Move janky.solutions matrix homeserver into kubernetes
This commit is contained in:
parent
fe000d186e
commit
eced9bae67
19 changed files with 354 additions and 73 deletions
|
@ -3,7 +3,7 @@ kind: Kustomization
|
|||
resources:
|
||||
- operators
|
||||
- system
|
||||
- adsb
|
||||
# - adsb
|
||||
- forgejo
|
||||
- generic-device-plugin
|
||||
- invoiceninja
|
||||
|
@ -11,6 +11,6 @@ resources:
|
|||
- monitoring
|
||||
- s3staticsites
|
||||
- shlink
|
||||
- system-upgrade
|
||||
- system-upgrade-controller
|
||||
- keycloak
|
||||
- miniflux
|
||||
|
|
14
k8s/matrix/appservices-janky.solutions/facebook.yaml
Normal file
14
k8s/matrix/appservices-janky.solutions/facebook.yaml
Normal file
|
@ -0,0 +1,14 @@
|
|||
id: facebook
|
||||
url: http://bridge-facebook:29319
|
||||
as_token: SECRET_FACEBOOK_AS_TOKEN
|
||||
hs_token: SECRET_FACEBOOK_HS_TOKEN
|
||||
sender_localpart: SECRET_FACEBOOK_LOCALPART
|
||||
rate_limited: false
|
||||
namespaces:
|
||||
users:
|
||||
- regex: ^@facebookbot:janky\.solutions$
|
||||
exclusive: true
|
||||
- regex: ^@facebook_.*:janky\.solutions$
|
||||
exclusive: true
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
push_ephemeral: true
|
14
k8s/matrix/appservices-janky.solutions/signal.yaml
Normal file
14
k8s/matrix/appservices-janky.solutions/signal.yaml
Normal file
|
@ -0,0 +1,14 @@
|
|||
id: signal
|
||||
url: http://bridge-signal:29328
|
||||
as_token: SECRET_SIGNAL_AS_TOKEN
|
||||
hs_token: SECRET_SIGNAL_HS_TOKEN
|
||||
sender_localpart: SECRET_SIGNAL_LOCALPART
|
||||
rate_limited: false
|
||||
namespaces:
|
||||
users:
|
||||
- regex: ^@signalbot:janky\.solutions$
|
||||
exclusive: true
|
||||
- regex: ^@signal_.*:janky\.solutions$
|
||||
exclusive: true
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
push_ephemeral: true
|
17
k8s/matrix/appservices-janky.solutions/telegram.yaml
Normal file
17
k8s/matrix/appservices-janky.solutions/telegram.yaml
Normal file
|
@ -0,0 +1,17 @@
|
|||
id: telegram
|
||||
as_token: SECRET_TELEGRAM_AS_TOKEN
|
||||
hs_token: SECRET_TELEGRAM_HS_TOKEN
|
||||
namespaces:
|
||||
users:
|
||||
- exclusive: true
|
||||
regex: '@telegram_.*:janky\.solutions'
|
||||
- exclusive: true
|
||||
regex: '@telegrambot:janky\.solutions'
|
||||
aliases:
|
||||
- exclusive: true
|
||||
regex: \#telegram_.*:janky\.solutions
|
||||
url: http://bridge-telegram:29317
|
||||
sender_localpart: SECRET_TELEGRAM_SENDER_LOCALPART
|
||||
rate_limited: false
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
push_ephemeral: true
|
|
@ -46,9 +46,9 @@ spec:
|
|||
app: bridge-facebook
|
||||
spec:
|
||||
initContainers:
|
||||
- name: template-config
|
||||
- name: initialize-secrets
|
||||
image: docker.io/library/python
|
||||
command: ["python", "/init/initialize-bridge.py"]
|
||||
command: ["python", "/init/initialize-secrets.py", "config.yaml"]
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /init
|
||||
|
@ -78,7 +78,7 @@ spec:
|
|||
name: bridge-facebook
|
||||
- name: init
|
||||
configMap:
|
||||
name: bridge-init
|
||||
name: secrets-init
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: storage
|
|
@ -1,14 +0,0 @@
|
|||
#!/usr/bin/python
|
||||
import os
|
||||
|
||||
with open("/config/config.yaml") as r:
|
||||
c = r.read()
|
||||
|
||||
for i in ["AS_TOKEN", "HS_TOKEN", "TG_API_ID", "TG_API_HASH"]:
|
||||
value = os.getenv(i)
|
||||
if value is not None:
|
||||
c = c.replace(i, value)
|
||||
print("replaced", i)
|
||||
|
||||
with open("/data/config.yaml", 'w') as w:
|
||||
w.write(c)
|
|
@ -1,7 +0,0 @@
|
|||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
cp /config/config.yaml /data/config.yaml
|
||||
sed -i "s#AS_TOKEN#${AS_TOKEN}#g" /data/config.yaml
|
||||
sed -i "s#HS_TOKEN#${HS_TOKEN}#g" /data/config.yaml
|
||||
sed -i "s#TG_API_ID#${TG_API_ID}#g" /data/config.yaml
|
||||
sed -i "s#TG_API_HASH#${TG_API_HASH}#g" /data/config.yaml
