starting matrix
This commit is contained in:
Nico Schottelius
parent
ba70fa804a
commit
afa82532d4
6 changed files with 379 additions and 0 deletions
23
apps/matrix/.helmignore
Normal file
23
apps/matrix/.helmignore
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
24
apps/matrix/Chart.yaml
Normal file
24
apps/matrix/Chart.yaml
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
apiVersion: v2
|
||||
name: matrix
|
||||
description: ungleich managed matrix
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.37.1"
|
||||
6
apps/matrix/README.md
Normal file
6
apps/matrix/README.md
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
## Missing
|
||||
|
||||
- db secret generation (sops?)
|
||||
- SMTP settings / secrets (ungleich mail + sops?)
|
||||
- Exposing sizes in value.yaml (db, gitea)
|
||||
- Maybe reducing to 1 PVC?
|
||||
297
apps/matrix/templates/deployment.yaml
Normal file
297
apps/matrix/templates/deployment.yaml
Normal file
|
|
@ -0,0 +1,297 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-matrix
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ .Release.Name }}-matrix
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ .Release.Name }}-matrix
|
||||
use-as-service: {{ .Release.Name }}
|
||||
spec:
|
||||
initContainers:
|
||||
- name: wait-for-cert
|
||||
image: busybox
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 5; done
|
||||
volumeMounts:
|
||||
- name: etcletsencrypt
|
||||
mountPath: "/etc/letsencrypt"
|
||||
containers:
|
||||
# This container will only start *after* the cert has been placed
|
||||
- name: nginx
|
||||
image: nginx:1.21-alpine
|
||||
ports:
|
||||
- containerPort: 443
|
||||
volumeMounts:
|
||||
- name: nginx-config
|
||||
mountPath: "/etc/nginx/conf.d/"
|
||||
- name: etcletsencrypt
|
||||
mountPath: "/etc/letsencrypt"
|
||||
- name: postgres
|
||||
image: postgres:13
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ tpl .Values.identifier . }}-postgres-config
|
||||
# Use subpath to avoid lost+found error
|
||||
volumeMounts:
|
||||
- name: postgres-data
|
||||
mountPath: "/var/lib/postgresql/data"
|
||||
subPath: postgres
|
||||
- name: matrix
|
||||
image: matrixdotorg/synapse:v1.37.1
|
||||
ports:
|
||||
- containerPort: 8008
|
||||
env:
|
||||
- name: SYNAPSE_CONFIG_PATH
|
||||
value: "/config/homeserver.yaml"
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: "/data"
|
||||
- name: matrix-config
|
||||
mountPath: "/config"
|
||||
volumes:
|
||||
- name: etcletsencrypt
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ tpl .Values.identifier . }}-data
|
||||
- name: postgres-data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ tpl .Values.identifier . }}-postgres-data
|
||||
- name: nginx-config
|
||||
configMap:
|
||||
name: {{ tpl .Values.identifier . }}-nginx-config
|
||||
- name: matrix-config
|
||||
configMap:
|
||||
name: {{ tpl .Values.identifier . }}-matrix-config
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}
|
||||
labels:
|
||||
app: {{ tpl .Values.identifier . }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 22
|
||||
name: ssh
|
||||
# Required for letsencrypt
|
||||
- port: 80
|
||||
name: http
|
||||
- port: 443
|
||||
name: https
|
||||
selector:
|
||||
use-as-service: {{ .Release.Name }}
|
||||
# ---
|
||||
# apiVersion: v1
|
||||
# kind: ConfigMap
|
||||
# metadata:
|
||||
# name: {{ tpl .Values.identifier . }}-matrixconfig
|
||||
# data:
|
||||
# {{ tpl (.Files.Glob "matrix/*").AsConfig . | indent 2 }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-letsencrypt-certs
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Mi
|
||||
storageClassName: rook-cephfs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: rook-cephfs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-postgres-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 500Mi
|
||||
storageClassName: rook-ceph-block
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-getcert
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: certbot-letsencrypt-getcert
|
||||
use-as-service: {{ .Release.Name }}
