112 lines
2.9 KiB
YAML
112 lines
2.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: mas-config-tmpl
|
|
namespace: matrix
|
|
data:
|
|
config.yaml: |
|
|
http:
|
|
listeners:
|
|
- name: web
|
|
resources:
|
|
- name: discovery
|
|
- name: human
|
|
- name: oauth
|
|
- name: compat
|
|
- name: graphql
|
|
- name: assets
|
|
- name: adminapi
|
|
binds:
|
|
- host: "::"
|
|
port: 8080
|
|
public_base: "https://mas.mynest.love/"
|
|
|
|
database:
|
|
uri: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres-svc:5432/mas"
|
|
|
|
matrix:
|
|
homeserver: "starling.mynest.love"
|
|
endpoint: "http://synapse-svc:8008"
|
|
secret: "${MAS_SYNAPSE_CLIENT_SECRET}"
|
|
|
|
upstream_oauth2:
|
|
providers:
|
|
- id: 01J1ABCD2345EFGH6789JKMNPQ
|
|
issuer: "https://sso.mynest.love/realms/nest"
|
|
client_id: "${CLIENT_ID}"
|
|
client_secret: "${CLIENT_SECRET}"
|
|
token_endpoint_auth_method: "client_secret_basic"
|
|
scope: "openid profile email"
|
|
claims_imports:
|
|
subject:
|
|
template: "{{ user.sub }}"
|
|
localpart:
|
|
action: "ignore"
|
|
displayname:
|
|
action: "suggest"
|
|
template: "{{ user.name }}"
|
|
email:
|
|
action: "suggest"
|
|
template: "{{ user.email }}"
|
|
set_email_verification: "always"
|
|
|
|
secrets:
|
|
encryption: "${MAS_ENCRYPTION_SECRET}"
|
|
keys:
|
|
- key_file: "/secrets/MAS_RSA_KEY"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mas
|
|
namespace: matrix
|
|
annotations:
|
|
keel.sh/policy: "all"
|
|
keel.sh/match-tag: "true"
|
|
keel.sh/schedule: "0 3 * * *"
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: mas
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: mas
|
|
spec:
|
|
initContainers:
|
|
- name: generate-config
|
|
image: alpine:latest
|
|
command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/config.yaml > /data/config.yaml"]
|
|
envFrom:
|
|
- secretRef:
|
|
name: matrix-secrets
|
|
volumeMounts:
|
|
- name: config-tmpl
|
|
mountPath: /tmpl/config.yaml
|
|
subPath: config.yaml
|
|
- name: mas-data
|
|
mountPath: /data
|
|
containers:
|
|
- name: mas
|
|
image: ghcr.io/element-hq/matrix-authentication-service:latest
|
|
env:
|
|
- name: MAS_CONFIG
|
|
value: "/data/config.yaml"
|
|
ports:
|
|
- containerPort: 8080
|
|
volumeMounts:
|
|
- name: mas-data
|
|
mountPath: /data
|
|
- name: secrets-volume
|
|
mountPath: /secrets
|
|
readOnly: true
|
|
volumes:
|
|
- name: mas-data
|
|
emptyDir: {}
|
|
- name: config-tmpl
|
|
configMap:
|
|
name: mas-config-tmpl
|
|
- name: secrets-volume
|
|
secret:
|
|
secretName: matrix-secrets
|