ungleich-public
/
ungleich-k8s
6
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[matrix] update all but DB config

This commit is contained in:
Nico Schottelius 2021-12-25 10:53:35 +01:00
parent a9f95fcbd4
commit aab0851b62
12 changed files with 3230 additions and 268 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
apps/matrix/README.md
View File

@ -5,6 +5,25 @@
* Defining the homeserver.yaml
* Integration with certbot
## Next
* create db.yaml with
```
#database:
# name: psycopg2
# args:
# user: synapse_user
# password: secretpassword
# database: synapse
# host: localhost
# port: 5432
# cp_min: 5
# cp_max: 10
```
* create log.config
* put pvc at /media_store
## Components

19
apps/matrix/synapse-nginx/synapse.conf Normal file
View File

@ -0,0 +1,19 @@
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ tpl .Values.synapseFQDN . }};
ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.synapseFQDN . }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.synapseFQDN . }}/privkey.pem;
client_max_body_size 0;
location ~ /_matrix|/_synapse {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:8008;
}
}

2896
apps/matrix/synapse/homeserver.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

27
apps/matrix/synapse/log.yaml Normal file
View File

@ -0,0 +1,27 @@
version: 1
formatters:
fmt:
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
filters:
context:
(): synapse.logging.context.LoggingContextFilter
request: ""
handlers:
console:
class: logging.StreamHandler
formatter: fmt
filters: [context]
root:
level: INFO
handlers: [console] # to use file handler instead, switch to [file]
loggers:
synapse:
level: INFO
synapse.storage.SQL:
level: INFO

7
apps/matrix/templates/element-web.yaml
View File

@ -9,6 +9,9 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-element-web
replicas: 1
strategy:
type: Recreate
template:
metadata:
labels:
@ -54,6 +57,10 @@ spec:
- name: nginx-config-proxy
configMap:
name: {{ .Release.Name }}-element-web-nginx-proxy
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ .Release.Name }}-element-web-letsencrypt-certs
---
apiVersion: v1
kind: Service

