release.yaml (20749B)
1 apiVersion: helm.toolkit.fluxcd.io/v2 2 kind: HelmRelease 3 metadata: 4 name: matrix-synapse 5 namespace: matrix 6 spec: 7 chart: 8 spec: 9 chart: matrix-synapse 10 sourceRef: 11 kind: HelmRepository 12 name: ananace-charts 13 version: 3.12.x 14 #chart: 15 # spec: 16 # chart: ./charts/matrix-synapse/ 17 # sourceRef: 18 # kind: GitRepository 19 # name: matrix-gateway-api 20 # namespace: matrix 21 interval: 120m 22 timeout: 2h 23 upgrade: 24 timeout: 2h 25 install: 26 timeout: 2h 27 remediation: 28 retries: 3 29 values: 30 signingkey: 31 job: 32 enabled: false 33 existingSecret: matrix-synapse-signingkey 34 existingSecretKey: signing.key 35 serverName: midnightthoughts.space 36 publicServerName: matrix.midnightthoughts.space 37 config: 38 extraMainListenerTypes: 39 - media 40 reportStats: true 41 enableRegistration: false 42 trustedKeyServers: 43 - server_name: matrix.org 44 wellknown: 45 enabled: true 46 client: 47 m.homeserver: 48 base_url: https://matrix.midnightthoughts.space 49 org.matrix.msc2965.authentication: 50 issuer: https://mas.matrix.midnightthoughts.space/ 51 account: https://mas.matrix.midnightthoughts.space/account/ 52 extraData: 53 support: 54 contacts: 55 - email_address: support@midnightthoughts.space 56 role: m.role.admin 57 image: 58 tag: v1.133.0 59 pullSecrets: 60 - name: ghcr-pull 61 extraConfig: 62 #notify_appservices_from_worker: appservices 63 enable_authenticated_media: true 64 stream_writers: 65 events: event_persister 66 run_background_tasks_on: background_worker 67 federation_sender_instances: 68 - federation-sender-1 69 pusher_instances: 70 - pusher-1 71 mau_stats_only: true 72 presence: 73 enabled: false 74 federation_metrics_domains: 75 - matrix.org 76 - t2bot.io 77 - t2l.io 78 - maunium.net 79 enable_media_repo: true 80 allow_public_rooms_without_auth: false 81 allow_public_rooms_over_federation: false 82 experimental_features: 83 msc2409_to_device_messages_enabled: true 84 msc3202_device_masquerading: true 85 msc3202_transaction_extensions: true 86 msc2716_enabled: true 87 msc3861: 88 enabled: true 89 issuer: https://mas.matrix.midnightthoughts.space/ 90 client_id: ENC[AES256_GCM,data:x2nGg799ROwak6N8chnHBi0gI7PKo832VmU=,iv:ubF4mi5rtOTEwJ8NgIFFiAyUCwqui/Oeu9t58IHXsbg=,tag:eWG+v2ak8r6Fo97owxsSrA==,type:str] 91 client_auth_method: client_secret_basic 92 client_secret: ENC[AES256_GCM,data:dPt+Gv8od5pOI07qW6Y5G019vFDmRy9ES8cBZbkefOv1Vk9dqEftoeAGeBoPxjR1Rhv3vjiNNxoy4zYkfs282Q==,iv:yvPSu2F0nzTwbUZWmXoIrNvGzFyxhDVCc73F9O41ik4=,tag:Ntnngh9UkRgEHHVjrT6mHg==,type:str] 93 admin_token: ENC[AES256_GCM,data:F1EX5GVojArw0wQLtbOpgTz4lgluarVPTpLjq2GENl0=,iv:mxyhJUC7A6WLJkFO7MtWxrCFbT6hp9YB9RqJYmlubVU=,tag:Y0WFFCzcftludevNpjY+tw==,type:str] 94 account_management_url: https://mas.matrix.midnightthoughts.space/account 95 app_service_config_files: 96 - /data/heisenbridge.yaml 97 - /data/meowlnir.yaml 98 event_cache_size: 30K 99 caches: 100 global_factor: 10 101 expire_caches: true 102 cache_entry_ttl: 1080m 103 sync_response_cache_duration: 2m 104 cache_autotuning: 105 max_cache_memory_usage: 4069M 106 target_cache_memory_usage: 2048M 107 min_cache_ttl: 5m 108 #modules: 109 # - module: matrix_invitee_server_blocker.InviteeServerBlocker 110 # config: 111 # broken_servers: 112 # #- matrix.org 113 # - matrix.im 114 # - funami.tech 115 # - suicideserver.net 