|
|
@ -41,14 +41,11 @@ spec:
|
|||
metadata:
|
||||
labels:
|
||||
app: bridge-signal
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8000"
|
||||
spec:
|
||||
initContainers:
|
||||
- name: template-config
|
||||
- name: initialize-secrets
|
||||
image: docker.io/library/python
|
||||
command: ["python", "/init/initialize-bridge.py"]
|
||||
command: ["python", "/init/initialize-secrets.py", "config.yaml"]
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /init
|
||||
|
@ -77,7 +74,7 @@ spec:
|
|||
name: bridge-signal
|
||||
- name: init
|
||||
configMap:
|
||||
name: bridge-init
|
||||
name: secrets-init
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: storage
|
||||
|
|
|
@ -62,14 +62,11 @@ spec:
|
|||
metadata:
|
||||
labels:
|
||||
app: bridge-telegram
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8000"
|
||||
spec:
|
||||
initContainers:
|
||||
- name: template-config
|
||||
- name: initialize-secrets
|
||||
image: docker.io/library/python
|
||||
command: ["python", "/init/initialize-bridge.py"]
|
||||
command: ["python", "/init/initialize-secrets.py", "config.yaml"]
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /init
|
||||
|
@ -99,7 +96,7 @@ spec:
|
|||
name: bridge-telegram
|
||||
- name: init
|
||||
configMap:
|
||||
name: bridge-init
|
||||
name: secrets-init
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: storage
|
||||
|
|
|
@ -1,21 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: bridge-init
|
||||
namespace: matrix
|
||||
data:
|
||||
initialize-bridge.py: | # TODO: migrate this and it's users to secrets-init/secrets-init.py which is similar but more generic
|
||||
#!/usr/bin/python
|
||||
import os
|
||||
|
||||
with open("/config/config.yaml") as r:
|
||||
c = r.read()
|
||||
|
||||
for i in ["AS_TOKEN", "HS_TOKEN", "TG_API_ID", "TG_API_HASH"]:
|
||||
value = os.getenv(i)
|
||||
if value is not None:
|
||||
c = c.replace(i, value)
|
||||
print("replaced", i)
|
||||
|
||||
with open("/data/config.yaml", 'w') as w:
|
||||
w.write(c)
|
82
k8s/matrix/config-janky.solutions/homeserver.yaml
Normal file
82
k8s/matrix/config-janky.solutions/homeserver.yaml
Normal file
|
@ -0,0 +1,82 @@
|
|||
server_name: "janky.solutions"
|
||||
pid_file: /data/homeserver.pid
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
- port: 8000
|
||||
type: http
|
||||
bind_addresses: ['0.0.0.0']
|
||||
resources:
|
||||
- names: [metrics]
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
host: janky-solutions-homeserver-database.matrix.svc.cluster.local
|
||||
dbname: matrix
|
||||
log_config: "/config/log.yaml"
|
||||
media_store_path: /data/media_store
|
||||
registration_shared_secret: "SECRET_registration_shared_secret"
|
||||
report_stats: false
|
||||
macaroon_secret_key: "SECRET_macaroon_secret_key"
|
||||
form_secret: "SECRET_form_secret"
|
||||
signing_key_path: "/secrets/janky.solutions.signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
public_baseurl: https://matrix.janky.solutions
|
||||
ip_range_whitelist: [10.5.1.245,10.5.1.1]
|
||||
oidc_providers:
|
||||
- idp_id: keycloak
|
||||
idp_name: "Janky Solutions Auth"
|
||||
issuer: "https://auth.janky.solutions/realms/janky.solutions"
|
||||
client_id: "synapse"
|
||||
client_secret: SECRET_oidc_secret
|
||||
scopes: ["openid", "profile"]
|
||||
user_mapping_provider:
|
||||
config:
|
||||
localpart_template: "{{ user.preferred_username }}"
|
||||
display_name_template: "{{ user.name }}"
|
||||
backchannel_logout_enabled: true # Optional
|
||||
password_config:
|
||||
enabled: false
|
||||
app_service_config_files:
|
||||
- /appservices/facebook.yaml
|
||||
- /appservices/telegram.yaml
|
||||
- /appservices/signal.yaml
|
||||
media_storage_providers:
|
||||
- module: s3_storage_provider.S3StorageProviderBackend
|
||||
store_local: True
|
||||
store_remote: True
|
||||
store_synchronous: True
|
||||
config:
