diff --git a/services/matrix-tuwunel/matrix-deployment.yaml b/services/matrix-tuwunel/matrix-deployment.yaml new file mode 100644 index 0000000..14d2fac --- /dev/null +++ b/services/matrix-tuwunel/matrix-deployment.yaml @@ -0,0 +1,255 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: synapse-config-tmpl + namespace: matrix +data: + homeserver.yaml: | + server_name: "starling.mynest.love" + public_baseurl: "https://starling.mynest.love" + + media_store_path: "/data/media_store" + uploads_path: "/data/uploads" + + serve_server_wellknown: true + serve_client_wellknown: true + + extra_well_known_client_content: + "m.homeserver": + base_url: "https://starling.mynest.love" + "org.matrix.msc4143.rtc_foci": + - type: livekit + livekit_service_url: "https://matrix-rtc.mynest.love" + + listeners: + - port: 8008 + tls: false + type: http + x_forwarded: true + resources: + - names: [client, federation] + compress: false + + database: + name: psycopg2 + args: + user: "${POSTGRES_USER}" + password: "${POSTGRES_PASSWORD}" + database: "synapse" + host: "postgres-svc" + cp_min: 5 + cp_max: 10 + + oidc_providers: + - idp_id: keycloak + idp_name: "Nest SSO" + discover: true + issuer: "https://sso.mynest.love/realms/nest" + client_id: "${CLIENT_ID}" + client_secret: "${CLIENT_SECRET}" + scopes: ["openid", "profile", "email"] + user_mapping_provider: + config: + localpart_template: "{{ user.preferred_username }}" + display_name_template: "{{ user.name }}" + + # MatrixRTC & LiveKit Requirements + experimental_features: + msc4140_enabled: true + msc4143_enabled: true + + macaroon_secret_key: "${SYNAPSE_MACAROON_KEY}" + form_secret: "${SYNAPSE_REGISTRATION_SECRET}" + registration_shared_secret: "${SYNAPSE_REGISTRATION_SECRET}" + enable_registration: false + report_stats: false +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: postgres + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: postgres + template: + metadata: + labels: + app: postgres + spec: + containers: + - name: postgres + image: postgres:15-alpine + env: + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: matrix-secrets + key: POSTGRES_USER + - name: POSTGRES_DB + value: "synapse" + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: matrix-secrets + key: POSTGRES_PASSWORD + - name: POSTGRES_INITDB_ARGS + value: "--encoding=UTF8 --lc-collate=C --lc-ctype=C" + ports: + - containerPort: 5432 + volumeMounts: + - name: postgres-data + mountPath: /var/lib/postgresql/data + subPath: synapse-data + volumes: + - name: postgres-data + persistentVolumeClaim: + claimName: postgres-data +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: synapse + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: synapse + template: + metadata: + labels: + app: synapse + spec: + initContainers: + - name: generate-config + image: alpine:latest + command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/homeserver.yaml > /data/homeserver.yaml && chown -R 991:991 /data"] + envFrom: + - secretRef: + name: matrix-secrets + volumeMounts: + - name: config-tmpl + mountPath: /tmpl/homeserver.yaml + subPath: homeserver.yaml + - name: synapse-data + mountPath: /data + containers: + - name: synapse + image: matrixdotorg/synapse:latest + ports: + - containerPort: 8008 + env: + - name: SYNAPSE_CONFIG_PATH + value: "/data/homeserver.yaml" + volumeMounts: + - name: synapse-data + mountPath: /data + volumes: + - name: synapse-data + persistentVolumeClaim: + claimName: synapse-data + - name: config-tmpl + configMap: + name: synapse-config-tmpl +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: livekit-config + namespace: matrix +data: + livekit.yaml: | + port: 7880 + rtc: + tcp_port: 7881 + udp_port: 7882 + use_external_ip: true + turn: + cert_file: "" + key_file: "" + tls_port: 0 + udp_port: 3478 + external_tls: false + # Crucial for Matrix integration: Only the JWT service can create rooms + room: + auto_create: false +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: livekit + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: livekit + template: + metadata: + labels: + app: livekit + spec: + containers: + - name: livekit + image: livekit/livekit-server:latest + args: ["--config", "/etc/livekit.yaml"] + ports: + - containerPort: 7880 + - containerPort: 7881 + - containerPort: 7882 + protocol: UDP + - containerPort: 3478 + protocol: UDP + env: + - name: LK_KEY + valueFrom: + secretKeyRef: + name: matrix-secrets + key: LIVEKIT_KEY + - name: LK_SECRET + valueFrom: + secretKeyRef: + name: matrix-secrets + key: LIVEKIT_SECRET + - name: LIVEKIT_KEYS + value: '$(LK_KEY): $(LK_SECRET)' + volumeMounts: + - name: config-volume + mountPath: /etc/livekit.yaml + subPath: livekit.yaml + volumes: + - name: config-volume + configMap: + name: livekit-config +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: lk-jwt-service + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: lk-jwt-service + template: + metadata: + labels: + app: lk-jwt-service + spec: + containers: + - name: lk-jwt-service + image: ghcr.io/element-hq/lk-jwt-service:0.4.2 + ports: + - containerPort: 8080 + envFrom: + - secretRef: + name: matrix-secrets + env: + - name: LIVEKIT_URL + value: "wss://matrix-rtc.mynest.love" + - name: LIVEKIT_FULL_ACCESS_HOMESERVERS + value: "starling.mynest.love" diff --git a/services/matrix-tuwunel/matrix-external-secrets.yaml b/services/matrix-tuwunel/matrix-external-secrets.yaml new file mode 100644 index 0000000..477c500 --- /dev/null +++ b/services/matrix-tuwunel/matrix-external-secrets.yaml @@ -0,0 +1,46 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: matrix-secrets + namespace: matrix +spec: + refreshInterval: "1h" + secretStoreRef: + name: vault-external-secrets-store + kind: ClusterSecretStore + target: + name: matrix-secrets + creationPolicy: Owner + data: + - secretKey: LIVEKIT_KEY + remoteRef: + key: matrix + property: livekit-key + - secretKey: LIVEKIT_SECRET + remoteRef: + key: matrix + property: livekit-secret + - secretKey: CLIENT_ID + remoteRef: + key: matrix + property: client-id + - secretKey: CLIENT_SECRET + remoteRef: + key: matrix + property: client-secret + - secretKey: POSTGRES_USER + remoteRef: + key: matrix + property: postgres-user + - secretKey: POSTGRES_PASSWORD + remoteRef: + key: matrix + property: postgres-password + - secretKey: SYNAPSE_MACAROON_KEY + remoteRef: + key: matrix + property: synapse-macaroon + - secretKey: SYNAPSE_REGISTRATION_SECRET + remoteRef: + key: matrix + property: synapse-registration diff --git a/services/matrix-tuwunel/matrix-ingress.yaml b/services/matrix-tuwunel/matrix-ingress.yaml new file mode 100644 index 0000000..46e0dbe --- /dev/null +++ b/services/matrix-tuwunel/matrix-ingress.yaml @@ -0,0 +1,67 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: matrix-ingress + namespace: matrix + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + tls: + - hosts: + - starling.mynest.love + secretName: matrix-tls + rules: + - host: starling.mynest.love + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: synapse-svc + port: + number: 8008 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: matrix-rtc-ingress + namespace: matrix + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + tls: + - hosts: + - matrix-rtc.mynest.love + secretName: matrix-rtc-tls + rules: + - host: matrix-rtc.mynest.love + http: + paths: + # 1. Route token generation traffic to the lk-jwt-service + - path: /sfu/get + pathType: Prefix + backend: + service: + name: lk-jwt-svc + port: + number: 8080 + - path: /get_token + pathType: Prefix + backend: + service: + name: lk-jwt-svc + port: + number: 