--- apiVersion: apps/v1 kind: Deployment metadata: name: {{ .Release.Name }}-jabber spec: selector: matchLabels: app: {{ .Release.Name }}-jabber replicas: 1 template: metadata: labels: app: {{ .Release.Name }}-jabber use-as-service: {{ .Release.Name }} spec: initContainers: - name: generate-jabber-signing-key image: ungleich/ungleich-jabber-synapse:{{ .Values.synapseVersion }} imagePullPolicy: Always command: - "python" - "-m" - "synapse.app.homeserver" - "--config-path" - "/baseconfig" - "--keys-directory" - "/data" - "--generate-keys" volumeMounts: - name: data mountPath: "/data" - name: jabber-config mountPath: "/baseconfig" containers: - name: certbot image: ungleich/ungleich-certbot imagePullPolicy: Always ports: - containerPort: 80 env: - name: DOMAIN value: "{{ tpl .Values.fqdn . }}" - name: EMAIL value: "{{ .Values.email }}" {{ if eq .Values.letsencryptStaging "no" }} - name: STAGING value: "no" {{ end }} volumeMounts: - name: etcletsencrypt mountPath: "/etc/letsencrypt" # This container will only start *after* the cert has been placed - name: debug image: alpine:latest volumeMounts: - name: nginx-config mountPath: "/etc/nginx/conf.d/" - name: etcletsencrypt mountPath: "/etc/letsencrypt" - name: data mountPath: "/data" - name: jabber-config mountPath: "/baseconfig" - name: postgres-vars mountPath: "/postgres" args: - sleep - "1000000" - name: nginx image: nginx:1.21-alpine ports: - containerPort: 443 volumeMounts: - name: nginx-config mountPath: "/etc/nginx/conf.d/" - name: etcletsencrypt mountPath: "/etc/letsencrypt" - name: postgres image: postgres:13 ports: - containerPort: 5432 envFrom: - secretRef: name: {{ tpl .Values.identifier . }}-postgres-config volumeMounts: - name: postgres-data mountPath: "/var/lib/postgresql/data" # Use subpath to avoid lost+found error subPath: postgres - name: jabber # SYNAPSE_CONFIG_DIR: where additional configs are placed -> postgres-db.yaml # SYNAPSE_CONFIG_PATH: the initial config # log.yaml -> same dir as postgres-db.yaml # /data = persistent storage image: ungleich/ungleich-jabber-synapse:{{ .Values.synapseVersion }} imagePullPolicy: Always ports: - containerPort: 8008 env: - name: SYNAPSE_CONFIG_PATH value: "/baseconfig/homeserver.yaml" - name: SYNAPSE_CONFIG_DIR value: "/config" volumeMounts: - name: data mountPath: "/data" - name: jabber-config mountPath: "/baseconfig" volumes: - name: etcletsencrypt persistentVolumeClaim: claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs - name: data persistentVolumeClaim: claimName: {{ tpl .Values.identifier . }}-data - name: postgres-data persistentVolumeClaim: claimName: {{ tpl .Values.identifier . }}-postgres-data - name: postgres-vars secret: secretName: {{ tpl .Values.identifier . }}-postgres-config - name: nginx-config configMap: name: {{ tpl .Values.identifier . }}-nginx-config - name: jabber-config configMap: name: {{ tpl .Values.identifier . }}-jabber-config items: - key: homeserver.yaml path: homeserver.yaml - key: log.yaml path: log.yaml --- apiVersion: v1 kind: Service metadata: name: {{ tpl .Values.identifier . }} labels: app: {{ tpl .Values.identifier . }} spec: type: ClusterIP ports: # Required for letsencrypt - port: 80 name: http - port: 443 name: https selector: use-as-service: {{ .Release.Name }} --- apiVersion: v1 kind: Service metadata: name: {{ tpl .Values.identifier . }}-web labels: app: {{ tpl .Values.identifier . }}-web spec: type: ClusterIP ports: # Required for letsencrypt - port: 80 name: http - port: 443 name: https selector: use-as-service: {{ .Release.Name }}-web --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: {{ tpl .Values.identifier . }}-letsencrypt-certs spec: accessModes: - ReadWriteMany resources: requests: storage: 50Mi storageClassName: rook-cephfs --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: {{ tpl .Values.identifier . }}-data spec: accessModes: - ReadWriteMany resources: requests: storage: 1Gi storageClassName: rook-cephfs --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: {{ tpl .Values.identifier . }}-postgres-data spec: accessModes: - ReadWriteOnce resources: requests: storage: 500Mi storageClassName: rook-ceph-block --- # apiVersion: batch/v1 # kind: Job # metadata: # name: {{ tpl .Values.identifier . }}-getcert # spec: # template: # metadata: # labels: # app: certbot-letsencrypt-getcert # use-as-service: {{ .Release.Name }} # spec: # restartPolicy: Never # containers: # - name: certbot # image: ungleich/ungleich-certbot # ports: # - containerPort: 80 # env: # - name: DOMAIN # value: "{{ tpl .Values.fqdn . }}" # - name: EMAIL # value: "{{ .Values.email }}" # {{ if eq .Values.letsencryptStaging "no" }} # - name: STAGING # value: "no" # {{ end }} # volumeMounts: # - name: etcletsencrypt # mountPath: "/etc/letsencrypt" # volumes: # - name: etcletsencrypt # persistentVolumeClaim: # claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs # backoffLimit: 3 #--- apiVersion: v1 kind: ConfigMap metadata: name: {{ tpl .Values.identifier . }}-nginx-config data: default.conf: | server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name {{ tpl .Values.fqdn . }}; ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem; client_max_body_size {{ .Values.max_filesize_in_mb }}m; location ~ /_jabber|/_synapse { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://localhost:8008; } } --- apiVersion: v1 kind: Secret metadata: name: {{ tpl .Values.identifier . }}-postgres-config annotations: secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD stringData: POSTGRES_USER: "jabber-synapse" POSTGRES_DB: "jabber-synapse" POSTGRES_HOST: "localhost" --- apiVersion: v1 kind: ConfigMap metadata: name: {{ tpl .Values.identifier . }}-jabber-config data: homeserver.yaml: | server_name: "{{ .Values.server_name }}" web_client_location: "{{ .Values.web_client_location }}" public_baseurl: "{{ tpl .Values.fqdn . }}" allow_public_rooms_without_auth: true allow_public_rooms_over_federation: false pid_file: "/var/run/jabber/homeserver.pid" report_stats: false signing_key_path: "/data/signin.key" listeners: - port: 8008 tls: false type: http x_forwarded: true bind_addresses: - '::1' - '127.0.0.1' resources: - names: [federation,client] compress: false - port: 9093 bind_addresses: - '::1' - '127.0.0.1' type: http resources: - names: [replication] database: name: "psycopg2" args: database: "jabber-synapse" host: "localhost" user: "jabber-synapse" password: "" cp_min: 10 cp_min: 5 log_config: "/baseconfig/log.yaml" enable_media_repo: true media_store_path: "/data/media" max_upload_size: "{{ .Values.max_filesize_in_mb }}M" enable_registration: {{ .Values.enable_registration }} log.yaml: | version: 1 formatters: fmt: format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s' filters: context: (): synapse.logging.context.LoggingContextFilter request: "" handlers: console: class: logging.StreamHandler formatter: fmt filters: [context] root: level: INFO handlers: [console] # to use file handler instead, switch to [file] loggers: synapse: level: INFO synapse.storage.SQL: level: INFO # example of enabling debugging for a component: # # synapse.federation.transport.server: # level: DEBUG