release.yaml (14998B)
1 apiVersion: helm.toolkit.fluxcd.io/v2 2 kind: HelmRelease 3 metadata: 4 name: draupnir-synapse 5 namespace: matrix 6 spec: 7 # chart: 8 # spec: 9 # chart: matrix-synapse 10 # sourceRef: 11 # kind: HelmRepository 12 # name: ananace-charts 13 # version: 3.11.x 14 chart: 15 spec: 16 chart: ./charts/matrix-synapse/ 17 sourceRef: 18 kind: GitRepository 19 name: matrix-gateway-api 20 namespace: matrix 21 interval: 60m 22 install: 23 remediation: 24 retries: 3 25 values: 26 extraConfig: 27 opentracing: 28 enabled: false 29 homeserver_whitelist: 30 - matrix.midnightthoughts.space 31 jaeger_config: 32 local_agent: 33 reporting_host: tempo.monitoring.svc.cluster.local 34 use_presence: false 35 app_service_config_files: 36 - /data/draupnir-registration.yaml 37 notify_appservices_from_worker: appservices 38 stream_writers: 39 events: event_persister 40 run_background_tasks_on: background_worker 41 presence: 42 enabled: false 43 federation_sender_instances: 44 - federation-sender-1 45 - federation-sender-2 46 event_cache_size: 10K 47 caches: 48 global_factor: 10 49 expire_caches: true 50 cache_entry_ttl: 240m 51 cache_autotuning: 52 max_cache_memory_usage: 2048M 53 target_cache_memory_usage: 1024M 54 min_cache_ttl: 5m 55 wellknown: 56 enabled: true 57 client: 58 m.homeserver: 59 base_url: https://matrix.draupnir.midnightthoughts.space 60 extraData: 61 support: 62 admins: 63 - email_address: support@midnightthoughts.space 64 role: admin 65 image: 66 tag: "v1.128.0" 67 pullSecrets: 68 - name: ghcr-pull 69 persistence: 70 size: 2Gi 71 existingClaim: draupnir-synapse-matrix-synapse-v2 72 volumePermissions: 73 enabled: true 74 workers: 75 default: 76 podSecurityContext: 77 fsGroup: 666 78 runAsGroup: 666 79 runAsUser: 666 80 securityContext: 81 capabilities: 82 drop: 83 - ALL 84 readOnlyRootFilesystem: true 85 runAsNonRoot: true 86 runAsUser: 666 87 volumeMounts: 88 - name: matrix-org-blocker 89 mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker 90 - name: pip-cache 91 mountPath: /.cache/pip 92 - name: tmp 93 mountPath: /tmp 94 - name: local 95 mountPath: /.local 96 - name: media-nonesense 97 mountPath: /synapse/data 98 - name: configs 99 mountPath: /data 100 readOnly: true 101 volumes: 102 - name: matrix-org-blocker 103 emptyDir: {} 104 - name: pip-cache 105 emptyDir: {} 106 - name: tmp 107 emptyDir: {} 108 - name: local 109 emptyDir: {} 110 - name: media-nonesense 111 emptyDir: {} 112 - name: configs 113 secret: 114 secretName: ENC[AES256_GCM,data:m7x2Z3oCmA6xIRqbkrccx91eNA==,iv:TsKqYTJLDiFtnH0TmLOsFLlwEdNg1r8hJYZdkhtWOGo=,tag:0SXGKKpLh0yUSHcqQ+aKcg==,type:str] 115 extraConfig: 116 opentracing: 117 enabled: false 118 homeserver_whitelist: 119 - matrix.midnightthoughts.space 120 jaeger_config: 121 local_agent: 122 reporting_host: tempo.monitoring.svc.cluster.local 123 notify_appservices_from_worker: appservices 124 event_cache_size: 30K 125 caches: 126 global_factor: 10 127 expire_caches: true 128 cache_entry_ttl: 1080m 129 sync_response_cache_duration: 2m 130 cache_autotuning: 131 max_cache_memory_usage: 4069M 132 target_cache_memory_usage: 2048M 133 min_cache_ttl: 5m 134 generic_frontend: 135 resources: 136 requests: 137 cpu: 101m 138 memory: 500Mi 139 limits: {} 140 replicaCount: 1 141 enabled: true 142 generic: true 143 listeners: 144 - client 145 csPaths: 146 # Sync requests 147 - /_matrix/client/(r0|v3)/sync$ 148 - /_matrix/client/(api/v1|r0|v3)/events$ 149 - /_matrix/client/(api/v1|r0|v3)/initialSync$ 150 - /_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ 151 # Client API requests 152 - /_matrix/client/(api/v1|r0|v3|unstable)/createRoom$ 153 - /_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$ 154 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$ 155 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$ 156 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$ 157 #- /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$ 158 - /_matrix/client/v1/rooms/.*/hierarchy$ 159 - /_matrix/client/(v1|unstable)/rooms/.*/relations/.