8080 + # 2. Route all standard traffic and WebSockets to LiveKit + - path: / + pathType: Prefix + backend: + service: + name: livekit-svc + port: + number: 7880 diff --git a/services/matrix-tuwunel/matrix-pvcs.yaml b/services/matrix-tuwunel/matrix-pvcs.yaml new file mode 100644 index 0000000..07ea68f --- /dev/null +++ b/services/matrix-tuwunel/matrix-pvcs.yaml @@ -0,0 +1,31 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: synapse-data + namespace: matrix + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 10Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: postgres-data + namespace: matrix + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 10Gi diff --git a/services/matrix/matrix-deployment.yaml b/services/matrix/matrix-deployment.yaml deleted file mode 100644 index 7411d9f..0000000 --- a/services/matrix/matrix-deployment.yaml +++ /dev/null @@ -1,176 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: tuwunel-config - namespace: matrix -data: - tuwunel.toml: | - [global] - server_name = "starling.mynest.love" - database_path = "/var/lib/tuwunel/" - address = "0.0.0.0" - port = 6167 - allow_registration = false - - [global.well_known] - client = "https://starling.mynest.love" - livekit_url = "https://matrix-rtc.mynest.love" - - [[global.identity_provider]] - brand = "keycloak" - client_id = "matrix-tuwunel" - client_secret_file = "/etc/tuwunel/client_secret" - issuer_url = "https://sso.mynest.love/realms/nest" - callback_url = "https://starling.mynest.love/_matrix/client/unstable/login/sso/callback/matrix-tuwunel" ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: tuwunel - namespace: matrix -spec: - replicas: 1 - selector: - matchLabels: - app: tuwunel - template: - metadata: - labels: - app: tuwunel - spec: - # Prevents K8s from injecting random network variables that trigger linter warnings - enableServiceLinks: false - containers: - - name: tuwunel - image: ghcr.io/matrix-construct/tuwunel:latest - ports: - - containerPort: 6167 - env: - - name: TUWUNEL_CONFIG - value: "/etc/tuwunel/tuwunel.toml" - - name: TUWUNEL_GLOBAL__IDENTITY_PROVIDER__0__CLIENT_SECRET - valueFrom: - secretKeyRef: - name: matrix-secrets - key: client-secret - volumeMounts: - - name: tuwunel-data - mountPath: /var/lib/tuwunel/ - - name: config-volume - mountPath: /etc/tuwunel/tuwunel.toml - subPath: tuwunel.toml - - name: secret-volume - mountPath: /etc/tuwunel/client_secret - subPath: client_secret - volumes: - - name: tuwunel-data - persistentVolumeClaim: - claimName: tuwunel-data - - name: config-volume - configMap: - name: tuwunel-config - - name: secret-volume - secret: - secretName: matrix-secrets - items: - - key: client-secret - path: client_secret ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: livekit-config - namespace: matrix -data: - livekit.yaml: | - port: 7880 - rtc: - tcp_port: 7881 - udp_port: 7882 - use_external_ip: true - turn: - cert_file: "" - key_file: "" - tls_port: 0 - udp_port: 3478 - external_tls: false - # Crucial for Matrix integration: Only the JWT service can create rooms - room: - auto_create: false ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: livekit - namespace: matrix -spec: - replicas: 1 - selector: - matchLabels: - app: livekit - template: - metadata: - labels: - app: livekit - spec: - containers: - - name: livekit - image: livekit/livekit-server:latest - args: ["--config", "/etc/livekit.yaml"] - ports: - - containerPort: 7880 - - containerPort: 7881 - - containerPort: 7882 - protocol: UDP - - containerPort: 3478 - protocol: UDP - env: - - name: LK_KEY - valueFrom: - secretKeyRef: - name: matrix-secrets - key: LIVEKIT_KEY - - name: LK_SECRET - valueFrom: - secretKeyRef: - name: matrix-secrets - key: LIVEKIT_SECRET - - name: LIVEKIT_KEYS - value: "$(LK_KEY): $(LK_SECRET)" - volumeMounts: - - name: config-volume - mountPath: /etc/livekit.yaml - subPath: livekit.yaml - volumes: - - name: config-volume - configMap: - name: livekit-config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: lk-jwt-service - namespace: matrix -spec: - replicas: 1 - selector: - matchLabels: - app: lk-jwt-service - template: - metadata: - labels: - app: lk-jwt-service - spec: - containers: - - name: lk-jwt-service - image: ghcr.io/element-hq/lk-jwt-service:latest - ports: - - containerPort: 8080 - envFrom: - - secretRef: - name: matrix-secrets - env: - - name: LIVEKIT_URL - value: "wss://matrix-rtc.mynest.love" - - name: LIVEKIT_FULL_ACCESS_HOMESERVERS - value: "starling.mynest.love" diff --git a/services/matrix/matrix-external-secrets.yaml b/services/matrix/matrix-external-secrets.yaml index 30f08ce..24cc5c3 100644 --- a/services/matrix/matrix-external-secrets.yaml +++ b/services/matrix/matrix-external-secrets.yaml @@ -20,7 +20,43 @@ spec: remoteRef: key: matrix property: livekit-secret - - secretKey: client-secret + - secretKey: CLIENT_ID + remoteRef: + key: matrix + property: client-id + - secretKey: CLIENT_SECRET remoteRef: key: matrix property: client-secret + - secretKey: POSTGRES_USER + remoteRef: + key: matrix + property: postgres-user + - secretKey: POSTGRES_PASSWORD + remoteRef: + key: matrix + property: postgres-password + - secretKey: SYNAPSE_MACAROON_KEY + remoteRef: + key: matrix + property: synapse-macaroon + - secretKey: SYNAPSE_REGISTRATION_SECRET + remoteRef: + key: matrix + property: synapse-registration + - secretKey: MAS_SYNAPSE_ADMIN_SECRET + remoteRef: + key: matrix + property: mas-synapse-admin + - secretKey: MAS_SYNAPSE_CLIENT_SECRET + remoteRef: + key: matrix + property: mas-synapse-client + - secretKey: MAS_ENCRYPTION_SECRET + remoteRef: + key: matrix + property: mas-encryption-secret + - secretKey: MAS_RSA_KEY + remoteRef: + key: matrix + property: mas-rsa-key diff --git a/services/matrix/matrix-ingress.yaml b/services/matrix/matrix-ingress.yaml index 9f038c0..45ef471 100644 --- a/services/matrix/matrix-ingress.yaml +++ b/services/matrix/matrix-ingress.yaml @@ -16,13 +16,60 @@ spec: - host: starling.mynest.love http: paths: + - path: /_matrix/client/v3/login + pathType: Prefix + backend: + service: + name: mas-svc + port: + number: 8080 + - path: /_matrix/client/v3/logout + pathType: Prefix + backend: + service: + name: mas-svc + port: + number: 8080 + - path: /_matrix/client/v3/refresh + pathType: Prefix + backend: + service: + name: mas-svc + port: + number: 8080 - path: / pathType: Prefix backend: service: - name: tuwunel-svc + name: synapse-svc port: - number: 80 + number: 8008 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: mas-ingress + namespace: matrix + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" +spec: + tls: + - hosts: + - mas.mynest.love + secretName: mas-tls + rules: + - host: mas.mynest.love + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: mas-svc + port: + number: 8080 --- apiVersion: networking.k8s.io/v1 kind: Ingress @@ -42,7 +89,7 @@ spec: - host: matrix-rtc.mynest.love http: paths: - # 1. Route token generation traffic to the lk-jwt-service + # 1. Route token generation & webhook traffic to the lk-jwt-service - path: /sfu/get pathType: Prefix backend: @@ -57,6 +104,13 @@ spec: name: lk-jwt-svc port: number: 8080 + - path: /sfu_webhook + pathType: Prefix + backend: + service: + name: lk-jwt-svc + port: + number: 8080 # 2. Route all standard traffic and WebSockets to LiveKit - path: / pathType: Prefix diff --git a/services/matrix/matrix-livekit.yaml b/services/matrix/matrix-livekit.yaml new file mode 100644 index 0000000..d1c3fd6 --- /dev/null +++ b/services/matrix/matrix-livekit.yaml @@ -0,0 +1,123 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: livekit-config-tmpl + namespace: matrix +data: + livekit.yaml: | + port: 7880 + rtc: + tcp_port: 7881 + udp_port: 7882 + use_external_ip: false + node_ip: "192.168.1.160" + turn: + cert_file: "" + key_file: "" + tls_port: 0 + udp_port: 3478 + external_tls: false + # Crucial for Matrix integration: Only the JWT service can create rooms + room: + auto_create: false + webhook: + api_key: "${LIVEKIT_KEY}" # Swapped to match the key name inside matrix-secrets + urls: + - https://matrix-rtc.mynest.love/sfu_webhook +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: livekit + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: livekit + template: + metadata: + labels: + app: livekit + spec: + initContainers: + - name: generate-config + image: alpine:latest + command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/livekit.yaml > /etc/livekit/livekit.yaml"] + envFrom: + - secretRef: + name: matrix-secrets + volumeMounts: + - name: config-tmpl + mountPath: /tmpl/livekit.yaml + subPath: livekit.yaml + - name: livekit-runtime-config + mountPath: /etc/livekit + containers: + - name: livekit + image: livekit/livekit-server:latest + args: ["--config", "/etc/livekit/livekit.yaml"] # Point to the generated file path + ports: + - containerPort: 7880 + - containerPort: 7881 + - containerPort: 7882 + protocol: UDP + - containerPort: 3478 + protocol: UDP + env: + - name: LK_KEY + valueFrom: + secretKeyRef: + name: matrix-secrets + key: LIVEKIT_KEY + - name: LK_SECRET + valueFrom: + secretKeyRef: + name: matrix-secrets + key: LIVEKIT_SECRET + - name: LIVEKIT_KEYS + value: '$(LK_KEY): $(LK_SECRET)' + volumeMounts: + - name: livekit-runtime-config + mountPath: /etc/livekit + volumes: + - name: livekit-runtime-config + emptyDir: {} + - name: config-tmpl + configMap: + name: livekit-config-tmpl +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: lk-jwt-service + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: lk-jwt-service + template: + metadata: + labels: + app: lk-jwt-service + spec: + hostAliases: + - ip: "192.168.1.150" + hostnames: + - "starling.mynest.love" + - "mas.mynest.love" + - "matrix-rtc.mynest.love" + containers: + - name: lk-jwt-service + image: ghcr.io/element-hq/lk-jwt-service:0.4.2 + ports: + - containerPort: 8080 + envFrom: + - secretRef: + name: matrix-secrets + env: + - name: LIVEKIT_URL + value: "wss://matrix-rtc.mynest.love" + - name: LIVEKIT_FULL_ACCESS_HOMESERVERS + value: "starling.mynest.love" diff --git a/services/matrix/matrix-mas.yaml b/services/matrix/matrix-mas.yaml new file mode 100644 index 0000000..8dbc68f --- /dev/null +++ b/services/matrix/matrix-mas.yaml @@ -0,0 +1,111 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: mas-config-tmpl + namespace: matrix +data: + config.yaml: | + http: + listeners: + - name: web + resources: + - name: discovery + - name: human + - name: oauth + - name: compat + - name: graphql + - name: assets + binds: + - host: "::" + port: 8080 + public_base: "https://mas.mynest.love/" + + database: + uri: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres-svc:5432/mas" + + matrix: + homeserver: "starling.mynest.love" + endpoint: "http://synapse-svc:8008" + secret: "${MAS_SYNAPSE_ADMIN_SECRET}" + + clients: + - client_id: "0000000000000000000SYNAPSE" + client_auth_method: client_secret_basic + client_secret: "${MAS_SYNAPSE_CLIENT_SECRET}" + + upstream_oauth2: + providers: + - id: 01J1ABCD2345EFGH6789JKMNPQ + issuer: "https://sso.mynest.love/realms/nest" + client_id: "${CLIENT_ID}" + client_secret: "${CLIENT_SECRET}" + token_endpoint_auth_method: "client_secret_basic" + scope: "openid profile email" + claims_imports: + subject: + template: "{{ user.sub }}" + localpart: + action: "ignore" + displayname: + action: "suggest" + template: "{{ user.name }}" + email: + action: "suggest" + template: "{{ user.email }}" + set_email_verification: "always" + secrets: + encryption: "${MAS_ENCRYPTION_SECRET}" + keys: + - key_file: "/secrets/MAS_RSA_KEY" +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: mas + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: mas + template: + metadata: + labels: + app: mas + spec: + initContainers: + - name: generate-config + image: alpine:latest + command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/config.yaml > /data/config.yaml"] + envFrom: + - secretRef: + name: matrix-secrets + volumeMounts: + - name: config-tmpl + mountPath: /tmpl/config.yaml + subPath: config.yaml + - name: mas-data + mountPath: /data + containers: + - name: mas + image: ghcr.io/element-hq/matrix-authentication-service:latest + env: + - name: MAS_CONFIG + value: "/data/config.yaml" + ports: + - containerPort: 8080 + volumeMounts: + - name: mas-data + mountPath: /data + - name: secrets-volume + mountPath: /secrets + readOnly: true + volumes: + - name: mas-data + emptyDir: {} + - name: config-tmpl + configMap: + name: mas-config-tmpl + - name: secrets-volume + secret: + secretName: matrix-secrets diff --git a/services/matrix/matrix-postgres.yaml b/services/matrix/matrix-postgres.yaml new file mode 100644 index 0000000..62b3f34 --- /dev/null +++ b/services/matrix/matrix-postgres.yaml @@ -0,0 +1,57 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: postgres-init-script + namespace: matrix +data: + init-multiple-dbs.sql: | + CREATE DATABASE synapse; + CREATE DATABASE mas; +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: postgres + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: postgres + template: + metadata: + labels: + app: postgres + spec: + containers: + - name: postgres + image: postgres:15-alpine + env: + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: matrix-secrets + key: POSTGRES_USER + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: matrix-secrets + key: POSTGRES_PASSWORD + - name: POSTGRES_INITDB_ARGS + value: "--encoding=UTF8 --lc-collate=C --lc-ctype=C" + ports: + - containerPort: 5432 + volumeMounts: + - name: postgres-data + mountPath: /var/lib/postgresql/data + subPath: synapse-data + - name: init-script + mountPath: /docker-entrypoint-initdb.d/init-multiple-dbs.sql + subPath: init-multiple-dbs.sql + volumes: + - name: postgres-data + persistentVolumeClaim: + claimName: postgres-data + - name: init-script + configMap: + name: postgres-init-script diff --git a/services/matrix/matrix-pvcs.yaml b/services/matrix/matrix-pvcs.yaml index a43832d..07ea68f 100644 --- a/services/matrix/matrix-pvcs.yaml +++ b/services/matrix/matrix-pvcs.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: tuwunel-data + name: synapse-data namespace: matrix labels: recurring-job.longhorn.io/source: "enabled" @@ -12,4 +12,20 @@ spec: storageClassName: longhorn resources: requests: - storage: 5Gi + storage: 10Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: postgres-data + namespace: matrix + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 10Gi diff --git a/services/matrix/matrix-service.yaml b/services/matrix/matrix-service.yaml index 0a30694..5f2d1cb 100644 --- a/services/matrix/matrix-service.yaml +++ b/services/matrix/matrix-service.yaml @@ -1,15 +1,41 @@ apiVersion: v1 kind: Service metadata: - name: tuwunel-svc + name: synapse-svc namespace: matrix spec: selector: - app: tuwunel + app: synapse ports: - protocol: TCP - port: 80 - targetPort: 6167 + port: 8008 + targetPort: 8008 +--- +apiVersion: v1 +kind: Service +metadata: + name: postgres-svc + namespace: matrix +spec: + selector: + app: postgres + ports: + - protocol: TCP + port: 5432 + targetPort: 5432 +--- +apiVersion: v1 +kind: Service +metadata: + name: mas-svc + namespace: matrix +spec: + selector: + app: mas + ports: + - protocol: TCP + port: 8080 + targetPort: 8080 --- apiVersion: v1 kind: Service diff --git a/services/matrix/matrix-synapse.yaml b/services/matrix/matrix-synapse.yaml new file mode 100644 index 0000000..8d33271 --- /dev/null +++ b/services/matrix/matrix-synapse.yaml @@ -0,0 +1,109 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: synapse-config-tmpl + namespace: matrix +data: + homeserver.yaml: | + server_name: "starling.mynest.love" + public_baseurl: "https://starling.mynest.love" + + media_store_path: "/data/media_store" + uploads_path: "/data/uploads" + + serve_server_wellknown: true + serve_client_wellknown: true + + extra_well_known_client_content: + "org.matrix.msc4143.rtc_foci": + - type: livekit + livekit_service_url: "https://matrix-rtc.mynest.love" + + matrix_rtc: + transports: + - type: livekit + livekit_service_url: "https://matrix-rtc.mynest.love" + + listeners: + - port: 8008 + tls: false + type: http + x_forwarded: true + resources: + - names: [client, federation] + compress: false + + database: + name: psycopg2 + args: + user: "${POSTGRES_USER}" + password: "${POSTGRES_PASSWORD}" + database: "synapse" + host: "postgres-svc" + cp_min: 5 + cp_max: 10 + + experimental_features: + msc4140_enabled: true + msc4143_enabled: true + msc4222_enabled: true + msc3861: + enabled: true + issuer: "https://mas.mynest.love/" + client_id: "0000000000000000000SYNAPSE" + client_auth_method: client_secret_basic + client_secret: "${MAS_SYNAPSE_CLIENT_SECRET}" + admin_token: "${MAS_SYNAPSE_ADMIN_SECRET}" + + macaroon_secret_key: "${SYNAPSE_MACAROON_KEY}" + form_secret: "${SYNAPSE_REGISTRATION_SECRET}" + registration_shared_secret: "${SYNAPSE_REGISTRATION_SECRET}" + enable_registration: false + report_stats: false +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: synapse + namespace: matrix +spec: + replicas: 1 + selector: + matchLabels: + app: synapse + template: + metadata: + labels: + app: synapse + spec: + initContainers: + - name: generate-config + image: alpine:latest + command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/homeserver.yaml > /data/homeserver.yaml && chown -R 991:991 /data"] + envFrom: + - secretRef: + name: matrix-secrets + volumeMounts: + - name: config-tmpl + mountPath: /tmpl/homeserver.yaml + subPath: homeserver.yaml + - name: synapse-data + mountPath: /data + containers: + - name: synapse + image: matrixdotorg/synapse:latest + ports: + - containerPort: 8008 + env: + - name: SYNAPSE_CONFIG_PATH + value: "/data/homeserver.yaml" + volumeMounts: + - name: synapse-data + mountPath: /data + volumes: + - name: synapse-data + persistentVolumeClaim: + claimName: synapse-data + - name: config-tmpl + configMap: + name: synapse-config-tmpl diff --git a/services/prowlarr/prowlarr-deployment.yaml b/services/prowlarr/prowlarr-deployment.yaml index 105c7ad..39681cd 100644 --- a/services/prowlarr/prowlarr-deployment.yaml +++ b/services/prowlarr/prowlarr-deployment.yaml @@ -44,18 +44,3 @@ spec: - name: prowlarr-config persistentVolumeClaim: claimName: prowlarr-config-pvc ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: prowlarr-config-pvc - labels: - recurring-job.longhorn.io/source: "enabled" - recurring-job-group.longhorn.io/app-config-group: "enabled" -spec: - accessModes: - - ReadWriteOnce - storageClassName: longhorn - resources: - requests: - storage: 200Mi diff --git a/services/prowlarr/prowlarr-pvcs.yaml b/services/prowlarr/prowlarr-pvcs.yaml new file mode 100644 index 0000000..57a8cfa --- /dev/null +++ b/services/prowlarr/prowlarr-pvcs.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: prowlarr-config-pvc + labels: + recurring-job.longhorn.io/source: "enabled" + recurring-job-group.longhorn.io/app-config-group: "enabled" +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 1Gi