354 lines
9.1 KiB
YAML
354 lines
9.1 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}-matrix
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-matrix
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ .Release.Name }}-matrix
|
|
use-as-service: {{ .Release.Name }}
|
|
spec:
|
|
initContainers:
|
|
- name: wait-for-cert
|
|
image: busybox
|
|
command:
|
|
- sh
|
|
- -c
|
|
- until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 2; done
|
|
volumeMounts:
|
|
- name: etcletsencrypt
|
|
mountPath: "/etc/letsencrypt"
|
|
- name: generate-matrix-signing-key
|
|
image: ungleich/ungleich-matrix-synapse:{{ .Values.synapseVersion }}
|
|
command:
|
|
- "python"
|
|
- "-m"
|
|
- "synapse.app.homeserver"
|
|
- "--config-path"
|
|
- "/baseconfig"
|
|
- "--keys-directory"
|
|
- "/data"
|
|
- "--generate-keys"
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: "/data"
|
|
- name: matrix-config
|
|
mountPath: "/baseconfig"
|
|
containers:
|
|
# This container will only start *after* the cert has been placed
|
|
- name: debug
|
|
image: alpine:latest
|
|
volumeMounts:
|
|
- name: nginx-config
|
|
mountPath: "/etc/nginx/conf.d/"
|
|
- name: etcletsencrypt
|
|
mountPath: "/etc/letsencrypt"
|
|
- name: data
|
|
mountPath: "/data"
|
|
- name: matrix-config
|
|
mountPath: "/baseconfig"
|
|
- name: postgres-vars
|
|
mountPath: "/postgres"
|
|
args:
|
|
- sleep
|
|
- "1000000"
|
|
- name: nginx
|
|
image: nginx:1.21-alpine
|
|
ports:
|
|
- containerPort: 443
|
|
volumeMounts:
|
|
- name: nginx-config
|
|
mountPath: "/etc/nginx/conf.d/"
|
|
- name: etcletsencrypt
|
|
mountPath: "/etc/letsencrypt"
|
|
- name: postgres
|
|
image: postgres:13
|
|
ports:
|
|
- containerPort: 5432
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ tpl .Values.identifier . }}-postgres-config
|
|
volumeMounts:
|
|
- name: postgres-data
|
|
mountPath: "/var/lib/postgresql/data"
|
|
# Use subpath to avoid lost+found error
|
|
subPath: postgres
|
|
- name: matrix
|
|
# SYNAPSE_CONFIG_DIR: where additional configs are placed -> postgres-db.yaml
|
|
# SYNAPSE_CONFIG_PATH: the initial config
|
|
# log.yaml -> same dir as postgres-db.yaml
|
|
# /data = persistent storage
|
|
image: ungleich/ungleich-matrix-synapse:{{ .Values.synapseVersion }}
|
|
ports:
|
|
- containerPort: 8008
|
|
env:
|
|
- name: SYNAPSE_CONFIG_PATH
|
|
value: "/baseconfig/homeserver.yaml"
|
|
- name: SYNAPSE_CONFIG_DIR
|
|
value: "/config"
|
|
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: "/data"
|
|
- name: matrix-config
|
|
mountPath: "/baseconfig"
|
|
volumes:
|
|
- name: etcletsencrypt
|
|
persistentVolumeClaim:
|
|
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: {{ tpl .Values.identifier . }}-data
|
|
- name: postgres-data
|
|
persistentVolumeClaim:
|
|
claimName: {{ tpl .Values.identifier . }}-postgres-data
|
|
- name: nginx-config
|
|
configMap:
|
|
name: {{ tpl .Values.identifier . }}-nginx-config
|
|
- name: matrix-config
|
|
configMap:
|
|
name: {{ tpl .Values.identifier . }}-matrix-config
|
|
items:
|
|
- key: homeserver.yaml
|
|
path: homeserver.yaml
|
|
- key: log.yaml
|
|
path: log.yaml
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}
|
|
labels:
|
|
app: {{ tpl .Values.identifier . }}
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
# Required for letsencrypt
|
|
- port: 80
|
|
name: http
|
|
- port: 443
|
|
name: https
|
|
selector:
|
|
use-as-service: {{ .Release.Name }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-web
|
|
labels:
|
|
app: {{ tpl .Values.identifier . }}-web
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
# Required for letsencrypt
|
|
- port: 80
|
|
name: http
|
|
- port: 443
|
|
name: https
|
|
selector:
|
|
use-as-service: {{ .Release.Name }}-web
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-letsencrypt-certs
