[apps/matrix] Begin cleanup for single worker approach

This commit is contained in:
Nico Schottelius 2021-12-21 12:02:28 +01:00
parent 52bec8f0c5
commit 58be88f40a
3 changed files with 129 additions and 123 deletions

View File

@ -1,3 +1,65 @@
## Todos / missing 2021-12-21
* Splitting / checking postgresql
* Setting up element-web + config
* Defining the homeserver.yaml
* Integration with certbot
## Components
### General
* Need switches for element-web (?)
* Or always deploy
### element-web
* Needs config: /app/config.json
* Needs FQDN for HTTPS / nginx
* Maybe limit the builtin webserver to localhost?
To add:
```
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "frame-ancestors 'none'";
```
### matrix-synapse
* Requires homeserver.yaml for starting
* Need to overwrite the entrypoint
* How/where do we specifiy the postgresql password?
* Maybe in our own init container using alpine?
Need to generate for postgresql:
```
database:
# The database engine name
name: "psycopg2"
# Arguments to pass to the engine
args:
database: "matrix-synapse"
host: "/var/run/postgresql"
user: "matrix-synapse"
password: ""
cp_min: 10
cp_min: 5
```
For configuration set/do not set:
* SYNAPSE_CONFIG_DIR=/config (this contains generated files from us)
* SYNAPSE_DATA_DIR is by default /data, keep as is
Save under:
## Missing
- db secret generation (sops?)
@ -6,9 +68,12 @@
- Exposing sizes in value.yaml (db, gitea)
- Maybe reducing to 1 PVC?
## TODOs
- Maybe move postgres into own service -> stays running by default
- Move postgres into own service -> stays running by default
## Reset

View File

@ -2,22 +2,60 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-matrix
name: {{ .Release.Name }}-matrix-element-web
spec:
selector:
matchLabels:
app: {{ .Release.Name }}-matrix
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-element-web
replicas: 1
template:
metadata:
labels:
app: {{ .Release.Name }}-matrix
use-as-service: {{ .Release.Name }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-element-web
spec:
containers:
- name: element-web
image: vectorim/element-web:{{ .Values.elementWebVersion }}
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: {{ .Release.Name }}-element-web
labels:
app: {{ .Release.Name }}-element-web
spec:
type: ClusterIP
ports:
# Required for letsencrypt
- port: 80
name: http
selector:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-element-web
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-matrix-synapse
spec:
selector:
matchLabels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
replicas: 1
template:
metadata:
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
spec:
initContainers:
- name: generate-matrix-signing-key
image: ungleich/ungleich-matrix-synapse:{{ .Values.synapseVersion }}
imagePullPolicy: Always
image: matrixdotorg/synapse:{{ .Values.synapseVersion }}
command:
- "python"
- "-m"
@ -33,61 +71,6 @@ spec:
- name: matrix-config
mountPath: "/baseconfig"
containers:
- name: certbot
image: ungleich/ungleich-certbot
imagePullPolicy: Always
ports:
- containerPort: 80
env:
- name: DOMAIN
value: "{{ tpl .Values.fqdn . }}"
- name: EMAIL
value: "{{ .Values.email }}"
{{ if eq .Values.letsencryptStaging "no" }}
- name: STAGING
value: "no"
{{ end }}
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
# This container will only start *after* the cert has been placed
- name: debug
image: alpine:latest
volumeMounts:
- name: nginx-config
mountPath: "/etc/nginx/conf.d/"
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: data
mountPath: "/data"
- name: matrix-config
mountPath: "/baseconfig"
- name: postgres-vars
mountPath: "/postgres"
args:
- sleep
- "1000000"
- name: nginx
image: nginx:1.21-alpine
ports:
- containerPort: 443
volumeMounts:
- name: nginx-config
mountPath: "/etc/nginx/conf.d/"
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: postgres
image: postgres:13
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: {{ tpl .Values.identifier . }}-postgres-config
volumeMounts:
- name: postgres-data
mountPath: "/var/lib/postgresql/data"
# Use subpath to avoid lost+found error
subPath: postgres
- name: matrix
# SYNAPSE_CONFIG_DIR: where additional configs are placed -> postgres-db.yaml
# SYNAPSE_CONFIG_PATH: the initial config
@ -111,22 +94,22 @@ spec:
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
claimName: {{ .Release.Name }}-letsencrypt-certs
- name: data
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-data
claimName: {{ .Release.Name }}-data
- name: postgres-data
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-postgres-data
claimName: {{ .Release.Name }}-postgres-data
- name: postgres-vars
secret:
secretName: {{ tpl .Values.identifier . }}-postgres-config
secretName: {{ .Release.Name }}-postgres-config
- name: nginx-config
configMap:
name: {{ tpl .Values.identifier . }}-nginx-config
name: {{ .Release.Name }}-nginx-config
- name: matrix-config
configMap:
name: {{ tpl .Values.identifier . }}-matrix-config
name: {{ .Release.Name }}-matrix-config
items:
- key: homeserver.yaml
path: homeserver.yaml
@ -137,9 +120,9 @@ spec:
apiVersion: v1
kind: Service
metadata:
name: {{ tpl .Values.identifier . }}
name: {{ .Release.Name }}
labels:
app: {{ tpl .Values.identifier . }}
app: {{ .Release.Name }}
spec:
type: ClusterIP
ports:
@ -154,9 +137,9 @@ spec:
apiVersion: v1
kind: Service
metadata:
name: {{ tpl .Values.identifier . }}-web
name: {{ .Release.Name }}-web
labels:
app: {{ tpl .Values.identifier . }}-web
app: {{ .Release.Name }}-web
spec:
type: ClusterIP
ports:
@ -171,7 +154,7 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-letsencrypt-certs
name: {{ .Release.Name }}-letsencrypt-certs
spec:
accessModes:
- ReadWriteMany
@ -183,7 +166,7 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-data
name: {{ .Release.Name }}-data
spec:
accessModes:
- ReadWriteMany
@ -195,7 +178,7 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-postgres-data
name: {{ .Release.Name }}-postgres-data
spec:
accessModes:
- ReadWriteOnce
@ -204,45 +187,10 @@ spec:
storage: 500Mi
storageClassName: rook-ceph-block
---
# apiVersion: batch/v1
# kind: Job
# metadata:
# name: {{ tpl .Values.identifier . }}-getcert
# spec:
# template:
# metadata:
# labels:
# app: certbot-letsencrypt-getcert
# use-as-service: {{ .Release.Name }}
# spec:
# restartPolicy: Never
# containers:
# - name: certbot
# image: ungleich/ungleich-certbot
# ports:
# - containerPort: 80
# env:
# - name: DOMAIN
# value: "{{ tpl .Values.fqdn . }}"
# - name: EMAIL
# value: "{{ .Values.email }}"
# {{ if eq .Values.letsencryptStaging "no" }}
# - name: STAGING
# value: "no"
# {{ end }}
# volumeMounts:
# - name: etcletsencrypt
# mountPath: "/etc/letsencrypt"
# volumes:
# - name: etcletsencrypt
# persistentVolumeClaim:
# claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
# backoffLimit: 3
#---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ tpl .Values.identifier . }}-nginx-config
name: {{ .Release.Name }}-nginx-config
data:
default.conf: |
server {
@ -268,7 +216,7 @@ data:
apiVersion: v1
kind: Secret
metadata:
name: {{ tpl .Values.identifier . }}-postgres-config
name: {{ .Release.Name }}-postgres-config
annotations:
secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD
stringData:
@ -279,7 +227,7 @@ stringData:
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ tpl .Values.identifier . }}-matrix-config
name: {{ .Release.Name }}-matrix-config
data:
homeserver.yaml: |
server_name: "{{ .Values.server_name }}"
@ -360,8 +308,3 @@ data:
synapse.storage.SQL:
level: INFO
# example of enabling debugging for a component:
#
# synapse.federation.transport.server:
# level: DEBUG

View File

@ -2,9 +2,7 @@ clusterDomain: c2.k8s.ooo
email: technik@ungleich.ch
letsencryptStaging: "yes"
# This is how the service and the data volumes are named - i.e. the
# persistent thing
identifier: "{{ .Release.Name }}"
fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
# This needs delegation / configuration on fn.nf
@ -18,5 +16,5 @@ enable_registration: false
# Maximum size of one particular file
max_filesize_in_mb: 100
elementVersion: "1.7.32"
synapseVersion: "v1.48.0"
elementWebVersion: "v1.9.8"
synapseVersion: "v1.49.0"