Transition to synapse

services/matrix-tuwunel/matrix-deployment.yaml

@@ -0,0 +1,255 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: synapse-config-tmpl
+  namespace: matrix
+data:
+  homeserver.yaml: |
+    server_name: "starling.mynest.love"
+    public_baseurl: "https://starling.mynest.love"
+
+    media_store_path: "/data/media_store"
+    uploads_path: "/data/uploads"
+
+    serve_server_wellknown: true
+    serve_client_wellknown: true
+    
+    extra_well_known_client_content:
+      "m.homeserver":
+        base_url: "https://starling.mynest.love"
+      "org.matrix.msc4143.rtc_foci":
+        - type: livekit
+          livekit_service_url: "https://matrix-rtc.mynest.love"
+    
+    listeners:
+      - port: 8008
+        tls: false
+        type: http
+        x_forwarded: true
+        resources:
+          - names: [client, federation]
+            compress: false
+            
+    database:
+      name: psycopg2
+      args:
+        user: "${POSTGRES_USER}"
+        password: "${POSTGRES_PASSWORD}"
+        database: "synapse"
+        host: "postgres-svc"
+        cp_min: 5
+        cp_max: 10
+        
+    oidc_providers:
+      - idp_id: keycloak
+        idp_name: "Nest SSO"
+        discover: true
+        issuer: "https://sso.mynest.love/realms/nest"
+        client_id: "${CLIENT_ID}"
+        client_secret: "${CLIENT_SECRET}"
+        scopes: ["openid", "profile", "email"]
+        user_mapping_provider:
+          config:
+            localpart_template: "{{ user.preferred_username }}"
+            display_name_template: "{{ user.name }}"
+            
+    # MatrixRTC & LiveKit Requirements
+    experimental_features:
+      msc4140_enabled: true
+      msc4143_enabled: true
+      
+    macaroon_secret_key: "${SYNAPSE_MACAROON_KEY}"
+    form_secret: "${SYNAPSE_REGISTRATION_SECRET}"
+    registration_shared_secret: "${SYNAPSE_REGISTRATION_SECRET}"
+    enable_registration: false
+    report_stats: false
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:15-alpine
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_DB
+              value: "synapse"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_INITDB_ARGS
+              value: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+              subPath: synapse-data
+      volumes:
+        - name: postgres-data
+          persistentVolumeClaim:
+            claimName: postgres-data
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: synapse
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: synapse
+  template:
+    metadata:
+      labels:
+        app: synapse
+    spec:
+      initContainers:
+        - name: generate-config
+          image: alpine:latest
+          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/homeserver.yaml > /data/homeserver.yaml && chown -R 991:991 /data"]
+          envFrom:
+            - secretRef:
+                name: matrix-secrets
+          volumeMounts:
+            - name: config-tmpl
+              mountPath: /tmpl/homeserver.yaml
+              subPath: homeserver.yaml
+            - name: synapse-data
+              mountPath: /data
+      containers:
+        - name: synapse
+          image: matrixdotorg/synapse:latest
+          ports:
+            - containerPort: 8008
+          env:
+            - name: SYNAPSE_CONFIG_PATH
+              value: "/data/homeserver.yaml"
+          volumeMounts:
+            - name: synapse-data
+              mountPath: /data
+      volumes:
+        - name: synapse-data
+          persistentVolumeClaim:
+            claimName: synapse-data
+        - name: config-tmpl
+          configMap:
+            name: synapse-config-tmpl
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: livekit-config
+  namespace: matrix
+data:
+  livekit.yaml: |
+    port: 7880
+    rtc:
+      tcp_port: 7881
+      udp_port: 7882
+      use_external_ip: true
+    turn:
+      cert_file: ""
+      key_file: ""
+      tls_port: 0
+      udp_port: 3478
+      external_tls: false
+    # Crucial for Matrix integration: Only the JWT service can create rooms
+    room:
+      auto_create: false
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: livekit
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: livekit
+  template:
+    metadata:
+      labels:
+        app: livekit
+    spec:
+      containers:
+        - name: livekit
+          image: livekit/livekit-server:latest
+          args: ["--config", "/etc/livekit.yaml"]
+          ports:
+            - containerPort: 7880
+            - containerPort: 7881
+            - containerPort: 7882
+              protocol: UDP
+            - containerPort: 3478
+              protocol: UDP
+          env:
+            - name: LK_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: LIVEKIT_KEY
+            - name: LK_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: LIVEKIT_SECRET
+            - name: LIVEKIT_KEYS
+              value: '$(LK_KEY): $(LK_SECRET)'
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/livekit.yaml
+              subPath: livekit.yaml
+      volumes:
+        - name: config-volume
+          configMap:
+            name: livekit-config
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lk-jwt-service
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lk-jwt-service
+  template:
+    metadata:
+      labels:
+        app: lk-jwt-service
+    spec:
+      containers:
+        - name: lk-jwt-service
+          image: ghcr.io/element-hq/lk-jwt-service:0.4.2
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - secretRef:
+                name: matrix-secrets
+          env:
+            - name: LIVEKIT_URL
+              value: "wss://matrix-rtc.mynest.love"
+            - name: LIVEKIT_FULL_ACCESS_HOMESERVERS
+              value: "starling.mynest.love"