* 160 - /_matrix/client/v1/rooms/.*/threads$ 161 - /_matrix/client/unstable/im.nheko.summary/summary/.*$ 162 - /_matrix/client/(r0|v3|unstable)/account/3pid$ 163 - /_matrix/client/(r0|v3|unstable)/account/whoami$ 164 - /_matrix/client/(r0|v3|unstable)/devices$ 165 - /_matrix/client/versions$ 166 - /_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ 167 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/.* 168 - /_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ 169 - /_matrix/client/v1/rooms/.*/timestamp_to_event$ 170 - /_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases.* 171 - /_matrix/client/(api/v1|r0|v3|unstable)/search$ 172 - /_matrix/client/(r0|v3|unstable)/user/.*/filter(/.*|$) 173 - /_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ 174 - /_matrix/client/(r0|v3|unstable)/capabilities$ 175 - /_matrix/client/(r0|v3|unstable)/notifications$ 176 # Encryption requests 177 - /_matrix/client/(r0|v3|unstable)/keys/query$ 178 - /_matrix/client/(r0|v3|unstable)/keys/changes$ 179 - /_matrix/client/(r0|v3|unstable)/keys/claim$ 180 - /_matrix/client/(r0|v3|unstable)/room_keys/.* 181 - /_matrix/client/(r0|v3|unstable)/keys/upload/.* 182 # Registration/login requests are done by MAS. 183 # Event sending requests 184 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact.* 185 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send.* 186 #- /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/.* 187 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ 188 - /_matrix/client/(api/v1|r0|v3|unstable)/join/.* 189 - /_matrix/client/(api/v1|r0|v3|unstable)/knock/.* 190 - /_matrix/client/(api/v1|r0|v3|unstable)/profile/.* 191 # # User directory search requests 192 - /_matrix/client/(r0|v3|unstable)/user_directory/search$ 193 # Worker event streams 194 # See https://matrix-org.github.io/synapse/latest/workers.html#stream-writers 195 # hopefully no stream 196 - ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events.* 197 # The pushrules event stream 198 # - ^/_matrix/client/(api/v1|r0|v3|unstable)/pushrules/ 199 # The account_data event stream 200 # - /_matrix/client/(r0|v3|unstable)/.*/tags 201 # - /_matrix/client/(r0|v3|unstable)/.*/account_data 202 # The receipts event stream 203 # - /_matrix/client/(r0|v3|unstable)/rooms/.*/receipt 204 # - /_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers 205 # The presence event stream 206 # - /_matrix/client/(api/v1|r0|v3|unstable)/presence/ 207 federation_reader: 208 resources: 209 requests: 210 cpu: 17m 211 memory: 153Mi 212 limits: {} 213 replicaCount: 1 214 enabled: true 215 generic: true 216 listeners: 217 - federation 218 paths: 219 - /_matrix/federation/v1/send/.* 220 - /_matrix/federation/v1/event/.* 221 - /_matrix/federation/v1/state/.* 222 - /_matrix/federation/v1/state_ids/.* 223 - /_matrix/federation/v1/backfill/.* 224 - /_matrix/federation/v1/get_missing_events/.* 225 - /_matrix/federation/v1/publicRooms.* 226 - /_matrix/federation/v1/query/.* 227 - /_matrix/federation/v1/make_join/.* 228 - /_matrix/federation/v1/make_leave/.* 229 - /_matrix/federation/(v1|v2)/send_join/.* 230 - /_matrix/federation/(v1|v2)/send_leave/.* 231 - /_matrix/federation/v1/make_knock/.* 232 - /_matrix/federation/v1/send_knock/.* 233 - /_matrix/federation/(v1|v2)/invite/.* 234 - /_matrix/federation/v1/event_auth/.* 235 - /_matrix/federation/v1/timestamp_to_event/.* 236 - /_matrix/federation/v1/exchange_third_party_invite/.* 237 - /_matrix/federation/v1/user/devices/.* 238 - /_matrix/key/v2/query.* 239 - /_matrix/federation/v1/hierarchy/.