k3s/services/matrix/matrix-deployment.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: tuwunel-config
  namespace: matrix
data:
  tuwunel.toml: |
    [global]
    server_name = "starling.mynest.love"
    database_path = "/var/lib/tuwunel/"
    address = "0.0.0.0"
    port = 6167
    allow_registration = false

    [global.well_known]
    client = "https://starling.mynest.love"
    livekit_url = "https://matrix-rtc.mynest.love" 

    [[global.identity_provider]]
    brand = "keycloak"
    client_id = "matrix-tuwunel"
    client_secret_file = "/etc/tuwunel/client_secret"
    issuer_url = "https://sso.mynest.love/realms/nest"
    callback_url = "https://starling.mynest.love/_matrix/client/unstable/login/sso/callback/matrix-tuwunel"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tuwunel
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tuwunel
  template:
    metadata:
      labels:
        app: tuwunel
    spec:
      # Prevents K8s from injecting random network variables that trigger linter warnings
      enableServiceLinks: false
      containers:
        - name: tuwunel
          image: ghcr.io/matrix-construct/tuwunel:latest
          ports:
            - containerPort: 6167
          env:
            - name: TUWUNEL_CONFIG
              value: "/etc/tuwunel/tuwunel.toml"
            - name: TUWUNEL_GLOBAL__IDENTITY_PROVIDER__0__CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: client-secret
          volumeMounts:
            - name: tuwunel-data
              mountPath: /var/lib/tuwunel/
            - name: config-volume
              mountPath: /etc/tuwunel/tuwunel.toml
              subPath: tuwunel.toml
            - name: secret-volume
              mountPath: /etc/tuwunel/client_secret
              subPath: client_secret
      volumes:
        - name: tuwunel-data
          persistentVolumeClaim:
            claimName: tuwunel-data
        - name: config-volume
          configMap:
            name: tuwunel-config
        - name: secret-volume
          secret:
            secretName: matrix-secrets
            items:
              - key: client-secret
                path: client_secret
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: livekit-config
  namespace: matrix
data:
  livekit.yaml: |
    port: 7880
    rtc:
      tcp_port: 7881
      udp_port: 7882
      use_external_ip: true
    turn:
      cert_file: ""
      key_file: ""
      tls_port: 0
      udp_port: 3478
      external_tls: false
    # Crucial for Matrix integration: Only the JWT service can create rooms
    room:
      auto_create: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: livekit
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: livekit
  template:
    metadata:
      labels:
        app: livekit
    spec:
      containers:
        - name: livekit
          image: livekit/livekit-server:latest
          args: ["--config", "/etc/livekit.yaml"]
          ports:
            - containerPort: 7880
            - containerPort: 7881
            - containerPort: 7882
              protocol: UDP
            - containerPort: 3478
              protocol: UDP
          env:
            - name: LK_KEY
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: LIVEKIT_KEY
            - name: LK_SECRET
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: LIVEKIT_SECRET
            - name: LIVEKIT_KEYS
              value: "$(LK_KEY): $(LK_SECRET)"
          volumeMounts:
            - name: config-volume
              mountPath: /etc/livekit.yaml
              subPath: livekit.yaml
      volumes:
        - name: config-volume
          configMap:
            name: livekit-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lk-jwt-service
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: lk-jwt-service
  template:
    metadata:
      labels:
        app: lk-jwt-service
    spec:
      containers:
        - name: lk-jwt-service
          image: ghcr.io/element-hq/lk-jwt-service:latest
          ports:
            - containerPort: 8080
          envFrom:
            - secretRef:
                name: matrix-secrets
          env:
            - name: LIVEKIT_URL
              value: "wss://matrix-rtc.mynest.love"
            - name: LIVEKIT_FULL_ACCESS_HOMESERVERS
              value: "starling.mynest.love"