services/matrix-tuwunel/matrix-external-secrets.yaml

@@ -0,0 +1,46 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: matrix-secrets
+  namespace: matrix
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: matrix-secrets
+    creationPolicy: Owner
+  data:
+  - secretKey: LIVEKIT_KEY
+    remoteRef:
+      key: matrix
+      property: livekit-key
+  - secretKey: LIVEKIT_SECRET
+    remoteRef:
+      key: matrix
+      property: livekit-secret
+  - secretKey: CLIENT_ID
+    remoteRef:
+      key: matrix
+      property: client-id
+  - secretKey: CLIENT_SECRET
+    remoteRef:
+      key: matrix
+      property: client-secret
+  - secretKey: POSTGRES_USER
+    remoteRef:
+      key: matrix
+      property: postgres-user
+  - secretKey: POSTGRES_PASSWORD
+    remoteRef:
+      key: matrix
+      property: postgres-password
+  - secretKey: SYNAPSE_MACAROON_KEY
+    remoteRef:
+      key: matrix
+      property: synapse-macaroon
+  - secretKey: SYNAPSE_REGISTRATION_SECRET
+    remoteRef:
+      key: matrix
+      property: synapse-registration

services/matrix-tuwunel/matrix-ingress.yaml

@@ -0,0 +1,67 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-ingress
+  namespace: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  tls:
+    - hosts:
+        - starling.mynest.love
+      secretName: matrix-tls
+  rules:
+    - host: starling.mynest.love
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse-svc
+                port:
+                  number: 8008
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-rtc-ingress
+  namespace: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  tls:
+    - hosts:
+        - matrix-rtc.mynest.love
+      secretName: matrix-rtc-tls
+  rules:
+    - host: matrix-rtc.mynest.love
+      http:
+        paths:
+          # 1. Route token generation traffic to the lk-jwt-service
+          - path: /sfu/get
+            pathType: Prefix
+            backend:
+              service:
+                name: lk-jwt-svc
+                port:
+                  number: 8080
+          - path: /get_token
+            pathType: Prefix
+            backend:
+              service:
+                name: lk-jwt-svc
+                port:
+                  number: 8080
+          # 2. Route all standard traffic and WebSockets to LiveKit
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: livekit-svc
+                port:
+                  number: 7880

services/matrix-tuwunel/matrix-pvcs.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: synapse-data
+  namespace: matrix
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-data
+  namespace: matrix
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi

services/matrix/matrix-deployment.yaml

@@ -1,176 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tuwunel-config
-  namespace: matrix
-data:
-  tuwunel.toml: |
-    [global]
-    server_name = "starling.mynest.love"
-    database_path = "/var/lib/tuwunel/"
-    address = "0.0.0.0"
-    port = 6167
-    allow_registration = false
-
-    [global.well_known]
-    client = "https://starling.mynest.love"
-    livekit_url = "https://matrix-rtc.mynest.love" 
-
-    [[global.identity_provider]]
-    brand = "keycloak"
-    client_id = "matrix-tuwunel"
-    client_secret_file = "/etc/tuwunel/client_secret"
-    issuer_url = "https://sso.mynest.love/realms/nest"
-    callback_url = "https://starling.mynest.love/_matrix/client/unstable/login/sso/callback/matrix-tuwunel"
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tuwunel
-  namespace: matrix
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tuwunel
-  template:
-    metadata:
-      labels:
-        app: tuwunel
-    spec:
-      # Prevents K8s from injecting random network variables that trigger linter warnings
-      enableServiceLinks: false
-      containers:
-        - name: tuwunel
-          image: ghcr.io/matrix-construct/tuwunel:latest
-          ports:
-            - containerPort: 6167
-          env:
-            - name: TUWUNEL_CONFIG
-              value: "/etc/tuwunel/tuwunel.toml"
-            - name: TUWUNEL_GLOBAL__IDENTITY_PROVIDER__0__CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: matrix-secrets
-                  key: client-secret
-          volumeMounts:
-            - name: tuwunel-data
-              mountPath: /var/lib/tuwunel/
-            - name: config-volume
-              mountPath: /etc/tuwunel/tuwunel.toml
-              subPath: tuwunel.toml
-            - name: secret-volume
-              mountPath: /etc/tuwunel/client_secret
-              subPath: client_secret
-      volumes:
-        - name: tuwunel-data
-          persistentVolumeClaim:
-            claimName: tuwunel-data
-        - name: config-volume
-          configMap:
-            name: tuwunel-config
-        - name: secret-volume
-          secret:
-            secretName: matrix-secrets
-            items:
-              - key: client-secret
-                path: client_secret
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: livekit-config
-  namespace: matrix
-data:
-  livekit.yaml: |
-    port: 7880
-    rtc:
-      tcp_port: 7881
-      udp_port: 7882
-      use_external_ip: true
-    turn:
-      cert_file: ""
-      key_file: ""
-      tls_port: 0
-      udp_port: 3478
-      external_tls: false
-    # Crucial for Matrix integration: Only the JWT service can create rooms
-    room:
-      auto_create: false
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: livekit
-  namespace: matrix
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: livekit
-  template:
-    metadata:
-      labels:
-        app: livekit
-    spec:
-      containers:
-        - name: livekit
-          image: livekit/livekit-server:latest
-          args: ["--config", "/etc/livekit.yaml"]
-          ports:
-            - containerPort: 7880
-            - containerPort: 7881
-            - containerPort: 7882
-              protocol: UDP
-            - containerPort: 3478
-              protocol: UDP
-          env:
-            - name: LK_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: matrix-secrets
-                  key: LIVEKIT_KEY
-            - name: LK_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: matrix-secrets
-                  key: LIVEKIT_SECRET
-            - name: LIVEKIT_KEYS
-              value: "$(LK_KEY): $(LK_SECRET)"
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/livekit.yaml
-              subPath: livekit.yaml
-      volumes:
-        - name: config-volume
-          configMap:
-            name: livekit-config
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lk-jwt-service
-  namespace: matrix
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: lk-jwt-service
-  template:
-    metadata:
-      labels:
-        app: lk-jwt-service
-    spec:
-      containers:
-        - name: lk-jwt-service
-          image: ghcr.io/element-hq/lk-jwt-service:latest
-          ports:
-            - containerPort: 8080
-          envFrom:
-            - secretRef:
-                name: matrix-secrets
-          env:
-            - name: LIVEKIT_URL
-              value: "wss://matrix-rtc.mynest.love"
-            - name: LIVEKIT_FULL_ACCESS_HOMESERVERS
-              value: "starling.mynest.love"

services/matrix/matrix-external-secrets.yaml

@@ -20,7 +20,43 @@ spec:
     remoteRef:
       key: matrix
       property: livekit-secret
-  - secretKey: client-secret
+  - secretKey: CLIENT_ID
+    remoteRef:
+      key: matrix
+      property: client-id
+  - secretKey: CLIENT_SECRET
     remoteRef:
       key: matrix
       property: client-secret
+  - secretKey: POSTGRES_USER
+    remoteRef:
+      key: matrix
+      property: postgres-user
+  - secretKey: POSTGRES_PASSWORD
+    remoteRef:
+      key: matrix
+      property: postgres-password
+  - secretKey: SYNAPSE_MACAROON_KEY
+    remoteRef:
+      key: matrix
+      property: synapse-macaroon
+  - secretKey: SYNAPSE_REGISTRATION_SECRET
+    remoteRef:
+      key: matrix
+      property: synapse-registration
+  - secretKey: MAS_SYNAPSE_ADMIN_SECRET
+    remoteRef:
+      key: matrix
+      property: mas-synapse-admin
+  - secretKey: MAS_SYNAPSE_CLIENT_SECRET
+    remoteRef:
+      key: matrix
+      property: mas-synapse-client
+  - secretKey: MAS_ENCRYPTION_SECRET
+    remoteRef:
+      key: matrix
+      property: mas-encryption-secret
+  - secretKey: MAS_RSA_KEY
+    remoteRef:
+      key: matrix
+      property: mas-rsa-key

