ungleich-k8s/apps/matrix/templates/deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-matrix
spec:
  selector:
    matchLabels:
      app: {{ .Release.Name }}-matrix
  replicas: 1
  template:
    metadata:
      labels:
        app: {{ .Release.Name }}-matrix
        use-as-service: {{ .Release.Name }}
    spec:
      initContainers:
        # - name: wait-for-cert
        #   image: busybox
        #   command:
        #     - sh
        #     - -c
        #     - until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 2; done
        #   volumeMounts:
        #     - name: etcletsencrypt
        #       mountPath: "/etc/letsencrypt"
        - name: generate-matrix-signing-key
          image: ungleich/ungleich-matrix-synapse:{{ .Values.synapseVersion }}
          command:
            - "python"
            - "-m"
            - "synapse.app.homeserver"
            - "--config-path"
            - "/baseconfig"
            - "--keys-directory"
            - "/data"
            - "--generate-keys"
          volumeMounts:
            - name: data
              mountPath: "/data"
            - name: matrix-config
              mountPath: "/baseconfig"
      containers:
        - name: certbot
          image: ungleich/ungleich-certbot
          ports:
            - containerPort: 80
          env:
          - name: DOMAIN
            value: "{{ tpl .Values.fqdn . }}"
          - name: EMAIL
            value: "{{ .Values.email }}"
          {{ if eq .Values.letsencryptStaging "no" }}
          - name: STAGING
            value: "no"
          {{ end }}
        volumeMounts:
          - name: etcletsencrypt
            mountPath: "/etc/letsencrypt"
        # This container will only start *after* the cert has been placed
        - name: debug
          image: alpine:latest
          volumeMounts:
            - name: nginx-config
              mountPath: "/etc/nginx/conf.d/"
            - name: etcletsencrypt
              mountPath: "/etc/letsencrypt"
            - name: data
              mountPath: "/data"
            - name: matrix-config
              mountPath: "/baseconfig"
            - name: postgres-vars
              mountPath: "/postgres"
          args:
            - sleep
            - "1000000"
        - name: nginx
          image: nginx:1.21-alpine
          ports:
            - containerPort: 443
          volumeMounts:
            - name: nginx-config
              mountPath: "/etc/nginx/conf.d/"
            - name: etcletsencrypt
              mountPath: "/etc/letsencrypt"
        - name: postgres
          image: postgres:13
          ports:
            - containerPort: 5432
          envFrom:
          - secretRef:
              name: {{ tpl .Values.identifier . }}-postgres-config
          volumeMounts:
            - name: postgres-data
              mountPath: "/var/lib/postgresql/data"
              # Use subpath to avoid lost+found error
              subPath: postgres
        - name: matrix
          # SYNAPSE_CONFIG_DIR: where additional configs are placed -> postgres-db.yaml
          # SYNAPSE_CONFIG_PATH: the initial config
          # log.yaml -> same dir as postgres-db.yaml
          # /data = persistent storage
          image: ungleich/ungleich-matrix-synapse:{{ .Values.synapseVersion }}
          ports:
            - containerPort: 8008
          env:
            - name: SYNAPSE_CONFIG_PATH
              value: "/baseconfig/homeserver.yaml"
            - name: SYNAPSE_CONFIG_DIR
              value: "/config"

          volumeMounts:
            - name: data
              mountPath: "/data"
            - name: matrix-config
              mountPath: "/baseconfig"
      volumes:
        - name: etcletsencrypt
          persistentVolumeClaim:
            claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
        - name: data
          persistentVolumeClaim:
            claimName: {{ tpl .Values.identifier . }}-data
        - name: postgres-data
          persistentVolumeClaim:
            claimName: {{ tpl .Values.identifier . }}-postgres-data
        - name: postgres-vars
          secret:
            secretName: {{ tpl .Values.identifier . }}-postgres-config
        - name: nginx-config
          configMap:
            name: {{ tpl .Values.identifier . }}-nginx-config
        - name: matrix-config
          configMap:
            name: {{ tpl .Values.identifier . }}-matrix-config
            items:
              - key: homeserver.yaml
                path: homeserver.yaml
              - key: log.yaml
                path: log.yaml