|
||||
bucket: matrix-media
|
||||
# All of the below options are optional, for use with non-AWS S3-like
|
||||
# services, or to specify access tokens here instead of some external method.
|
||||
region_name: sea-01
|
||||
endpoint_url: https://storage.home.finn.io
|
||||
access_key_id: SECRET_AWS_ACCESS_KEY_ID
|
||||
secret_access_key: SECRET_AWS_SECRET_ACCESS_KEY
|
||||
|
||||
# Server Side Encryption for Customer-provided keys
|
||||
#sse_customer_key: <S3_SSEC_KEY>
|
||||
# Your SSE-C algorithm is very likely AES256
|
||||
# Default is AES256.
|
||||
#sse_customer_algo: <S3_SSEC_ALGO>
|
||||
|
||||
# The object storage class used when uploading files to the bucket.
|
||||
# Default is STANDARD.
|
||||
#storage_class: "STANDARD_IA"
|
||||
|
||||
# Prefix for all media in bucket, can't be changed once media has been uploaded
|
||||
# Useful if sharing the bucket between Synapses
|
||||
# Blank if not provided
|
||||
prefix: "janky.solutions/"
|
||||
|
||||
# The maximum number of concurrent threads which will be used to connect
|
||||
# to S3. Each thread manages a single connection. Default is 40.
|
||||
#
|
||||
#threadpool_size: 20
|
21
k8s/matrix/config-janky.solutions/log.yaml
Normal file
21
k8s/matrix/config-janky.solutions/log.yaml
Normal file
|
@ -0,0 +1,21 @@
|
|||
version: 1
|
||||
formatters:
|
||||
precise:
|
||||
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
|
||||
handlers:
|
||||
console:
|
||||
class: logging.StreamHandler
|
||||
formatter: precise
|
||||
loggers:
|
||||
# This is just here so we can leave `loggers` in the config regardless of whether
|
||||
# we configure other loggers below (avoid empty yaml dict error).
|
||||
_placeholder:
|
||||
level: "INFO"
|
||||
synapse.storage.SQL:
|
||||
# beware: increasing this to DEBUG will make synapse log sensitive
|
||||
# information such as access tokens.
|
||||
level: INFO
|
||||
root:
|
||||
level: INFO
|
||||
handlers: [console]
|
||||
disable_existing_loggers: false
|
192
k8s/matrix/janky.solutions-homeserver.yaml
Normal file
192
k8s/matrix/janky.solutions-homeserver.yaml
Normal file
|
@ -0,0 +1,192 @@
|
|||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: homeserver-janky-solutions
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: synapse
|
||||
instance: janky.solutions
|
||||
serviceName: homeserver-janky-solutions
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: synapse
|
||||
instance: janky.solutions
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8000"
|
||||
prometheus.io/path: /_synapse/metrics
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 991
|
||||
fsGroupChangePolicy: "OnRootMismatch"
|
||||
initContainers:
|
||||
- name: initialize-homeserver-secrets
|
||||
image: library/python
|
||||
command: ["python", "/init/initialize-secrets.py", "homeserver.yaml"]
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /init
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: config
|
||||
mountPath: /config
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: synapse-janky-solutions
|
||||
- name: initialize-bridge-secrets
|
||||
image: library/python
|
||||
command: ["python", "/init/initialize-secrets.py", "facebook.yaml", "telegram.yaml", "signal.yaml"]
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /init
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: appservices
|
||||
mountPath: /config
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: synapse-janky-solutions
|
||||
containers:
|
||||
- image: git.janky.solutions/jankysolutions/infra/synapse:latest
|
||||
name: synapse
|
||||
resources: {}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: secrets
|
||||
mountPath: /secrets
|
||||
- name: appservices
|
||||
mountPath: /appservices
|
||||
env:
|
||||
- name: SYNAPSE_SERVER_NAME
|
||||
value: matrix.janky.solutions
|
||||
- name: SYNAPSE_REPORT_STATS
|
||||
value: "no"
|
||||
- name: TZ
|
||||
value: America/Los_Angeles
|
||||
- name: PGUSER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix.janky-solutions-homeserver-database.credentials.postgresql.acid.zalan.do
|
||||
key: username
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix.janky-solutions-homeserver-database.credentials.postgresql.acid.zalan.do
|
||||