services/matrix/matrix-ingress.yaml

@@ -16,13 +16,60 @@ spec:
     - host: starling.mynest.love
       http:
         paths:
+          - path: /_matrix/client/v3/login
+            pathType: Prefix
+            backend:
+              service:
+                name: mas-svc
+                port:
+                  number: 8080
+          - path: /_matrix/client/v3/logout
+            pathType: Prefix
+            backend:
+              service:
+                name: mas-svc
+                port:
+                  number: 8080
+          - path: /_matrix/client/v3/refresh
+            pathType: Prefix
+            backend:
+              service:
+                name: mas-svc
+                port:
+                  number: 8080
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: tuwunel-svc
+                name: synapse-svc
                 port:
-                  number: 80
+                  number: 8008
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mas-ingress
+  namespace: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  tls:
+    - hosts:
+        - mas.mynest.love
+      secretName: mas-tls
+  rules:
+    - host: mas.mynest.love
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: mas-svc
+                port:
+                  number: 8080
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -42,7 +89,7 @@ spec:
     - host: matrix-rtc.mynest.love
       http:
         paths:
-          # 1. Route token generation traffic to the lk-jwt-service
+          # 1. Route token generation & webhook traffic to the lk-jwt-service
           - path: /sfu/get
             pathType: Prefix
             backend:
@@ -57,6 +104,13 @@ spec:
                 name: lk-jwt-svc
                 port:
                   number: 8080
+          - path: /sfu_webhook
+            pathType: Prefix
+            backend:
+              service:
+                name: lk-jwt-svc
+                port:
+                  number: 8080
           # 2. Route all standard traffic and WebSockets to LiveKit
           - path: /
             pathType: Prefix

services/matrix/matrix-livekit.yaml

@@ -0,0 +1,123 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: livekit-config-tmpl
+  namespace: matrix
+data:
+  livekit.yaml: |
+    port: 7880
+    rtc:
+      tcp_port: 7881
+      udp_port: 7882
+      use_external_ip: false
+      node_ip: "192.168.1.160"
+    turn:
+      cert_file: ""
+      key_file: ""
+      tls_port: 0
+      udp_port: 3478
+      external_tls: false
+    # Crucial for Matrix integration: Only the JWT service can create rooms
+    room:
+      auto_create: false
+    webhook:
+      api_key: "${LIVEKIT_KEY}" # Swapped to match the key name inside matrix-secrets
+      urls:
+        - https://matrix-rtc.mynest.love/sfu_webhook
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: livekit
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: livekit
+  template:
+    metadata:
+      labels:
+        app: livekit
+    spec:
+      initContainers:
+        - name: generate-config
+          image: alpine:latest
+          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/livekit.yaml > /etc/livekit/livekit.yaml"]
+          envFrom:
+            - secretRef:
+                name: matrix-secrets
+          volumeMounts:
+            - name: config-tmpl
+              mountPath: /tmpl/livekit.yaml
+              subPath: livekit.yaml
+            - name: livekit-runtime-config
+              mountPath: /etc/livekit
+      containers:
+        - name: livekit
+          image: livekit/livekit-server:latest
+          args: ["--config", "/etc/livekit/livekit.yaml"] # Point to the generated file path
+          ports:
+            - containerPort: 7880
+            - containerPort: 7881
+            - containerPort: 7882
+              protocol: UDP
+            - containerPort: 3478
+              protocol: UDP
+          env:
+            - name: LK_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: LIVEKIT_KEY
+            - name: LK_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: LIVEKIT_SECRET
+            - name: LIVEKIT_KEYS
+              value: '$(LK_KEY): $(LK_SECRET)'
+          volumeMounts:
+            - name: livekit-runtime-config
+              mountPath: /etc/livekit
+      volumes:
+        - name: livekit-runtime-config
+          emptyDir: {}
+        - name: config-tmpl
+          configMap:
+            name: livekit-config-tmpl
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lk-jwt-service
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: lk-jwt-service
+  template:
+    metadata:
+      labels:
+        app: lk-jwt-service
+    spec:
+      hostAliases:
+        - ip: "192.168.1.150"
+          hostnames:
+            - "starling.mynest.love"
+            - "mas.mynest.love"
+            - "matrix-rtc.mynest.love"
+      containers:
+        - name: lk-jwt-service
+          image: ghcr.io/element-hq/lk-jwt-service:0.4.2
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - secretRef:
+                name: matrix-secrets
+          env:
+            - name: LIVEKIT_URL
+              value: "wss://matrix-rtc.mynest.love"
+            - name: LIVEKIT_FULL_ACCESS_HOMESERVERS
+              value: "starling.mynest.love"