---
apiVersion: v1
kind: Service
metadata:
  name: {{ tpl .Values.identifier . }}
  labels:
    app: {{ tpl .Values.identifier . }}
spec:
  type: ClusterIP
  ports:
   # Required for letsencrypt
   - port: 80
     name: http
   - port: 443
     name: https
  selector:
   use-as-service: {{ .Release.Name }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ tpl .Values.identifier . }}-web
  labels:
    app: {{ tpl .Values.identifier . }}-web
spec:
  type: ClusterIP
  ports:
   # Required for letsencrypt
   - port: 80
     name: http
   - port: 443
     name: https
  selector:
   use-as-service: {{ .Release.Name }}-web
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ tpl .Values.identifier . }}-letsencrypt-certs
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 50Mi
  storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ tpl .Values.identifier . }}-data
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ tpl .Values.identifier . }}-postgres-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 500Mi
  storageClassName: rook-ceph-block
---
# apiVersion: batch/v1
# kind: Job
# metadata:
#   name: {{ tpl .Values.identifier . }}-getcert
# spec:
#   template:
#     metadata:
#       labels:
#         app: certbot-letsencrypt-getcert
#         use-as-service: {{ .Release.Name }}
#     spec:
#       restartPolicy: Never
#       containers:
#       - name: certbot
#         image: ungleich/ungleich-certbot
#         ports:
#           - containerPort: 80
#         env:
#           - name: DOMAIN
#             value: "{{ tpl .Values.fqdn . }}"
#           - name: EMAIL
#             value: "{{ .Values.email }}"
#           {{ if eq .Values.letsencryptStaging "no" }}
#           - name: STAGING
#             value: "no"
#           {{ end }}
#         volumeMounts:
#           - name: etcletsencrypt
#             mountPath: "/etc/letsencrypt"
#       volumes:
#         - name: etcletsencrypt
#           persistentVolumeClaim:
#             claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
#   backoffLimit: 3
#---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ tpl .Values.identifier . }}-nginx-config
data:
  default.conf: |
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name {{ tpl .Values.fqdn . }};

        ssl_certificate      /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
        ssl_certificate_key  /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;

        client_max_body_size {{ .Values.max_filesize_in_mb }}m;

        location ~ /_matrix|/_synapse {
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header Host $http_host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_pass http://localhost:8008;
        }
    }
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ tpl .Values.identifier . }}-postgres-config
  annotations:
    secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD
stringData:
  POSTGRES_USER: "matrix-synapse"
  POSTGRES_DB: "matrix-synapse"
  POSTGRES_HOST: "localhost"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ tpl .Values.identifier . }}-matrix-config
data:
  homeserver.yaml: |
    server_name: "{{ .Values.server_name }}"
    web_client_location: "{{ .Values.web_client_location }}"

    public_baseurl: "{{ tpl .Values.fqdn . }}"

    allow_public_rooms_without_auth: true
    allow_public_rooms_over_federation: false

    pid_file: "/var/run/matrix/homeserver.pid"
    report_stats: false
    signing_key_path: "/data/signin.key"

    listeners:
      - port: 8008
        tls: false
        type: http
        x_forwarded: true
        bind_addresses:
        - '::1'
        - '127.0.0.1'

        resources:
          - names: [federation,client]
            compress: false
      - port: 9093
        bind_addresses:
        - '::1'
        - '127.0.0.1'

        type: http
        resources:
          - names: [replication]

    database:
      name: "psycopg2"
      args:
        database: "matrix-synapse"
        host: "localhost"
        user: "matrix-synapse"
        password: ""
        cp_min: 10
        cp_min: 5

    log_config: "/config/log.yaml"

    enable_media_repo: true
    media_store_path: "/data/media"
    max_upload_size: "{{ .Values.max_filesize_in_mb }}M"
    enable_registration: {{ .Values.enable_registration }}

  log.yaml: |
    version: 1

    formatters:
      fmt:
        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'

    filters:
      context:
        (): synapse.logging.context.LoggingContextFilter
        request: ""

    handlers:
      console:
        class: logging.StreamHandler
        formatter: fmt
        filters: [context]

    root:
      level: INFO
      handlers: [console] # to use file handler instead, switch to [file]

    loggers:
      synapse:
        level: INFO

      synapse.storage.SQL:
        level: INFO

    # example of enabling debugging for a component:
    #
    # synapse.federation.transport.server:
    #    level: DEBUG