* 240 appservice: 241 resources: 242 requests: 243 cpu: 18m 244 memory: 120Mi 245 limits: {} 246 enabled: true 247 name: appservices 248 generic: true 249 federation_sender_1: 250 resources: 251 requests: 252 cpu: 24m 253 memory: 131Mi 254 limits: {} 255 labels: 256 synapse-component: federation-sender 257 name: federation-sender-1 258 enabled: true 259 generic: true 260 federation_sender_2: 261 resources: 262 requests: 263 cpu: 24m 264 memory: 131Mi 265 limits: {} 266 labels: 267 synapse-component: federation-sender 268 name: federation-sender-2 269 enabled: true 270 generic: true 271 background_worker: 272 resources: 273 requests: 274 cpu: 22m 275 memory: 116Mi 276 limits: {} 277 name: background_worker 278 replicaCount: 1 279 enabled: true 280 generic: true 281 event_persister: 282 resources: 283 requests: 284 cpu: 32m 285 memory: 201Mi 286 limits: {} 287 name: event_persister 288 replicaCount: 1 289 enabled: true 290 generic: true 291 listeners: 292 - replication 293 synapse: 294 podSecurityContext: 295 fsGroup: 666 296 runAsGroup: 666 297 runAsUser: 666 298 securityContext: 299 capabilities: 300 drop: 301 - ALL 302 readOnlyRootFilesystem: true 303 runAsNonRoot: true 304 runAsUser: 666 305 resources: 306 requests: 307 cpu: 14m 308 memory: 150Mi 309 limits: {} 310 extraVolumeMounts: 311 - name: configs 312 mountPath: /data 313 readOnly: true 314 - name: matrix-org-blocker 315 mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker 316 - name: pip-cache 317 mountPath: /.cache/pip 318 - name: local 319 mountPath: /.local 320 extraVolumes: 321 - name: matrix-org-blocker 322 emptyDir: {} 323 - name: pip-cache 324 emptyDir: {} 325 - name: local 326 emptyDir: {} 327 - name: configs 328 secret: 329 secretName: ENC[AES256_GCM,data:aVOK2h6KTIKNX8Ypa+AF2UOITA==,iv:PIyZ94Tfr84QUqut2oFu09bYRGwJiKpEpfBmWtQZNXE=,tag:QZflZ3hovkN5a1Bs5S4oMg==,type:str] 330 ## Liveness probe configuration to use 331 ## 332 livenessProbe: 333 timeoutSeconds: 60 334 failureThreshold: 5 335 httpGet: 336 path: /health 337 port: http 338 ## Readiness probe configuration to use 339 ## 340 readinessProbe: 341 timeoutSeconds: 60 342 failureThreshold: 5 343 httpGet: 344 path: /health 345 port: http 346 extraCommands: [] 347 annotations: 348 prometheus.io/scrape: "true" 349 prometheus.io/path: /_synapse/metrics 350 prometheus.io/port: "9090" 351 externalRedis: 352 host: draupnir-synapse-keydb.matrix.svc.cluster.local 353 port: 6379 354 password: null 355 redis: 356 enabled: false 357 usePassword: false 358 password: null 359 auth: 360 enabled: false 361 password: null 362 postgresql: 363 enabled: false 364 externalPostgresql: 365 host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local 366 port: 5432 367 sslmode: require 368 database: draupnir_synapse 369 username: draupnir_synapse 370 password: ENC[AES256_GCM,data:AKyUY8U2Yv4P9eGE35GeinMk2mutkhmqJtD2LbyNXY1FczzC82m4oguktEouOsrdCmPTugokdzQuDB/VODsAwQ==,iv:An2J8dC74tnGFq1zrTho0SeSjrIJxsF2wZjIJiiAnAs=,tag:WaWLRBU8xzsmOgcm4g8kYA==,type:str] 371 signingkey: 372 job: 373 enabled: false 374 serverName: draupnir.midnightthoughts.space 375 publicServerName: matrix.draupnir.midnightthoughts.space 376 config: 377 reportStats: true 378 enableRegistration: false 379 extraMainListenerTypes: 380 - media 381 gateway: 382 parentRefs: 383 - name: envoy-gateway 384 namespace: envoy-gateway 385 enabled: true 386 timeouts: 387 request: 60s 388 backendRequest: 60s 389 hosts: 390 - draupnir.midnightthoughts.space 391 - matrix.draupnir.midnightthoughts.space 392 ingress: 393 enabled: false 394 sops: 395 kms: [] 396 gcp_kms: [] 397 azure_kv: [] 398 hc_vault: [] 399 age: 400 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 401 enc: | 402 -----BEGIN AGE ENCRYPTED FILE----- 403 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dFpjM1lmcllpR0RKdXdv 404 bTAydDBWbVRoRXhDUjRwc0FxcjdNU1VNalNJCjcwWE9mQnUydU9QdGZNVWRvSk5k 405 NWRiY1diZy9XRkgxaEgycVp5ZHgyQlkKLS0tIFNtbFJRdm5lMklZUS9FL0xrMW5F 406 RUwrQmhKTlRLVjk3QlRxQ3pUb3pEMHcKRT/WEzTcOmlzlvMT5ddT82d8inRAgvyQ 407 qom+xJO9SM2jcej4kl+0cMJ8zqsrXmw7PukTLjKXOh6egmw+p6qMpQ== 408 -----END AGE ENCRYPTED FILE----- 409 lastmodified: "2025-01-18T16:41:05Z" 410 mac: ENC[AES256_GCM,data:bejkU903B5B+O8+zzTa0Rypwfq29N94yWBw9/kOf/XByJZYdsCtC6kYX6G/QLwPRRvKuONYEozAxqFbiTqkR1NVyzqDf8Oj+KEXtQBf3P0SY334yCmaeajHLlKm6kanD5NnpVSmX3BcuVfTGwQK3jZ+Kab+cDNu4/AGqw+6Vnxg=,iv:vg1mrpIUNny4WqqS666kM4yvZpI0TuL7ViSP+ib7HVM=,tag:JF0OdVZino0cP0+Bmx+slw==,type:str] 411 pgp: [] 412 encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 413 version: 3.9.1