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 50Mi
|
|
storageClassName: rook-cephfs
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-data
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
storageClassName: rook-cephfs
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-postgres-data
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 500Mi
|
|
storageClassName: rook-ceph-block
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-getcert
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: certbot-letsencrypt-getcert
|
|
use-as-service: {{ .Release.Name }}
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: certbot
|
|
image: ungleich/ungleich-certbot
|
|
ports:
|
|
- containerPort: 80
|
|
env:
|
|
- name: DOMAIN
|
|
value: "{{ tpl .Values.fqdn . }}"
|
|
- name: EMAIL
|
|
value: "{{ .Values.email }}"
|
|
{{ if eq .Values.letsencryptStaging "no" }}
|
|
- name: STAGING
|
|
value: "no"
|
|
{{ end }}
|
|
volumeMounts:
|
|
- name: etcletsencrypt
|
|
mountPath: "/etc/letsencrypt"
|
|
volumes:
|
|
- name: etcletsencrypt
|
|
persistentVolumeClaim:
|
|
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
|
|
backoffLimit: 3
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-nginx-config
|
|
data:
|
|
default.conf: |
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
|
|
server_name {{ tpl .Values.fqdn . }};
|
|
|
|
ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
|
|
|
|
client_max_body_size {{ .Values.max_filesize_in_mb }}m;
|
|
|
|
location ~ /_matrix|/_synapse {
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_pass http://localhost:8008;
|
|
}
|
|
}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-postgres-config
|
|
annotations:
|
|
secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD
|
|
stringdata:
|
|
POSTGRES_USER: "matrix-synapse"
|
|
POSTGRES_DB: "matrix-synapse"
|
|
POSTGRES_HOST: "localhost"
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ tpl .Values.identifier . }}-matrix-config
|
|
data:
|
|
homeserver.yaml: |
|
|
server_name: "{{ .Values.server_name }}"
|
|
web_client_location: "{{ .Values.web_client_location }}"
|
|
|
|
public_baseurl: "{{ tpl .Values.fqdn . }}"
|
|
|
|
allow_public_rooms_without_auth: true
|
|
allow_public_rooms_over_federation: false
|
|
|
|
pid_file: "/var/run/matrix/homeserver.pid"
|
|
report_stats: false
|
|
signing_key_path: "/data/signin.key"
|
|
|
|
listeners:
|
|
- port: 8008
|
|
tls: false
|
|
type: http
|
|
x_forwarded: true
|
|
bind_addresses:
|
|
- '::1'
|
|
- '127.0.0.1'
|
|
|
|
resources:
|
|
- names: [federation,client]
|
|
compress: false
|
|
- port: 9093
|
|
bind_addresses:
|
|
- '::1'
|
|
- '127.0.0.1'
|
|
|
|
type: http
|
|
resources:
|
|
- names: [replication]
|
|
|
|
database:
|
|
name: "psycopg2"
|
|
args:
|
|
database: "matrix-synapse"
|
|
host: "localhost"
|
|
user: "matrix-synapse"
|
|
password: ""
|
|
cp_min: 10
|
|
cp_min: 5
|
|
|
|
log_config: "/config/log.yaml"
|
|
|
|
enable_media_repo: true
|
|
media_store_path: "/data/media"
|
|
max_upload_size: "{{ .Values.max_filesize_in_mb }}M"
|
|
enable_registration: {{ .Values.enable_registration }}
|
|
|
|
log.yaml: |
|
|
version: 1
|
|
|
|
formatters:
|
|
fmt:
|
|
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
|
|
|
|
filters:
|
|
context:
|
|
(): synapse.logging.context.LoggingContextFilter
|
|
request: ""
|
|
|
|
handlers:
|
|
console:
|
|
class: logging.StreamHandler
|
|
formatter: fmt
|
|
filters: [context]
|
|
|
|
root:
|
|
level: INFO
|
|
handlers: [console] # to use file handler instead, switch to [file]
|
|
|
|
loggers:
|
|
synapse:
|
|
level: INFO
|
|
|
|
synapse.storage.SQL:
|
|
level: INFO
|
|
|
|
# example of enabling debugging for a component:
|
|
#
|
|
# synapse.federation.transport.server:
|
|
# level: DEBUG
|