From afa82532d4ec48058d3640cd0cb2dcf9b3ac14f7 Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Thu, 1 Jul 2021 18:29:33 +0200 Subject: [PATCH] starting matrix --- apps/matrix/.helmignore | 23 ++ apps/matrix/Chart.yaml | 24 ++ apps/matrix/README.md | 6 + apps/matrix/templates/deployment.yaml | 297 ++++++++++++++++++ .../templates/tests/test-connection.yaml | 13 + apps/matrix/values.yaml | 16 + 6 files changed, 379 insertions(+) create mode 100644 apps/matrix/.helmignore create mode 100644 apps/matrix/Chart.yaml create mode 100644 apps/matrix/README.md create mode 100644 apps/matrix/templates/deployment.yaml create mode 100644 apps/matrix/templates/tests/test-connection.yaml create mode 100644 apps/matrix/values.yaml diff --git a/apps/matrix/.helmignore b/apps/matrix/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/apps/matrix/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/apps/matrix/Chart.yaml b/apps/matrix/Chart.yaml new file mode 100644 index 0000000..d04256d --- /dev/null +++ b/apps/matrix/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: matrix +description: ungleich managed matrix + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "1.37.1" diff --git a/apps/matrix/README.md b/apps/matrix/README.md new file mode 100644 index 0000000..7d68f32 --- /dev/null +++ b/apps/matrix/README.md @@ -0,0 +1,6 @@ +## Missing + +- db secret generation (sops?) +- SMTP settings / secrets (ungleich mail + sops?) +- Exposing sizes in value.yaml (db, gitea) + - Maybe reducing to 1 PVC? diff --git a/apps/matrix/templates/deployment.yaml b/apps/matrix/templates/deployment.yaml new file mode 100644 index 0000000..632ea7f --- /dev/null +++ b/apps/matrix/templates/deployment.yaml @@ -0,0 +1,297 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-matrix +spec: + selector: + matchLabels: + app: {{ .Release.Name }}-matrix + replicas: 1 + template: + metadata: + labels: + app: {{ .Release.Name }}-matrix + use-as-service: {{ .Release.Name }} + spec: + initContainers: + - name: wait-for-cert + image: busybox + command: + - sh + - -c + - until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 5; done + volumeMounts: + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + containers: + # This container will only start *after* the cert has been placed + - name: nginx + image: nginx:1.21-alpine + ports: + - containerPort: 443 + volumeMounts: + - name: nginx-config + mountPath: "/etc/nginx/conf.d/" + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + - name: postgres + image: postgres:13 + ports: + - containerPort: 5432 + envFrom: + - configMapRef: + name: {{ tpl .Values.identifier . }}-postgres-config + # Use subpath to avoid lost+found error + volumeMounts: + - name: postgres-data + mountPath: "/var/lib/postgresql/data" + subPath: postgres + - name: matrix + image: matrixdotorg/synapse:v1.37.1 + ports: + - containerPort: 8008 + env: + - name: SYNAPSE_CONFIG_PATH + value: "/config/homeserver.yaml" + volumeMounts: + - name: data + mountPath: "/data" + - name: matrix-config + mountPath: "/config" + volumes: + - name: etcletsencrypt + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs + - name: data + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-data + - name: postgres-data + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-postgres-data + - name: nginx-config + configMap: + name: {{ tpl .Values.identifier . }}-nginx-config + - name: matrix-config + configMap: + name: {{ tpl .Values.identifier . }}-matrix-config + +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ tpl .Values.identifier . }} + labels: + app: {{ tpl .Values.identifier . }} +spec: + type: ClusterIP + ports: + - port: 22 + name: ssh + # Required for letsencrypt + - port: 80 + name: http + - port: 443 + name: https + selector: + use-as-service: {{ .Release.Name }} +# --- +# apiVersion: v1 +# kind: ConfigMap +# metadata: +# name: {{ tpl .Values.identifier . }}-matrixconfig +# data: +# {{ tpl (.Files.Glob "matrix/*").AsConfig . | indent 2 }} +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ tpl .Values.identifier . }}-letsencrypt-certs +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 50Mi + storageClassName: rook-cephfs +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ tpl .Values.identifier . }}-data +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + storageClassName: rook-cephfs +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ tpl .Values.identifier . }}-postgres-data +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 500Mi + storageClassName: rook-ceph-block +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ tpl .Values.identifier . }}-getcert +spec: + template: + metadata: + labels: + app: certbot-letsencrypt-getcert + use-as-service: {{ .Release.Name }} + spec: + restartPolicy: Never + containers: + - name: certbot + image: ungleich/ungleich-certbot + ports: + - containerPort: 80 + env: + - name: DOMAIN + value: "{{ tpl .Values.fqdn . }}" + - name: EMAIL + value: "{{ .Values.email }}" + {{ if eq .Values.letsencryptStaging "no" }} + - name: STAGING + value: "no" + {{ end }} + volumeMounts: + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + volumes: + - name: etcletsencrypt + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs + backoffLimit: 3 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ tpl .Values.identifier . }}-nginx-config +data: + default.conf: | + server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name {{ tpl .Values.fqdn . }}; + + ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem; + + client_max_body_size 256m; + + location ~ /_matrix|/_synapse { + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_pass http://localhost:8008; + } + } +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ tpl .Values.identifier . }}-postgres-config +data: + POSTGRES_USER: matrix-synapse + POSTGRES_DB: matrix-synapse +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ tpl .Values.identifier . }}-matrix-config +data: + homeserver.yaml: | + server_name: "{{ .Values.server_name }}" + web_client_location: "{{ .Values.web_client_location }}" + + public_baseurl: "{{ tpl .Values.fqdn . }}" + + allow_public_rooms_without_auth: true + allow_public_rooms_over_federation: false + + pid_file: "/var/run/matrix/homeserver.pid" + + listeners: + - port: 8008 + tls: false + type: http + x_forwarded: true + bind_addresses: + - '::1' + - '127.0.0.1' + + resources: + - names: [federation,client,metrics] + compress: false + - port: 9093 + bind_addresses: + - '::1' + - '127.0.0.1' + + type: http + resources: + - names: [replication] + + database: + name: "psycopg2" + args: + database: "matrix-synapse" + host: "localhost" + user: "matrix-synapse" + password: "" + cp_min: 10 + cp_min: 5 + + log_config: "/config/log.yaml" + + enable_media_repo: true + media_store_path: "/data" + max_upload_size: "100M" + enable_registration: false + + log.yaml: | + version: 1 + + formatters: + fmt: + format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s' + + filters: + context: + (): synapse.logging.context.LoggingContextFilter + request: "" + + handlers: + console: + class: logging.StreamHandler + formatter: fmt + filters: [context] + + root: + level: INFO + handlers: [console] # to use file handler instead, switch to [file] + + loggers: + synapse: + level: INFO + + synapse.storage.SQL: + level: INFO + + # example of enabling debugging for a component: + # + # synapse.federation.transport.server: + # level: DEBUG diff --git a/apps/matrix/templates/tests/test-connection.yaml b/apps/matrix/templates/tests/test-connection.yaml new file mode 100644 index 0000000..85cbdda --- /dev/null +++ b/apps/matrix/templates/tests/test-connection.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ tpl .Values.identifier . }}-test-connection" + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['https://{{ tpl .Values.fqdn . }}'] + restartPolicy: Never diff --git a/apps/matrix/values.yaml b/apps/matrix/values.yaml new file mode 100644 index 0000000..7f6c688 --- /dev/null +++ b/apps/matrix/values.yaml @@ -0,0 +1,16 @@ +clusterDomain: c2.k8s.ooo +email: technik@ungleich.ch +letsencryptStaging: "yes" + +# This is how the service and the data volumes are named - i.e. the +# persistent thing +identifier: "{{ .Release.Name }}" +fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + +# This needs delegation / configuration on fn.nf +server_name: "fn.nf" + +# Full URL +web_client_location: "https://TBD" + +enable_registration: false