLcm9jVnYzU1dRCmlKZUJqUFBYNDVJSy9kUVZNakE0
+ RUtnZ3ZhOTk3UDRQZjFEVEE2Z2NkeG8KLS0tIFVWVmpnQ09NVXVrYVk1OTRWRWNR
+ VmYrOUlwWUdwbVYveWFETjJ4RE85YncK0cCo6zi5aSiT9ImWbYC4zHgE/MFZ8S/K
+ tqL65OCfG0MXexJcvRt0fnXfecJq7wSUN2Ge89M1TSqb2NQ4x8t4bQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-02T17:03:16Z"
+ mac: ENC[AES256_GCM,data:spmDupR/ZgqgNd4sd/gHlsEeRY3pCaG8Q2T5CqqlcJXWfNVwGjnokRAbeREU6boIkterDeJrLs8yGQcERrOOA+2lZfqt7pEOBysYYCddzO5A7YmDJ5V7Z/MMIz/gU0xDr2q7jUm4fZNTmOqulrBrw1k5VMSi/EAD40jU9uySYiI=,iv:IhWPrNMBIikmL8ArHECLGiC6P3yeRHzC5Zqg05kaL5Y=,tag:91rG3qtfQbMmDsFget/X/g==,type:str]
pgp: []
- encrypted_regex: ^(data|stringData)$
+ encrypted_regex: ^(data|stringData|password)$
version: 3.7.3
diff --git a/apps/production/secrets/sliding-proxy-secret.yaml b/apps/production/secrets/sliding-proxy-secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: sliding-proxy-env
+ namespace: matrix
+type: Opaque
+stringData:
+ SYNCV3_SECRET: ENC[AES256_GCM,data:jfXXkjSTt3DsZz/1wZCr0/Y1WTLx5JP80KUaWNW7iNvXTugpVggnbOgIPzaMhs9jZ2607UMUW6hvRSYJNIaqOg==,iv:joQTFYr2cfAPEIlZF8iNG/JGFqEbm321n0YUwVbxFCA=,tag:W4dQHCq5zABSMVBP6S7Bcg==,type:str]
+ SYNCV3_DB: ENC[AES256_GCM,data:EW4Ver9pmZD4yS54PZjAbCnv2XwD5pzRTC8NyzrxyJuqezRuzPcLTW22BLJyTNMj3nWR9vH4E+avDZDX4DqaTGoOvZDKU0VqD0KHMMszPjem5pXrVi5bkMpiVc0+RrP8EtUxJ32FFXjJeP+rhX8F+3RKwCP8yVwA+ZUmPMO/mZNwdEpwB1qX7OzB1RJoYmOA0bHJ,iv:oBoDgPMGOPZkRgQHDJewxQHKMl13YfXHHMNP1uaRWtk=,tag:pI6+SMcMVJg8e7DX6Huwtg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0VU9QTHE1RVUwQzZPbDg1
+ T2dpd09TYmlSMkFodVpxMXJELzM1ZnZGNXhRCnNQa0xQYU1GaGpldG5vZjJTU1Vj
+ cCtnMFRHZ0lsOHR6Z2F6OGxOZDZQbmcKLS0tIFEzVTlJc2ZLbEY4V3cwWHl6TDla
+ ZlplenJoaEdOaiswRmtFWmgxMzZqNkUKJQDrT6/KQh+bddFVBERMkZ/E4SfzmZaz
+ HRfPyGDgVLzJg5sFUSSpZmivBQym+08lb/tA4YgxglTzHnM3CNzyKw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-04-02T17:17:04Z"
+ mac: ENC[AES256_GCM,data:bO9L85K/DVIXEF87WGB4Tl1OSrbSc7vkEz/BnW6z+TsJ3g1E1tGSrVZ+qvrIB6rtkcebUGC4PXMQARk2kKlVZbEoi4nE0TFCJIcwNN6nzLC8Cc0fi9w8QEEXw2A1cOfhi5jBG1S9FNSOOyaVwaAOsOBwNHltKE7qjvqZOLFDx5s=,iv:WaYyUgNGIRWWsW1vU08dxt37XCNUHGvwNKCajZC5yyQ=,tag:WOYmoeTnIpc9OhJGjIC6Fg==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData|password)$
+ version: 3.7.3
diff --git a/apps/production/sliding-proxy-ingress.yaml b/apps/production/sliding-proxy-ingress.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+ labels:
+ app: sliding-proxy-midnightthoughts
+ name: sliding-proxy-midnightthoughts-srv
+ namespace: matrix
+spec:
+ ports:
+ - port: 8888
+ selector:
+ app: sliding-proxy-midnightthoughts
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ name: sliding-proxy-midnightthoughts
+ namespace: matrix
+spec:
+ ingressClassName: traefik
+ rules:
+ - host: sliding.matrix.midnightthoughts.space
+ http:
+ paths:
+ - backend:
+ service:
+ name: sliding-proxy-midnightthoughts-srv
+ port:
+ number: 8888
+ path: /
+ pathType: Prefix
+ tls:
+ - hosts:
+ - sliding.matrix.midnightthoughts.space
+ secretName: sliding-proxy-midnightthoughts-tls-secret
diff --git a/apps/production/sliding-proxy-values.yaml b/apps/production/sliding-proxy-values.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: sliding-proxy-midnightthoughts
+ namespace: matrix
+spec:
+ template:
+ spec:
+ containers:
+ - name: sliding-proxy-midnightthoughts-container
+ env:
+ - name: SYNCV3_SERVER
+ value: "https://matrix.midnightthoughts.space"
diff --git a/infrastructure/controllers/image-updater.yaml b/infrastructure/controllers/image-updater.yaml
@@ -0,0 +1,26 @@
+
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImageUpdateAutomation
+metadata:
+ name: flux-system
+ namespace: flux-system
+spec:
+ interval: 1m0s
+ sourceRef:
+ kind: GitRepository
+ name: flux-system
+ git:
+ checkout:
+ ref:
+ branch: main
+ commit:
+ author:
+ email: fluxcdbot@users.noreply.gitea
+ name: fluxcdbot
+ messageTemplate: "{{range .Updated.Images}}{{println .}}{{end}}"
+ push:
+ branch: main
+ update:
+ path: ./
+ strategy: Setters
diff --git a/infrastructure/controllers/kustomization.yaml b/infrastructure/controllers/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
- metallb.yaml
- cert-manager.yaml
- weave-gitops.yaml
+ - image-updater.yaml
