k3s/services/matrix-tuwunel/matrix-deployment.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: synapse-config-tmpl
  namespace: matrix
data:
  homeserver.yaml: |
    server_name: "starling.mynest.love"
    public_baseurl: "https://starling.mynest.love"

    media_store_path: "/data/media_store"
    uploads_path: "/data/uploads"

    serve_server_wellknown: true
    serve_client_wellknown: true
    
    extra_well_known_client_content:
      "m.homeserver":
        base_url: "https://starling.mynest.love"
      "org.matrix.msc4143.rtc_foci":
        - type: livekit
          livekit_service_url: "https://matrix-rtc.mynest.love"
    
    listeners:
      - port: 8008
        tls: false
        type: http
        x_forwarded: true
        resources:
          - names: [client, federation]
            compress: false
            
    database:
      name: psycopg2
      args:
        user: "${POSTGRES_USER}"
        password: "${POSTGRES_PASSWORD}"
        database: "synapse"
        host: "postgres-svc"
        cp_min: 5
        cp_max: 10
        
    oidc_providers:
      - idp_id: keycloak
        idp_name: "Nest SSO"
        discover: true
        issuer: "https://sso.mynest.love/realms/nest"
        client_id: "${CLIENT_ID}"
        client_secret: "${CLIENT_SECRET}"
        scopes: ["openid", "profile", "email"]
        user_mapping_provider:
          config:
            localpart_template: "{{ user.preferred_username }}"
            display_name_template: "{{ user.name }}"
            
    # MatrixRTC & LiveKit Requirements
    experimental_features:
      msc4140_enabled: true
      msc4143_enabled: true
      
    macaroon_secret_key: "${SYNAPSE_MACAROON_KEY}"
    form_secret: "${SYNAPSE_REGISTRATION_SECRET}"
    registration_shared_secret: "${SYNAPSE_REGISTRATION_SECRET}"
    enable_registration: false
    report_stats: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:15-alpine
          env:
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: POSTGRES_USER
            - name: POSTGRES_DB
              value: "synapse"
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: POSTGRES_PASSWORD
            - name: POSTGRES_INITDB_ARGS
              value: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
          ports:
            - containerPort: 5432
          volumeMounts:
            - name: postgres-data
              mountPath: /var/lib/postgresql/data
              subPath: synapse-data
      volumes:
        - name: postgres-data
          persistentVolumeClaim:
            claimName: postgres-data
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: synapse
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: synapse
  template:
    metadata:
      labels:
        app: synapse
    spec:
      initContainers:
        - name: generate-config
          image: alpine:latest
          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/homeserver.yaml > /data/homeserver.yaml && chown -R 991:991 /data"]
          envFrom:
            - secretRef:
                name: matrix-secrets
          volumeMounts:
            - name: config-tmpl
              mountPath: /tmpl/homeserver.yaml
              subPath: homeserver.yaml
            - name: synapse-data
              mountPath: /data
      containers:
        - name: synapse
          image: matrixdotorg/synapse:latest
          ports:
            - containerPort: 8008
          env:
            - name: SYNAPSE_CONFIG_PATH
              value: "/data/homeserver.yaml"
          volumeMounts:
            - name: synapse-data
              mountPath: /data
      volumes:
        - name: synapse-data
          persistentVolumeClaim:
            claimName: synapse-data
        - name: config-tmpl
          configMap:
            name: synapse-config-tmpl
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: livekit-config
  namespace: matrix
data:
  livekit.yaml: |
    port: 7880
    rtc:
      tcp_port: 7881
      udp_port: 7882
      use_external_ip: true
    turn:
      cert_file: ""
      key_file: ""
      tls_port: 0
      udp_port: 3478
      external_tls: false
    # Crucial for Matrix integration: Only the JWT service can create rooms
    room:
      auto_create: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: livekit
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: livekit
  template:
    metadata:
      labels:
        app: livekit
    spec:
      containers:
        - name: livekit
          image: livekit/livekit-server:latest
          args: ["--config", "/etc/livekit.yaml"]
          ports:
            - containerPort: 7880
            - containerPort: 7881
            - containerPort: 7882
              protocol: UDP
            - containerPort: 3478
              protocol: UDP
          env:
            - name: LK_KEY
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: LIVEKIT_KEY
            - name: LK_SECRET
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: LIVEKIT_SECRET
            - name: LIVEKIT_KEYS
              value: '$(LK_KEY): $(LK_SECRET)'
          volumeMounts:
            - name: config-volume
              mountPath: /etc/livekit.yaml
              subPath: livekit.yaml
      volumes:
        - name: config-volume
          configMap:
            name: livekit-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lk-jwt-service
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: lk-jwt-service
  template:
    metadata:
      labels:
        app: lk-jwt-service
    spec:
      containers:
        - name: lk-jwt-service
          image: ghcr.io/element-hq/lk-jwt-service:0.4.2
          ports:
            - containerPort: 8080
          envFrom:
            - secretRef:
                name: matrix-secrets
          env:
            - name: LIVEKIT_URL
              value: "wss://matrix-rtc.mynest.love"
            - name: LIVEKIT_FULL_ACCESS_HOMESERVERS
              value: "starling.mynest.love"