release.yaml (14797B)
1 apiVersion: helm.toolkit.fluxcd.io/v2 2 kind: HelmRelease 3 metadata: 4 name: draupnir-synapse 5 namespace: matrix 6 spec: 7 chart: 8 spec: 9 chart: matrix-synapse 10 sourceRef: 11 kind: HelmRepository 12 name: ananace-charts 13 version: 3.12.x 14 interval: 60m 15 install: 16 remediation: 17 retries: 3 18 values: 19 extraConfig: 20 opentracing: 21 enabled: false 22 homeserver_whitelist: 23 - matrix.midnightthoughts.space 24 jaeger_config: 25 local_agent: 26 reporting_host: tempo.monitoring.svc.cluster.local 27 use_presence: false 28 app_service_config_files: 29 - /data/draupnir-registration.yaml 30 notify_appservices_from_worker: appservices 31 stream_writers: 32 events: event_persister 33 run_background_tasks_on: background_worker 34 presence: 35 enabled: false 36 federation_sender_instances: 37 - federation-sender-1 38 - federation-sender-2 39 event_cache_size: 10K 40 caches: 41 global_factor: 10 42 expire_caches: true 43 cache_entry_ttl: 240m 44 cache_autotuning: 45 max_cache_memory_usage: 2048M 46 target_cache_memory_usage: 1024M 47 min_cache_ttl: 5m 48 wellknown: 49 enabled: true 50 client: 51 m.homeserver: 52 base_url: https://matrix.draupnir.midnightthoughts.space 53 extraData: 54 support: 55 admins: 56 - email_address: support@midnightthoughts.space 57 role: admin 58 image: 59 tag: "v1.140.0" 60 pullSecrets: 61 - name: ghcr-pull 62 persistence: 63 size: 2Gi 64 existingClaim: draupnir-synapse-matrix-synapse-v2 65 volumePermissions: 66 enabled: true 67 workers: 68 default: 69 podSecurityContext: 70 fsGroup: 666 71 runAsGroup: 666 72 runAsUser: 666 73 securityContext: 74 capabilities: 75 drop: 76 - ALL 77 readOnlyRootFilesystem: true 78 runAsNonRoot: true 79 runAsUser: 666 80 volumeMounts: 81 - name: matrix-org-blocker 82 mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker 83 - name: pip-cache 84 mountPath: /.cache/pip 85 - name: tmp 86 mountPath: /tmp 87 - name: local 88 mountPath: /.local 89 - name: media-nonesense 90 mountPath: /synapse/data 91 - name: configs 92 mountPath: /data 93 readOnly: true 94 volumes: 95 - name: matrix-org-blocker 96 emptyDir: {} 97 - name: pip-cache 98 emptyDir: {} 99 - name: tmp 100 emptyDir: {} 101 - name: local 102 emptyDir: {} 103 - name: media-nonesense 104 emptyDir: {} 105 - name: configs 106 secret: 107 secretName: ENC[AES256_GCM,data:m7x2Z3oCmA6xIRqbkrccx91eNA==,iv:TsKqYTJLDiFtnH0TmLOsFLlwEdNg1r8hJYZdkhtWOGo=,tag:0SXGKKpLh0yUSHcqQ+aKcg==,type:str] 108 extraConfig: 109 opentracing: 110 enabled: false 111 homeserver_whitelist: 112 - matrix.midnightthoughts.space 113 jaeger_config: 114 local_agent: 115 reporting_host: tempo.monitoring.svc.cluster.local 116 notify_appservices_from_worker: appservices 117 event_cache_size: 30K 118 caches: 119 global_factor: 10 120 expire_caches: true 121 cache_entry_ttl: 1080m 122 sync_response_cache_duration: 2m 123 cache_autotuning: 124 max_cache_memory_usage: 4069M 125 target_cache_memory_usage: 2048M 126 min_cache_ttl: 5m 127 generic_frontend: 128 resources: 129 requests: 130 cpu: 101m 131 memory: 500Mi 132 limits: {} 133 replicaCount: 1 134 enabled: true 135 generic: true 136 listeners: 137 - client 138 csPaths: 139 # Sync requests 140 - /_matrix/client/(r0|v3)/sync$ 141 - /_matrix/client/(api/v1|r0|v3)/events$ 142 - /_matrix/client/(api/v1|r0|v3)/initialSync$ 143 - /_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ 144 # Client API requests 145 - /_matrix/client/(api/v1|r0|v3|unstable)/createRoom$ 146 - /_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$ 147 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$ 148 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$ 149 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$ 150 #- /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$ 151 - /_matrix/client/v1/rooms/.*/hierarchy$ 152 - /_matrix/client/(v1|unstable)/rooms/.*/relations/.* 153 - /_matrix/client/v1/rooms/.*/threads$ 154 - /_matrix/client/unstable/im.nheko.summary/summary/.