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: certbot
|
||||
image: ungleich/ungleich-certbot
|
||||
ports:
|
||||
- containerPort: 80
|
||||
env:
|
||||
- name: DOMAIN
|
||||
value: "{{ tpl .Values.fqdn . }}"
|
||||
- name: EMAIL
|
||||
value: "{{ .Values.email }}"
|
||||
{{ if eq .Values.letsencryptStaging "no" }}
|
||||
- name: STAGING
|
||||
value: "no"
|
||||
{{ end }}
|
||||
volumeMounts:
|
||||
- name: etcletsencrypt
|
||||
mountPath: "/etc/letsencrypt"
|
||||
volumes:
|
||||
- name: etcletsencrypt
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
|
||||
backoffLimit: 3
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-nginx-config
|
||||
data:
|
||||
default.conf: |
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
server_name {{ tpl .Values.fqdn . }};
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
|
||||
|
||||
client_max_body_size 256m;
|
||||
|
||||
location ~ /_matrix|/_synapse {
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_pass http://localhost:8008;
|
||||
}
|
||||
}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-postgres-config
|
||||
data:
|
||||
POSTGRES_USER: matrix-synapse
|
||||
POSTGRES_DB: matrix-synapse
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ tpl .Values.identifier . }}-matrix-config
|
||||
data:
|
||||
homeserver.yaml: |
|
||||
server_name: "{{ .Values.server_name }}"
|
||||
web_client_location: "{{ .Values.web_client_location }}"
|
||||
|
||||
public_baseurl: "{{ tpl .Values.fqdn . }}"
|
||||
|
||||
allow_public_rooms_without_auth: true
|
||||
allow_public_rooms_over_federation: false
|
||||
|
||||
pid_file: "/var/run/matrix/homeserver.pid"
|
||||
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
bind_addresses:
|
||||
- '::1'
|
||||
- '127.0.0.1'
|
||||
|
||||
resources:
|
||||
- names: [federation,client,metrics]
|
||||
compress: false
|
||||
- port: 9093
|
||||
bind_addresses:
|
||||
- '::1'
|
||||
- '127.0.0.1'
|
||||
|
||||
type: http
|
||||
resources:
|
||||
- names: [replication]
|
||||
|
||||
database:
|
||||
name: "psycopg2"
|
||||
args:
|
||||
database: "matrix-synapse"
|
||||
host: "localhost"
|
||||
user: "matrix-synapse"
|
||||
password: ""
|
||||
cp_min: 10
|
||||
cp_min: 5
|
||||
|
||||
log_config: "/config/log.yaml"
|
||||
|
||||
enable_media_repo: true
|
||||
media_store_path: "/data"
|
||||
max_upload_size: "100M"
|
||||
enable_registration: false
|
||||
|
||||
log.yaml: |
|
||||
version: 1
|
||||
|
||||
formatters:
|
||||
fmt:
|
||||
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
|
||||
|
||||
filters:
|
||||
context:
|
||||
(): synapse.logging.context.LoggingContextFilter
|
||||
request: ""
|
||||
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: fmt
|
||||
filters: [context]
|
||||
|
||||
root:
|
||||
level: INFO
|
||||
handlers: [console] # to use file handler instead, switch to [file]
|
||||
|
||||
loggers:
|
||||
synapse:
|
||||
level: INFO
|
||||
|
||||
synapse.storage.SQL:
|
||||
level: INFO
|
||||
|
||||
# example of enabling debugging for a component:
|
||||
#
|
||||
# synapse.federation.transport.server:
|
||||
# level: DEBUG
|
||||
13
apps/matrix/templates/tests/test-connection.yaml
Normal file
13
apps/matrix/templates/tests/test-connection.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ tpl .Values.identifier . }}-test-connection"
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['https://{{ tpl .Values.fqdn . }}']
|
||||
restartPolicy: Never
|
||||
16
apps/matrix/values.yaml
Normal file
16
apps/matrix/values.yaml
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
clusterDomain: c2.k8s.ooo
|
||||
email: technik@ungleich.ch
|
||||
letsencryptStaging: "yes"
|
||||
|
||||
# This is how the service and the data volumes are named - i.e. the
|
||||
# persistent thing
|
||||
identifier: "{{ .Release.Name }}"
|
||||
fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
|
||||
|
||||
# This needs delegation / configuration on fn.nf
|
||||
server_name: "fn.nf"
|
||||
|
||||
# Full URL
|
||||
web_client_location: "https://TBD"
|
||||
|
||||
enable_registration: false
|
||||
Loading…
Reference in a new issue