267
apps/matrix/templates/matrix-synapse.yaml
View File

@ -1,267 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-matrix-synapse
spec:
selector:
matchLabels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
replicas: 1
template:
metadata:
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
spec:
initContainers:
- name: generate-matrix-signing-key
image: matrixdotorg/synapse:{{ .Values.synapseVersion }}
command:
- "python"
- "-m"
- "synapse.app.homeserver"
- "--config-path"
- "/baseconfig"
- "--keys-directory"
- "/data"
- "--generate-keys"
volumeMounts:
- name: data
mountPath: "/data"
- name: matrix-config
mountPath: "/baseconfig"
containers:
- name: matrix
image: ungleich/ungleich-matrix-synapse:{{ .Values.synapseVersion }}
imagePullPolicy: Always
ports:
- containerPort: 8008
env:
- name: SYNAPSE_CONFIG_PATH
value: "/baseconfig/homeserver.yaml"
- name: SYNAPSE_CONFIG_DIR
value: "/config"
volumeMounts:
- name: data
mountPath: "/data"
- name: matrix-config
mountPath: "/baseconfig"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ .Release.Name }}-letsencrypt-certs
- name: data
persistentVolumeClaim:
claimName: {{ .Release.Name }}-data
- name: postgres-data
persistentVolumeClaim:
claimName: {{ .Release.Name }}-postgres-data
- name: postgres-vars
secret:
secretName: {{ .Release.Name }}-postgres-config
- name: nginx-config
configMap:
name: {{ .Release.Name }}-nginx-config
- name: matrix-config
configMap:
name: {{ .Release.Name }}-matrix-config
items:
- key: homeserver.yaml
path: homeserver.yaml
- key: log.yaml
path: log.yaml
---
apiVersion: v1
kind: Service
metadata:
name: {{ .Release.Name }}
labels:
app: {{ .Release.Name }}
spec:
type: ClusterIP
ports:
# Required for letsencrypt
- port: 80
name: http
- port: 443
name: https
selector:
use-as-service: {{ .Release.Name }}
---
apiVersion: v1
kind: Service
metadata:
name: {{ .Release.Name }}-web
labels:
app: {{ .Release.Name }}-web
spec:
type: ClusterIP
ports:
# Required for letsencrypt
- port: 80
name: http
- port: 443
name: https
selector:
use-as-service: {{ .Release.Name }}-web
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-letsencrypt-certs
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Mi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-data
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-postgres-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 500Mi
storageClassName: rook-ceph-block
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Release.Name }}-nginx-config
data:
default.conf: |
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ tpl .Values.fqdn . }};
ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
client_max_body_size {{ .Values.max_filesize_in_mb }}m;
location ~ /_matrix|/_synapse {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:8008;
}
}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ .Release.Name }}-postgres-config
annotations:
secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD
stringData:
POSTGRES_USER: "matrix-synapse"
POSTGRES_DB: "matrix-synapse"
POSTGRES_HOST: "localhost"
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Release.Name }}-matrix-config
data:
homeserver.yaml: |
server_name: "{{ .Values.server_name }}"
web_client_location: "{{ .Values.web_client_location }}"
public_baseurl: "{{ tpl .Values.fqdn . }}"
allow_public_rooms_without_auth: true
allow_public_rooms_over_federation: false
pid_file: "/var/run/matrix/homeserver.pid"
report_stats: false
signing_key_path: "/data/signin.key"
listeners:
- port: 8008
tls: false
type: http
x_forwarded: true
bind_addresses:
- '::1'
- '127.0.0.1'
resources:
- names: [federation,client]
compress: false
- port: 9093
bind_addresses:
- '::1'
- '127.0.0.1'
type: http
resources:
- names: [replication]
database:
name: "psycopg2"
args:
database: "matrix-synapse"
host: "localhost"
user: "matrix-synapse"
password: ""
cp_min: 10
cp_min: 5
log_config: "/baseconfig/log.yaml"
enable_media_repo: true
media_store_path: "/data/media"
max_upload_size: "{{ .Values.max_filesize_in_mb }}M"
enable_registration: {{ .Values.enable_registration }}
log.yaml: |
version: 1
formatters:
fmt:
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
filters:
context:
(): synapse.logging.context.LoggingContextFilter
request: ""
handlers:
console:
class: logging.StreamHandler
formatter: fmt
filters: [context]
root:
level: INFO
handlers: [console] # to use file handler instead, switch to [file]
loggers:
synapse:
level: INFO
synapse.storage.SQL:
level: INFO

76
apps/matrix/templates/postgres.yaml Normal file
View File

@ -0,0 +1,76 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-postgres
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: postgres
spec:
selector:
matchLabels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: postgres
replicas: 1
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: postgres
spec:
containers:
- name: postgres
image: postgres:14
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: {{ .Release.Name }}-postgres-config
volumeMounts:
- name: postgres-data
mountPath: "/var/lib/postgresql/data"
subPath: postgres
resources:
requests:
memory: "64Mi"
cpu: "100m"
limits:
memory: "256Mi"
cpu: "400m"
volumes:
- name: postgres-data
persistentVolumeClaim:
claimName: {{ .Release.Name }}-postgres-data
---
apiVersion: v1
kind: Service
metadata:
name: {{ .Release.Name }}-postgres
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: postgres
spec:
type: ClusterIP
ports:
- port: 5432
name: postgres
selector:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: postgres
---
---
apiVersion: v1
kind: Secret
metadata:
name: {{ .Release.Name }}-postgres-config
annotations:
secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD
hosting: {{ .Release.Name }}
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: postgres
stringData:
POSTGRES_USER: "matrix-synapse"
POSTGRES_DB: "matrix-synapse"