*$ 155 - /_matrix/client/(r0|v3|unstable)/account/3pid$ 156 - /_matrix/client/(r0|v3|unstable)/account/whoami$ 157 - /_matrix/client/(r0|v3|unstable)/devices$ 158 - /_matrix/client/versions$ 159 - /_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ 160 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/.* 161 - /_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ 162 - /_matrix/client/v1/rooms/.*/timestamp_to_event$ 163 - /_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases.* 164 - /_matrix/client/(api/v1|r0|v3|unstable)/search$ 165 - /_matrix/client/(r0|v3|unstable)/user/.*/filter(/.*|$) 166 - /_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ 167 - /_matrix/client/(r0|v3|unstable)/capabilities$ 168 - /_matrix/client/(r0|v3|unstable)/notifications$ 169 # Encryption requests 170 - /_matrix/client/(r0|v3|unstable)/keys/query$ 171 - /_matrix/client/(r0|v3|unstable)/keys/changes$ 172 - /_matrix/client/(r0|v3|unstable)/keys/claim$ 173 - /_matrix/client/(r0|v3|unstable)/room_keys/.* 174 - /_matrix/client/(r0|v3|unstable)/keys/upload/.* 175 # Registration/login requests are done by MAS. 176 # Event sending requests 177 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact.* 178 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send.* 179 #- /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/.* 180 - /_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ 181 - /_matrix/client/(api/v1|r0|v3|unstable)/join/.* 182 - /_matrix/client/(api/v1|r0|v3|unstable)/knock/.* 183 - /_matrix/client/(api/v1|r0|v3|unstable)/profile/.* 184 # # User directory search requests 185 - /_matrix/client/(r0|v3|unstable)/user_directory/search$ 186 # Worker event streams 187 # See https://matrix-org.github.io/synapse/latest/workers.html#stream-writers 188 # hopefully no stream 189 - ^/_matrix/client/unstable/org.matrix.msc4140/delayed_events.* 190 # The pushrules event stream 191 # - ^/_matrix/client/(api/v1|r0|v3|unstable)/pushrules/ 192 # The account_data event stream 193 # - /_matrix/client/(r0|v3|unstable)/.*/tags 194 # - /_matrix/client/(r0|v3|unstable)/.*/account_data 195 # The receipts event stream 196 # - /_matrix/client/(r0|v3|unstable)/rooms/.*/receipt 197 # - /_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers 198 # The presence event stream 199 # - /_matrix/client/(api/v1|r0|v3|unstable)/presence/ 200 federation_reader: 201 resources: 202 requests: 203 cpu: 17m 204 memory: 153Mi 205 limits: {} 206 replicaCount: 1 207 enabled: true 208 generic: true 209 listeners: 210 - federation 211 paths: 212 - /_matrix/federation/v1/send/.* 213 - /_matrix/federation/v1/event/.* 214 - /_matrix/federation/v1/state/.* 215 - /_matrix/federation/v1/state_ids/.* 216 - /_matrix/federation/v1/backfill/.* 217 - /_matrix/federation/v1/get_missing_events/.* 218 - /_matrix/federation/v1/publicRooms.* 219 - /_matrix/federation/v1/query/.* 220 - /_matrix/federation/v1/make_join/.* 221 - /_matrix/federation/v1/make_leave/.* 222 - /_matrix/federation/(v1|v2)/send_join/.* 223 - /_matrix/federation/(v1|v2)/send_leave/.* 224 - /_matrix/federation/v1/make_knock/.* 225 - /_matrix/federation/v1/send_knock/.* 226 - /_matrix/federation/(v1|v2)/invite/.* 227 - /_matrix/federation/v1/event_auth/.* 228 - /_matrix/federation/v1/timestamp_to_event/.* 229 - /_matrix/federation/v1/exchange_third_party_invite/.* 230 - /_matrix/federation/v1/user/devices/.* 231 - /_matrix/key/v2/query.* 232 - /_matrix/federation/v1/hierarchy/.