116 # - cuteness-overdose.com 117 # - xmr.se 118 # #- module: synapse_rspamd.AntispamModule 119 # # config: 120 # # dry_run: true 121 # # required_score_threshold: 10 122 # # rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2 123 # # rspamd_password: ENC[AES256_GCM,data:oawyHMbChq7A,iv:PwIpJFtRpWVv7EIqssmdVRFJMKeIT03J9VNoD8LcGpU=,tag:MsYaPedvIxLKz2UiD8NS1Q==,type:str] 124 # # local_server_address: matrix.midnightthoughts.space 125 # # matrix_access_token: ENC[AES256_GCM,data:39s3mP9giCwVFslygyZuMIYwvQ9FRxlv2YYkwB5fuWdmQ0ATZ61NRDlx,iv:1ypgEQXrwzbJPkvc5oqFYdDz0JV4gQf6wflYN7yqHDQ=,tag:Dfui+n0hN8jgfr+f+slfjg==,type:str] 126 persistence: 127 enabled: true 128 size: 20Gi 129 existingClaim: matrix-synapse-v2 130 volumePermissions: 131 enabled: true 132 workers: 133 default: 134 podSecurityContext: 135 fsGroup: 666 136 runAsGroup: 666 137 runAsUser: 666 138 securityContext: 139 capabilities: 140 drop: 141 - ALL 142 readOnlyRootFilesystem: true 143 runAsNonRoot: true 144 runAsUser: 666 145 resources: 146 requests: 147 cpu: 100m 148 memory: 200Mi 149 limits: {} 150 volumes: 151 - name: matrix-org-blocker 152 emptyDir: {} 153 - name: synapse-rspamd 154 emptyDir: {} 155 - name: httpx 156 emptyDir: {} 157 - name: pip-cache 158 emptyDir: {} 159 - name: tmp 160 emptyDir: {} 161 - name: local 162 emptyDir: {} 163 - name: media-nonesense 164 emptyDir: {} 165 - name: configs 166 secret: 167 secretName: ENC[AES256_GCM,data:ypFdR6+wvfYFJ9Sh,iv:9ml7d8JTqvDlZF4Aukn7T5fMbOC9ENe8BmMb5QG0+So=,tag:lxk+auEHLrdhuArPHzf/Aw==,type:str] 168 - name: meowlnir-config 169 secret: 170 secretName: ENC[AES256_GCM,data:UfJJuKOUBvk=,iv:QfNQKvVNgL7lYOskP5xDzqhcXd8TQttn/PauUqobd0I=,tag:jjfhNItpkRJ9FD/t07P+mA==,type:str] 171 volumeMounts: 172 - name: matrix-org-blocker 173 mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker 174 - name: synapse-rspamd 175 mountPath: /usr/local/lib/python3.11/site-packages/synapse_rspamd 176 - name: httpx 177 mountPath: /usr/local/lib/python3.11/site-packages/httpx 178 - name: pip-cache 179 mountPath: /.cache/pip 180 - name: tmp 181 mountPath: /tmp 182 - name: local 183 mountPath: /.local 184 - name: media-nonesense 185 mountPath: /synapse/data 186 - name: configs 187 mountPath: /data/heisenbridge.yaml 188 subPath: heisenbridge.yaml 189 readOnly: true 190 - name: meowlnir-config 191 mountPath: /data/meowlnir.yaml 192 subPath: appservice.yaml 193 readOnly: true 194 extraCommands: [] 195 #- pip install --index-url https://MTRNord:6a34cfef990d89e6e081b64003dad6dc50d45ca4@codeberg.org/api/packages/MTRNord/pypi/simple/ matrix-invitee-server-blocker 196 #- pip install httpx 197 #- pip install --index-url https://codeberg.org/api/packages/MTRNord/pypi/simple/ synapse-rspamd 198 extraConfig: 199 #notify_appservices_from_worker: appservices 200 enable_authenticated_media: true 201 event_cache_size: 30K 202 caches: 203 global_factor: 10 204 expire_caches: true 205 cache_entry_ttl: 1080m 206 sync_response_cache_duration: 2m 207 cache_autotuning: 208 max_cache_memory_usage: 4069M 209 target_cache_memory_usage: 2048M 210 min_cache_ttl: 5m 211 #modules: 212 # - module: matrix_invitee_server_blocker.InviteeServerBlocker 213 # config: 214 # broken_servers: 215 # #- matrix.org 216 # - matrix.im 217 # - funami.tech 218 # - suicideserver.net 219 # #- module: synapse_rspamd.AntispamModule 220 # # config: 221 # # dry_run: true 222 # # required_score_threshold: 10 223 # # rspamd_url: http://rspamd-matrix.matrix.svc.cluster.local:11334/checkv2 224 # # rspamd_password: ENC[AES256_GCM,data:OZXUNW4g3AvV,iv:ZkNtB5dCnyDve0c9WI/E72YWqXyXtHFvnYAAf2TUz9Y=,tag:hYF/MwpEbtYMfOVe6zYlXg==,type:str] 225 # # local_server_address: matrix.midnightthoughts.space 226 # # matrix_access_token: ENC[AES256_GCM,data:MFfc6mlpCVg5KQH+ozXmTPFTX+0OjiIZjbn23cVS7SeqQuSqUhjkNxyy,iv:GUoRiYYAogBA4enHp/W+ZQvpkOyaixmd0hNm2gxp2o8=,tag:b6tDDnFpd/pYsrzXHEF0ig==,type:str] 227 federation_reader: 228 resources: 229 requests: 230 cpu: 100m 231 memory: 1026Mi 232 limits: {} 233 replicaCount: 0 234 enabled: true 235 generic: true 236 listeners: 237 - federation 238 paths: 239 - /_matrix/federation/v1/send/.* 240 - /_matrix/federation/v1/event/.* 241 - /_matrix/federation/v1/state/.* 242 - /_matrix/federation/v1/state_ids/.* 243 - /_matrix/federation/v1/backfill/.* 244 - /_matrix/federation/v1/get_missing_events/.* 245 - /_matrix/federation/v1/publicRooms.* 246 - /_matrix/federation/v1/query/.* 247 - /_matrix/federation/v1/make_join/.* 248 - /_matrix/federation/v1/make_leave/.* 249 - /_matrix/federation/(v1|v2)/send_join/.* 250 - /_matrix/federation/(v1|v2)/send_leave/.* 251 - /_matrix/federation/v1/make_knock/.* 252 - /_matrix/federation/v1/send_knock/.* 253 - /_matrix/federation/(v1|v2)/invite/.* 254 - /_matrix/federation/v1/event_auth/.* 255 - /_matrix/federation/v1/timestamp_to_event/.* 256 - /_matrix/federation/v1/exchange_third_party_invite/.* 257 - /_matrix/federation/v1/user/devices/.* 258 - /_matrix/key/v2/query.* 259 - /_matrix/federation/v1/hierarchy/.* 260 event_persister: 261 name: event_persister 262 replicaCount: 0 263 enabled: true 264 generic: true 265 listeners: 266 - replication 267 background_worker: 268 name: background_worker 269 replicaCount: 0 270 enabled: true 271 generic: true 272 generic_frontend: 273 resources: 274 requests: 275 cpu: 232m 276 memory: 1008Mi 277 limits: {} 278 replicaCount: 0 279 enabled: true 280 generic: true 281 listeners: 282 - client 283 csPaths: 284 # Sync requests 285 - /_matrix/client/(r0|v3)/sync$ 286 - /_matrix/client/(api/v1|r0|v3)/events$ 287 - /_matrix/client/(api/v1|r0|v3)/initialSync$ 288 - /_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ 289 # Client API requests 290 - /_matrix/client/(api/v1|r0|v3|unstable)/createRoom$ 291 - /_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$ 292 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$ 293 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$ 294 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$ 295 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$ 296 - /_matrix/client/v1/rooms/.*/hierarchy$ 297 - /_matrix/client/(v1|unstable)/rooms/.*/relations/.* 298 - /_matrix/client/v1/rooms/.*/threads$ 299 - /_matrix/client/unstable/im.nheko.summary/summary/.*$ 300 - /_matrix/client/(r0|v3|unstable)/account/3pid$ 301 - /_matrix/client/(r0|v3|unstable)/account/whoami$ 302 - /_matrix/client/(r0|v3|unstable)/devices$ 303 - /_matrix/client/versions$ 304 - /_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ 305 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/.* 306 - /_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ 307 - /_matrix/client/v1/rooms/.*/timestamp_to_event$ 308 - /_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases.* 309 - /_matrix/client/(api/v1|r0|v3|unstable)/search$ 310 - /_matrix/client/(r0|v3|unstable)/user/.*/filter(/.*|$) 311 - /_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ 312 - /_matrix/client/(r0|v3|unstable)/capabilities$ 313 - /_matrix/client/(r0|v3|unstable)/notifications$ 314 # Encryption requests 315 - /_matrix/client/(r0|v3|unstable)/keys/query$ 316 - /_matrix/client/(r0|v3|unstable)/keys/changes$ 317 - /_matrix/client/(r0|v3|unstable)/keys/claim$ 318 - /_matrix/client/(r0|v3|unstable)/room_keys/.* 319 - /_matrix/client/(r0|v3|unstable)/keys/upload/.* 320 # Registration/login requests are done by MAS. 321 # Event sending requests 322 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact.* 323 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send.* 324 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/.* 325 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ 326 - /_matrix/client/(api/v1|r0|v3|unstable)/join/.* 327 - /_matrix/client/(api/v1|r0|v3|unstable)/knock/.* 328 - /_matrix/client/(api/v1|r0|v3|unstable)/profile/.* 329 # # User directory search requests 330 - /_matrix/client/(r0|v3|unstable)/user_directory/search$ 331 # Worker event streams 332 # See https://matrix-org.github.io/synapse/latest/workers.html#stream-writers 333 # hopefully no stream 334 - ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events.* 335 # The pushrules event stream 336 # - ^/_matrix/client/(api/v1|r0|v3|unstable)/pushrules/ 337 # The account_data event stream 338 # - /_matrix/client/(r0|v3|unstable)/.*/tags 339 # - /_matrix/client/(r0|v3|unstable)/.*/account_data 340 # The receipts event stream 341 # - /_matrix/client/(r0|v3|unstable)/rooms/.*/receipt 342 # - /_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers 343 # The presence event stream 344 # - /_matrix/client/(api/v1|r0|v3|unstable)/presence/ 345 pusher: 346 labels: 347 synapse-component: pusher 348 name: pusher-1 349 enabled: true 350 generic: true 351 appservice: 352 enabled: false 353 name: appservices 354 generic: true 355 federation_sender_1: 356 labels: 357 synapse-component: federation-sender 358 name: federation-sender-1 359 enabled: true 360 generic: true 361 resources: 362 requests: 363 cpu: 300m 364 memory: 200Mi 365 limits: {} 366 synapse: 367 podSecurityContext: 368 fsGroup: 666 369 runAsGroup: 666 370 runAsUser: 666 371 securityContext: 372 capabilities: 373 drop: 374 - ALL 375 readOnlyRootFilesystem: true 376 runAsNonRoot: true 377 runAsUser: 666 378 resources: 379 requests: 380 cpu: 30m 381 memory: 800Mi 382 limits: {} 383 ## Liveness probe configuration to use 384 ## 385 livenessProbe: 386 timeoutSeconds: 60 387 failureThreshold: 5 388 httpGet: 389 path: /health 390 port: http 391 ## Readiness probe configuration to use 392 ## 393 readinessProbe: 394 timeoutSeconds: 60 395 failureThreshold: 5 396 httpGet: 397 path: /health 398 port: http 399 extraVolumes: 400 - name: matrix-org-blocker 401 emptyDir: {} 402 - name: synapse-rspamd 403 emptyDir: {} 404 - name: httpx 405 emptyDir: {} 406 - name: pip-cache 407 emptyDir: {} 408 - name: local 409 emptyDir: {} 410 - name: configs 411 secret: 412 secretName: ENC[AES256_GCM,data:RHjUkDXq0A5kZbRA,iv:dlxEo1fadEDNigoHr9Tqk/Zu+Q5bOQ74PywzO2PpoN4=,tag:xaijpRm11z5xdbGcyCWUkA==,type:str] 413 - name: meowlnir-config 414 secret: 415 secretName: ENC[AES256_GCM,data:8IhzjPq+BrQ=,iv:j0FAZOfiI+oT9BSEWBDKlRFClCz5Uw+mmDYPIN3Vo+Y=,tag:xYLFCZdF1/i8PqZbLtOhcA==,type:str] 416 extraVolumeMounts: 417 - name: matrix-org-blocker 418 mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker 419 - name: synapse-rspamd 420 mountPath: /usr/local/lib/python3.11/site-packages/synapse_rspamd 421 - name: httpx 422 mountPath: /usr/local/lib/python3.11/site-packages/httpx 423 - name: pip-cache 424 mountPath: /.cache/pip 425 - name: local 426 mountPath: /.local 427 - name: configs 428 mountPath: /data/heisenbridge.yaml 429 subPath: heisenbridge.yaml 430 readOnly: true 431 - name: meowlnir-config 432 mountPath: /data/meowlnir.yaml 433 subPath: appservice.yaml 434 readOnly: true 435 extraCommands: [] 436 #- pip install --index-url https://MTRNord:6a34cfef990d89e6e081b64003dad6dc50d45ca4@codeberg.org/api/packages/MTRNord/pypi/simple/ matrix-invitee-server-blocker 437 #- pip install httpx 438 #- pip install --index-url https://codeberg.org/api/packages/MTRNord/pypi/simple/ synapse-rspamd 439 annotations: 440 prometheus.io/scrape: "true" 441 prometheus.io/path: /_synapse/metrics 442 prometheus.io/port: "9090" 443 externalRedis: 444 host: matrix-synapse-keydb.matrix.svc.cluster.local 445 port: 6379 446 password: null 447 redis: 448 enabled: false 449 usePassword: false 450 password: null 451 auth: 452 enabled: false 453 password: null 454 postgresql: 455 enabled: false 456 externalPostgresql: 457 host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local 458 port: 5432 459 sslmode: require 460 username: synapse 461 database: synapse 462 password: ENC[AES256_GCM,data:icO9RBxBViEh6AkA87NSm0ouIDhzcX9oJaXWii1sGgq6l1DOLU75zdODrzEXsxnnZc1uKNBuTtNQF3XpVHOtDw==,iv:nEHLDaH0zihHMO/vSS74EtOoJKtDZTH9IadI4+9BDPk=,tag:vC+Bvl9tL8sk9hP1scrvtQ==,type:str] 463 gateway: 464 parentRefs: 465 - name: envoy-gateway 466 namespace: envoy-gateway 467 enabled: true 468 timeouts: 469 request: 60s 470 backendRequest: 60s 471 hosts: 472 - midnightthoughts.space 473 - matrix.midnightthoughts.space 474 csPaths: 475 - backendRefs: 476 - kind: Service 477 name: mas 478 port: 8080 479 matches: 480 - path: 481 type: RegularExpression 482 value: /_matrix/client/.*/(login|logout|refresh).* 483 - path: 484 type: RegularExpression 485 value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect 486 ingress: 487 enabled: false 488 sops: 489 kms: [] 490 gcp_kms: [] 491 azure_kv: [] 492 hc_vault: [] 493 age: 494 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 495 enc: | 496 -----BEGIN AGE ENCRYPTED FILE----- 497 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ZyszR1dPREwzRmZWdHNx 498 cEU5UFZKRUhIQkFONmVlczk0T2tDTXpxY1V3Cm1tMHdvRWduOEZncVAzT3Z5K0Jj 499 WFRzL3lId3BQd0FPL2tFZUxLN0ZEdXcKLS0tIDZzSTJJK1lEa2JJclgrUzRaNjVq 500 TEtpck9aVzdRN1IvZENOWng4SlRrR1UKnSlzvPdolygQM9k5nErNlzXkMcfzCwgY 501 khE4PJGiZD7FRQkh4wyDiMaRxhKne1Z/bA78pox+5mFTG6/Fl5PHeg== 502 -----END AGE ENCRYPTED FILE----- 503 lastmodified: "2025-05-12T09:23:36Z" 504 mac: ENC[AES256_GCM,data:R71A0wRXC2MXMuAiLl5ghZiYfDi3m4QWDfLHpNs+AhYYqqaAnK39pPCUDn0xZ4wIWeO//qnOs3bdusyTynlMFHzSo65NALpRFrfxx9sko5wk4cWjWNOTM/KCreD7D94DaCH1QpqIU9HtkLsBkYGfxLiKIbh7yUk5IuPEPaz5nW8=,iv:PZn53utalIC98SQqeRtbD3S5vdAeEqQsRMRGEo3/+3g=,tag:s78tBy23mPDE04zIgguPqg==,type:str] 505 pgp: [] 506 encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 507 version: 3.9.1