key: password
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8008
|
||||
- name: metrics
|
||||
containerPort: 8000
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: synapse-janky-solutions
|
||||
- name: appservices
|
||||
configMap:
|
||||
name: appservices-janky-solutions
|
||||
- name: init
|
||||
configMap:
|
||||
name: secrets-init
|
||||
- name: secrets
|
||||
secret:
|
||||
secretName: synapse-janky-solutions
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: homeserver-janky-solutions
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8008
|
||||
selector:
|
||||
app: synapse
|
||||
instance: janky.solutions
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: homeserver-janky-solutions
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
spec:
|
||||
rules:
|
||||
- host: matrix.janky.solutions
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: homeserver-janky-solutions
|
||||
port:
|
||||
name: http
|
||||
---
|
||||
apiVersion: "acid.zalan.do/v1"
|
||||
kind: postgresql
|
||||
metadata:
|
||||
name: janky-solutions-homeserver-database
|
||||
spec:
|
||||
teamId: matrix
|
||||
volume:
|
||||
size: 10Gi
|
||||
numberOfInstances: 2
|
||||
users:
|
||||
superuser:
|
||||
- superuser
|
||||
- createdb
|
||||
matrix: []
|
||||
databases:
|
||||
matrix: matrix
|
||||
patroni:
|
||||
initdb:
|
||||
encoding: UTF8
|
||||
locale: C
|
||||
pg_hba:
|
||||
- local all all trust
|
||||
- hostssl all +zalandos 127.0.0.1/32 pam
|
||||
- host all all 127.0.0.1/32 md5
|
||||
- hostssl all +zalandos ::1/128 pam
|
||||
- host all all ::1/128 md5
|
||||
- local replication standby trust
|
||||
- hostssl replication standby all md5
|
||||
- hostnossl all all all reject
|
||||
- hostssl all +zalandos all pam
|
||||
- hostssl all all all md5
|
||||
- host all all all md5
|
||||
resources:
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: 4Gi
|
||||
postgresql:
|
||||
version: "16"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: janky-solutions-homeserver-database-nodeport
|
||||
namespace: matrix
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- name: postgresql
|
||||
port: 5432
|
||||
nodePort: 30003
|
||||
selector:
|
||||
k8s.home.finn.io: janky-solutions-homeserver-database
|
||||
spilo-role: master
|
|
@ -3,7 +3,7 @@ kind: Kustomization
|
|||
namespace: matrix
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- bridge-meta.yaml
|
||||
- bridge-facebook.yaml
|
||||
- bridge-signal.yaml
|
||||
- bridge-telegram.yaml
|
||||
- janky.bot-homeserver.yaml
|
||||
|
@ -11,10 +11,6 @@ resources:
|
|||
- secrets.yaml
|
||||
- secrets-init.yaml
|
||||
configMapGenerator:
|
||||
- name: bridge-init
|
||||
files:
|
||||
- bridge-init/initialize-bridge.py
|
||||
- bridge-init/initialize-bridge.sh
|
||||
- name: synapse-janky-bot
|
||||
files:
|
||||
- config-janky.bot/homeserver.yaml
|
||||
|
|
|
@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
|||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- promtail.yaml
|
||||
- ingresses.yaml
|
||||
- secrets.yaml
|
||||
|
|
|
@ -1,7 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: monitoring
|
||||
labels:
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
pod-security.kubernetes.io/warn-version: latest
|
|
@ -49,6 +49,7 @@
|
|||
- monitoring-0:9595 # signald on legacy monitoring
|
||||
- monitoring-0:9099 # rdap monitor on legacy monitoring
|
||||
- hypervisor-d:9162 # apcupsd_exporter on hypervisor-d
|
||||
- hypervisor-d:9633 # smartctl_exporter on hypervisor-d
|
||||
- job_name: promtail
|
||||
static_configs:
|
||||
- targets:
|
||||
|
|
|
@ -16,3 +16,4 @@ configMapGenerator:
|
|||
- logical_backup_s3_bucket=k8s-db-backups
|
||||
- logical_backup_s3_endpoint=storage.home.finn.io
|
||||
- logical_backup_s3_region=us-sea-1
|
||||
- custom_pod_annotations=prometheus.io/scrape:true,prometheus.io/port:8008
|
||||
|
|
|
@ -5,7 +5,6 @@
|
|||
(list "jellyfin" "jellyfin.janky.solutions" "http://jellyfin:8096")
|
||||
(list "dns" "dns.janky.solutions" "http://dns:9191")
|
||||
(list "dns443" "dns.janky.solutions:443" "http://dns:9191")
|
||||
(list "matrix" "matrix.janky.solutions" "http://matrix:8008")
|
||||
}}
|
||||
http:
|
||||
routers:
|
||||
|
|
Loading…
Reference in a new issue