* 233 appservice: 234 resources: 235 requests: 236 cpu: 18m 237 memory: 120Mi 238 limits: {} 239 enabled: true 240 name: appservices 241 generic: true 242 federation_sender_1: 243 resources: 244 requests: 245 cpu: 24m 246 memory: 131Mi 247 limits: {} 248 labels: 249 synapse-component: federation-sender 250 name: federation-sender-1 251 enabled: true 252 generic: true 253 federation_sender_2: 254 resources: 255 requests: 256 cpu: 24m 257 memory: 131Mi 258 limits: {} 259 labels: 260 synapse-component: federation-sender 261 name: federation-sender-2 262 enabled: true 263 generic: true 264 background_worker: 265 resources: 266 requests: 267 cpu: 22m 268 memory: 116Mi 269 limits: {} 270 name: background_worker 271 replicaCount: 1 272 enabled: true 273 generic: true 274 event_persister: 275 resources: 276 requests: 277 cpu: 32m 278 memory: 201Mi 279 limits: {} 280 name: event_persister 281 replicaCount: 1 282 enabled: true 283 generic: true 284 listeners: 285 - replication 286 synapse: 287 podSecurityContext: 288 fsGroup: 666 289 runAsGroup: 666 290 runAsUser: 666 291 securityContext: 292 capabilities: 293 drop: 294 - ALL 295 readOnlyRootFilesystem: true 296 runAsNonRoot: true 297 runAsUser: 666 298 resources: 299 requests: 300 cpu: 14m 301 memory: 150Mi 302 limits: {} 303 extraVolumeMounts: 304 - name: configs 305 mountPath: /data 306 readOnly: true 307 - name: matrix-org-blocker 308 mountPath: /usr/local/lib/python3.11/site-packages/matrix_invitee_server_blocker 309 - name: pip-cache 310 mountPath: /.cache/pip 311 - name: local 312 mountPath: /.local 313 extraVolumes: 314 - name: matrix-org-blocker 315 emptyDir: {} 316 - name: pip-cache 317 emptyDir: {} 318 - name: local 319 emptyDir: {} 320 - name: configs 321 secret: 322 secretName: ENC[AES256_GCM,data:aVOK2h6KTIKNX8Ypa+AF2UOITA==,iv:PIyZ94Tfr84QUqut2oFu09bYRGwJiKpEpfBmWtQZNXE=,tag:QZflZ3hovkN5a1Bs5S4oMg==,type:str] 323 ## Liveness probe configuration to use 324 ## 325 livenessProbe: 326 timeoutSeconds: 60 327 failureThreshold: 5 328 httpGet: 329 path: /health 330 port: http 331 ## Readiness probe configuration to use 332 ## 333 readinessProbe: 334 timeoutSeconds: 60 335 failureThreshold: 5 336 httpGet: 337 path: /health 338 port: http 339 extraCommands: [] 340 annotations: 341 prometheus.io/scrape: "true" 342 prometheus.io/path: /_synapse/metrics 343 prometheus.io/port: "9090" 344 externalRedis: 345 host: draupnir-synapse-keydb.matrix.svc.cluster.local 346 port: 6379 347 password: null 348 redis: 349 enabled: false 350 usePassword: false 351 password: null 352 auth: 353 enabled: false 354 password: null 355 postgresql: 356 enabled: false 357 externalPostgresql: 358 host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local 359 port: 5432 360 sslmode: require 361 database: draupnir_synapse 362 username: draupnir_synapse 363 password: ENC[AES256_GCM,data:AKyUY8U2Yv4P9eGE35GeinMk2mutkhmqJtD2LbyNXY1FczzC82m4oguktEouOsrdCmPTugokdzQuDB/VODsAwQ==,iv:An2J8dC74tnGFq1zrTho0SeSjrIJxsF2wZjIJiiAnAs=,tag:WaWLRBU8xzsmOgcm4g8kYA==,type:str] 364 signingkey: 365 job: 366 enabled: false 367 serverName: draupnir.midnightthoughts.space 368 publicServerName: matrix.draupnir.midnightthoughts.space 369 config: 370 reportStats: true 371 enableRegistration: false 372 extraMainListenerTypes: 373 - media 374 gateway: 375 parentRefs: 376 - name: envoy-gateway 377 namespace: envoy-gateway 378 enabled: true 379 timeouts: 380 request: 60s 381 backendRequest: 60s 382 hosts: 383 - draupnir.midnightthoughts.space 384 - matrix.draupnir.midnightthoughts.space 385 ingress: 386 enabled: false 387 sops: 388 kms: [] 389 gcp_kms: [] 390 azure_kv: [] 391 hc_vault: [] 392 age: 393 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 394 enc: | 395 -----BEGIN AGE ENCRYPTED FILE----- 396 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dFpjM1lmcllpR0RKdXdv 397 bTAydDBWbVRoRXhDUjRwc0FxcjdNU1VNalNJCjcwWE9mQnUydU9QdGZNVWRvSk5k 398 NWRiY1diZy9XRkgxaEgycVp5ZHgyQlkKLS0tIFNtbFJRdm5lMklZUS9FL0xrMW5F 399 RUwrQmhKTlRLVjk3QlRxQ3pUb3pEMHcKRT/WEzTcOmlzlvMT5ddT82d8inRAgvyQ 400 qom+xJO9SM2jcej4kl+0cMJ8zqsrXmw7PukTLjKXOh6egmw+p6qMpQ== 401 -----END AGE ENCRYPTED FILE----- 402 lastmodified: "2025-01-18T16:41:05Z" 403 mac: ENC[AES256_GCM,data:bejkU903B5B+O8+zzTa0Rypwfq29N94yWBw9/kOf/XByJZYdsCtC6kYX6G/QLwPRRvKuONYEozAxqFbiTqkR1NVyzqDf8Oj+KEXtQBf3P0SY334yCmaeajHLlKm6kanD5NnpVSmX3BcuVfTGwQK3jZ+Kab+cDNu4/AGqw+6Vnxg=,iv:vg1mrpIUNny4WqqS666kM4yvZpI0TuL7ViSP+ib7HVM=,tag:JF0OdVZino0cP0+Bmx+slw==,type:str] 404 pgp: [] 405 encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 406 version: 3.9.1