services/matrix/matrix-mas.yaml

@@ -0,0 +1,111 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mas-config-tmpl
+  namespace: matrix
+data:
+  config.yaml: |
+    http:
+      listeners:
+        - name: web
+          resources:
+            - name: discovery
+            - name: human
+            - name: oauth
+            - name: compat
+            - name: graphql
+            - name: assets
+          binds:
+            - host: "::"
+              port: 8080
+      public_base: "https://mas.mynest.love/"
+      
+    database:
+      uri: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres-svc:5432/mas"
+      
+    matrix:
+      homeserver: "starling.mynest.love"
+      endpoint: "http://synapse-svc:8008"
+      secret: "${MAS_SYNAPSE_ADMIN_SECRET}"
+
+    clients:
+      - client_id: "0000000000000000000SYNAPSE"
+        client_auth_method: client_secret_basic
+        client_secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
+
+    upstream_oauth2:
+      providers:
+        - id: 01J1ABCD2345EFGH6789JKMNPQ
+          issuer: "https://sso.mynest.love/realms/nest"
+          client_id: "${CLIENT_ID}"
+          client_secret: "${CLIENT_SECRET}"
+          token_endpoint_auth_method: "client_secret_basic"
+          scope: "openid profile email"
+          claims_imports:
+            subject:
+              template: "{{ user.sub }}"
+            localpart:
+              action: "ignore"
+            displayname:
+              action: "suggest"
+              template: "{{ user.name }}"
+            email:
+              action: "suggest"
+              template: "{{ user.email }}"
+              set_email_verification: "always"
+    secrets:
+      encryption: "${MAS_ENCRYPTION_SECRET}"
+      keys:
+        - key_file: "/secrets/MAS_RSA_KEY"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mas
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mas
+  template:
+    metadata:
+      labels:
+        app: mas
+    spec:
+      initContainers:
+        - name: generate-config
+          image: alpine:latest
+          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/config.yaml > /data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: matrix-secrets
+          volumeMounts:
+            - name: config-tmpl
+              mountPath: /tmpl/config.yaml
+              subPath: config.yaml
+            - name: mas-data
+              mountPath: /data
+      containers:
+        - name: mas
+          image: ghcr.io/element-hq/matrix-authentication-service:latest
+          env:
+            - name: MAS_CONFIG
+              value: "/data/config.yaml"
+          ports:
+            - containerPort: 8080
+          volumeMounts:
+            - name: mas-data
+              mountPath: /data
+            - name: secrets-volume
+              mountPath: /secrets
+              readOnly: true
+      volumes:
+        - name: mas-data
+          emptyDir: {}
+        - name: config-tmpl
+          configMap:
+            name: mas-config-tmpl
+        - name: secrets-volume
+          secret:
+            secretName: matrix-secrets

services/matrix/matrix-postgres.yaml

@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-init-script
+  namespace: matrix
+data:
+  init-multiple-dbs.sql: |
+    CREATE DATABASE synapse;
+    CREATE DATABASE mas;
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:15-alpine
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: matrix-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRES_INITDB_ARGS
+              value: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+              subPath: synapse-data
+            - name: init-script
+              mountPath: /docker-entrypoint-initdb.d/init-multiple-dbs.sql
+              subPath: init-multiple-dbs.sql
+      volumes:
+        - name: postgres-data
+          persistentVolumeClaim:
+            claimName: postgres-data
+        - name: init-script
+          configMap:
+            name: postgres-init-script