47
apps/matrix/templates/pvc.yaml Normal file
View File

@ -0,0 +1,47 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-element-web-letsencrypt-certs
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Mi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-synapse-letsencrypt-certs
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Mi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ .Release.Name }}-postgres-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 500Mi
storageClassName: rook-ceph-block

10
apps/matrix/templates/synapse-conf.yaml Normal file
View File

@ -0,0 +1,10 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Release.Name }}-synapse-conf
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: synapse
data:
{{ tpl (.Files.Glob "synapse/*").AsConfig . | indent 2 }}

10
apps/matrix/templates/synapse-proxy.yaml Normal file
View File

@ -0,0 +1,10 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Release.Name }}-synapse-nginx-proxy
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: synapse-nginx
data:
{{ tpl (.Files.Glob "synapse-nginx/*").AsConfig . | indent 2 }}

118
apps/matrix/templates/synapse.yaml Normal file
View File

@ -0,0 +1,118 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-matrix-synapse
spec:
selector:
matchLabels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
replicas: 1
template:
metadata:
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
annotations:
checksum/config: {{ include (print $.Template.BasePath "/synapse-proxy.yaml") . | sha256sum }}
checksum/synapse: {{ include (print $.Template.BasePath "/synapse-conf.yaml") . | sha256sum }}
spec:
initContainers:
- name: generate-matrix-signing-key
image: matrixdotorg/synapse:{{ .Values.synapseVersion }}
command:
- "python"
- "-m"
- "synapse.app.homeserver"
- "--config-path"
- "/conf"
- "--keys-directory"
- "/data"
- "--generate-keys"
volumeMounts:
- name: data
mountPath: "/data"
- name: synapse-conf
mountPath: "/conf"
containers:
- name: nginx
image: ungleich/ungleich-certbot:1.1.1
ports:
- containerPort: 443
name: https
- containerPort: 80
name: http
env:
- name: DOMAIN
value: "{{ tpl .Values.synapseFQDN . }}"
- name: EMAIL
value: "{{ .Values.email }}"
{{ if eq .Values.letsencryptStaging "no" }}
- name: STAGING
value: "no"
{{ end }}
volumeMounts:
- name: nginx-config-proxy
mountPath: "/nginx-configs"
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: synapse
image: matrixdotorg/synapse:{{ .Values.synapseVersion }}
ports:
- containerPort: 8008
env:
- name: SYNAPSE_CONFIG_PATH
value: "/conf/homeserver.yaml"
- name: SYNAPSE_CONFIG_DIR
value: "/conf"
volumeMounts:
- name: data
mountPath: "/data"
- name: synapse-conf
mountPath: "/conf"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ .Release.Name }}-synapse-letsencrypt-certs
- name: data
persistentVolumeClaim:
claimName: {{ .Release.Name }}-data
- name: postgres-vars
secret:
secretName: {{ .Release.Name }}-postgres-config
- name: nginx-config
configMap:
name: {{ .Release.Name }}-nginx-config
- name: synapse-conf
configMap:
name: {{ .Release.Name }}-synapse-conf
---
apiVersion: v1
kind: Service
metadata:
name: {{ .Release.Name }}
labels:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
spec:
type: ClusterIP
ports:
- port: 80
name: http
- port: 443
name: https
selector:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: matrix-synapse
# database:
# name: "psycopg2"
# args:
# database: "matrix-synapse"
# host: "localhost"
# user: "matrix-synapse"
# password: ""
# cp_min: 10
# cp_min: 5
# log_config: "/baseconfig/log.yaml"

2
apps/matrix/values.yaml
View File

@ -8,7 +8,7 @@ enable_registration: false
max_filesize_in_mb: 100
elementWebVersion: "v1.9.8"
synapseVersion: "v1.49.0"
synapseVersion: "v1.49.2"
elementWebFQDN: "{{ .Release.Name }}-element-web.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
synapseFQDN: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"