services/matrix/matrix-pvcs.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: tuwunel-data
+  name: synapse-data
   namespace: matrix
   labels:
     recurring-job.longhorn.io/source: "enabled"
@@ -12,4 +12,20 @@ spec:
   storageClassName: longhorn
   resources:
     requests:
-      storage: 5Gi
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-data
+  namespace: matrix
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi

services/matrix/matrix-service.yaml

@@ -1,15 +1,41 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: tuwunel-svc
+  name: synapse-svc
   namespace: matrix
 spec:
   selector:
-    app: tuwunel
+    app: synapse
   ports:
     - protocol: TCP
-      port: 80
-      targetPort: 6167
+      port: 8008
+      targetPort: 8008
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-svc
+  namespace: matrix
+spec:
+  selector:
+    app: postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mas-svc
+  namespace: matrix
+spec:
+  selector:
+    app: mas
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
 ---
 apiVersion: v1
 kind: Service

services/matrix/matrix-synapse.yaml

@@ -0,0 +1,109 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: synapse-config-tmpl
+  namespace: matrix
+data:
+  homeserver.yaml: |
+    server_name: "starling.mynest.love"
+    public_baseurl: "https://starling.mynest.love"
+
+    media_store_path: "/data/media_store"
+    uploads_path: "/data/uploads"
+
+    serve_server_wellknown: true
+    serve_client_wellknown: true
+    
+    extra_well_known_client_content:
+      "org.matrix.msc4143.rtc_foci":
+        - type: livekit
+          livekit_service_url: "https://matrix-rtc.mynest.love"
+
+    matrix_rtc:
+      transports:
+        - type: livekit
+          livekit_service_url: "https://matrix-rtc.mynest.love"
+    
+    listeners:
+      - port: 8008
+        tls: false
+        type: http
+        x_forwarded: true
+        resources:
+          - names: [client, federation]
+            compress: false
+            
+    database:
+      name: psycopg2
+      args:
+        user: "${POSTGRES_USER}"
+        password: "${POSTGRES_PASSWORD}"
+        database: "synapse"
+        host: "postgres-svc"
+        cp_min: 5
+        cp_max: 10
+        
+    experimental_features:
+      msc4140_enabled: true
+      msc4143_enabled: true
+      msc4222_enabled: true
+      msc3861:
+        enabled: true
+        issuer: "https://mas.mynest.love/"
+        client_id: "0000000000000000000SYNAPSE"
+        client_auth_method: client_secret_basic
+        client_secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
+        admin_token: "${MAS_SYNAPSE_ADMIN_SECRET}"
+      
+    macaroon_secret_key: "${SYNAPSE_MACAROON_KEY}"
+    form_secret: "${SYNAPSE_REGISTRATION_SECRET}"
+    registration_shared_secret: "${SYNAPSE_REGISTRATION_SECRET}"
+    enable_registration: false
+    report_stats: false
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: synapse
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: synapse
+  template:
+    metadata:
+      labels:
+        app: synapse
+    spec:
+      initContainers:
+        - name: generate-config
+          image: alpine:latest
+          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/homeserver.yaml > /data/homeserver.yaml && chown -R 991:991 /data"]
+          envFrom:
+            - secretRef:
+                name: matrix-secrets
+          volumeMounts:
+            - name: config-tmpl
+              mountPath: /tmpl/homeserver.yaml
+              subPath: homeserver.yaml
+            - name: synapse-data
+              mountPath: /data
+      containers:
+        - name: synapse
+          image: matrixdotorg/synapse:latest
+          ports:
+            - containerPort: 8008
+          env:
+            - name: SYNAPSE_CONFIG_PATH
+              value: "/data/homeserver.yaml"
+          volumeMounts:
+            - name: synapse-data
+              mountPath: /data
+      volumes:
+        - name: synapse-data
+          persistentVolumeClaim:
+            claimName: synapse-data
+        - name: config-tmpl
+          configMap:
+            name: synapse-config-tmpl

services/prowlarr/prowlarr-deployment.yaml

@@ -44,18 +44,3 @@ spec:
         - name: prowlarr-config
           persistentVolumeClaim:
             claimName: prowlarr-config-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prowlarr-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 200Mi

services/prowlarr/prowlarr-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prowlarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi