Skip to content

Commit 62e7983

Browse files
ildocildoc
committed
matrix
1 parent e50ff7f commit 62e7983

File tree

18 files changed

+716
-35
lines changed

18 files changed

+716
-35
lines changed

‎ansible/inventory/group_vars/all.yml‎

Lines changed: 17 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -121,9 +121,8 @@ external_secrets:
121121
vault_token: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/external-secrets:vault_token') }}"
122122

123123
invidious:
124-
# db_user: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/invidious:db_user') }}"
125124
db_user: invidious_user
126-
db_password: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/invidious:db_password') }}"
125+
db_password: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/invidious:postgres_password') }}"
127126
db_name: invidious_db
128127
db_host: "192.168.0.30"
129128
visitor_data: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/invidious:visitor_data') }}"
@@ -154,59 +153,44 @@ db:
154153
- pg_trgm
155154
- btree_gin
156155

157-
# - name: harbor_registry
158-
# owner: harbor_user
159-
# encoding: UTF8
160-
# lc_collate: en_US.UTF-8
161-
# lc_ctype: en_US.UTF-8
162-
163-
# - name: harbor_notary_server
164-
# owner: harbor_user
165-
# encoding: UTF8
166-
# lc_collate: en_US.UTF-8
167-
# lc_ctype: en_US.UTF-8
168-
169-
# - name: harbor_notary_signer
170-
# owner: harbor_user
171-
# encoding: UTF8
172-
# lc_collate: en_US.UTF-8
173-
# lc_ctype: en_US.UTF-8
174-
175156
- name: authentik_db
176157
owner: authentik_user
177158
encoding: UTF8
178159
lc_collate: en_US.UTF-8
179160
lc_ctype: en_US.UTF-8
180-
181161

162+
- name: matrix_db
163+
owner: matrix_user
164+
encoding: UTF8
165+
lc_collate: en_US.UTF-8
166+
lc_ctype: en_US.UTF-8
167+
182168
users:
183169
# Utenti applicativi con accesso completo al loro database
184170
- name: invidious_user
185-
password: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/invidious:db_password') }}"
171+
password: "{{ lookup('community.hashi_vault.hashi_vault', 'ansible/data/invidious:postgres_password') }}"
186172
databases:
187173
- invidious_db
188174
privileges: ALL
189175
table_privs: ALL
190176
sequence_privs: ALL
191177

192-
# - name: harbor_user
193-
# password: "{{ lookup('community.hashi_vault.hashi_vault', 'cross/data/apps/harbor:db_password') }}"
194-
# databases:
195-
# - harbor_registry
196-
# - harbor_notary_server
197-
# - harbor_notary_signer
198-
# privileges: ALL
199-
# table_privs: ALL
200-
# sequence_privs: ALL
201-
202178
- name: authentik_user
203-
password: "{{ lookup('community.hashi_vault.hashi_vault', 'cross/data/apps/authentik:db_password') }}"
179+
password: "{{ lookup('community.hashi_vault.hashi_vault', 'cross/data/apps/authentik:postgres_password') }}"
204180
databases:
205181
- authentik_db
206182
privileges: ALL
207183
table_privs: ALL
208184
sequence_privs: ALL
209185

186+
- name: matrix_user
187+
password: "{{ lookup('community.hashi_vault.hashi_vault', 'cross/data/apps/matrix:postgres_password') }}"
188+
databases:
189+
- matrix_db
190+
privileges: ALL
191+
table_privs: ALL
192+
sequence_privs: ALL
193+
210194
redis:
211195
config:
212196
appendonly: true

‎gl-sast-report.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎kubernetes/applications/element/configmap.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: element-config
6+
namespace: apps
7+
data:
8+
config.json: |
9+
{
10+
"default_server_config": {
11+
"m.homeserver": {
12+
"base_url": "https://matrix.ildoc.it",
13+
"server_name": "matrix.ildoc.it"
14+
}
15+
},
16+
"brand": "Element",
17+
"default_country_code": "IT",
18+
"default_federate": true,
19+
"default_theme": "dark",
20+
"disable_custom_urls": false,
21+
"disable_guests": true,
22+
"disable_login_language_selector": false,
23+
"disable_3pid_login": false,
24+
"enable_presence_by_hs_url": {
25+
"https://matrix.ildoc.it": true
26+
},
27+
"setting_defaults": {
28+
"breadcrumbs": true,
29+
"UIFeature.urlPreviews": true,
30+
"UIFeature.feedback": false,
31+
"UIFeature.voip": true,
32+
"UIFeature.widgets": true,
33+
"UIFeature.flair": false,
34+
"UIFeature.communities": false,
35+
"UIFeature.advanced": true
36+
},
37+
"show_labs_settings": true,
38+
"features": {
39+
"feature_video_rooms": true,
40+
"feature_element_call_video_rooms": true,
41+
"feature_group_calls": true
42+
},
43+
"room_directory": {
44+
"servers": [
45+
"matrix.ildoc.it"
46+
]
47+
},
48+
"enable_encryption_by_default_for_dms": true,
49+
"permalink_prefix": "https://matrix.to",
50+
"update_base_url": "https://packages.element.io/desktop/update/",
51+
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
52+
}

‎kubernetes/applications/element/deployment.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: element-web
6+
namespace: apps
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: element-web
11+
replicas: 2
12+
strategy:
13+
type: RollingUpdate
14+
revisionHistoryLimit: 3
15+
template:
16+
metadata:
17+
labels:
18+
app: element-web
19+
spec:
20+
containers:
21+
- name: element-web
22+
image: vectorim/element-web:v1.11.88
23+
ports:
24+
- containerPort: 80
25+
name: http
26+
protocol: TCP
27+
volumeMounts:
28+
- name: config
29+
mountPath: /app/config.json
30+
subPath: config.json
31+
readOnly: true
32+
resources:
33+
limits:
34+
cpu: 100m
35+
memory: 128Mi
36+
requests:
37+
cpu: 50m
38+
memory: 64Mi
39+
livenessProbe:
40+
httpGet:
41+
path: /
42+
port: http
43+
initialDelaySeconds: 10
44+
periodSeconds: 30
45+
timeoutSeconds: 5
46+
failureThreshold: 3
47+
readinessProbe:
48+
httpGet:
49+
path: /
50+
port: http
51+
initialDelaySeconds: 5
52+
periodSeconds: 10
53+
timeoutSeconds: 5
54+
failureThreshold: 3
55+
volumes:
56+
- name: config
57+
configMap:
58+
name: element-config

‎kubernetes/applications/element/service.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: element-web
6+
namespace: apps
7+
spec:
8+
type: ClusterIP
9+
ports:
10+
- port: 80
11+
targetPort: 80
12+
protocol: TCP
13+
name: http
14+
selector:
15+
app: element-web

‎kubernetes/applications/matrix/cloudflared/configmap.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: cloudflared-matrix-stack-config
6+
namespace: apps
7+
data:
8+
config.yaml: |
9+
tunnel: YOUR-TUNNEL-ID
10+
credentials-file: /etc/cloudflared/credentials/credentials.json
11+
12+
# Metrics endpoint
13+
metrics: 0.0.0.0:2000
14+
15+
# Ingress rules per Matrix + Element
16+
ingress:
17+
# Element Web - deve essere PRIMA per evitare conflitti
18+
- hostname: element.ildoc.it
19+
service: http://element-web.apps.svc.cluster.local:80
20+
originRequest:
21+
noTLSVerify: false
22+
connectTimeout: 30s
23+
24+
# Matrix Client API
25+
- hostname: matrix.ildoc.it
26+
service: http://matrix-synapse.apps.svc.cluster.local:8008
27+
originRequest:
28+
noTLSVerify: false
29+
connectTimeout: 30s
30+
tlsTimeout: 10s
31+
32+
# Matrix Federation API (path-based routing)
33+
- hostname: matrix.ildoc.it
34+
path: /_matrix/federation/*
35+
service: http://matrix-synapse.apps.svc.cluster.local:8448
36+
originRequest:
37+
noTLSVerify: false
38+
39+
# Catch-all (obbligatorio)
40+
- service: http_status:404

‎kubernetes/applications/matrix/cloudflared/deployment.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: cloudflared-matrix-stack
6+
namespace: apps
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: cloudflared-matrix-stack
11+
replicas: 2
12+
strategy:
13+
type: RollingUpdate
14+
revisionHistoryLimit: 3
15+
template:
16+
metadata:
17+
labels:
18+
app: cloudflared-matrix-stack
19+
spec:
20+
containers:
21+
- name: cloudflared
22+
image: cloudflare/cloudflared:2024.12.2
23+
args:
24+
- tunnel
25+
- --config
26+
- /etc/cloudflared/config.yaml
27+
- run
28+
volumeMounts:
29+
- name: config
30+
mountPath: /etc/cloudflared
31+
readOnly: true
32+
- name: credentials
33+
mountPath: /etc/cloudflared/credentials
34+
readOnly: true
35+
resources:
36+
limits:
37+
cpu: 200m
38+
memory: 256Mi
39+
requests:
40+
cpu: 100m
41+
memory: 128Mi
42+
livenessProbe:
43+
httpGet:
44+
path: /ready
45+
port: 2000
46+
initialDelaySeconds: 30
47+
periodSeconds: 30
48+
volumes:
49+
- name: config
50+
configMap:
51+
name: cloudflared-matrix-stack-config
52+
- name: credentials
53+
secret:
54+
secretName: cloudflared-matrix-stack-credentials

‎kubernetes/applications/matrix/cloudflared/secret.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
apiVersion: external-secrets.io/v1
3+
kind: ExternalSecret
4+
metadata:
5+
name: vault-cloudflared-matrix-stack-credentials
6+
namespace: apps
7+
spec:
8+
refreshInterval: "1h"
9+
secretStoreRef:
10+
name: vault-kubernetes-secret-store
11+
kind: ClusterSecretStore
12+
target:
13+
name: cloudflared-matrix-stack-credentials
14+
creationPolicy: Owner
15+
template:
16+
type: Opaque
17+
data:
18+
credentials.json: |
19+
{
20+
"AccountTag": "{{ .account_tag }}",
21+
"TunnelSecret": "{{ .tunnel_secret }}",
22+
"TunnelID": "{{ .tunnel_id }}"
23+
}
24+
data:
25+
- secretKey: account_tag
26+
remoteRef:
27+
key: kubernetes/data/apps/matrix-stack/cloudflared
28+
property: account_tag
29+
- secretKey: tunnel_secret
30+
remoteRef:
31+
key: kubernetes/data/apps/matrix-stack/cloudflared
32+
property: tunnel_secret
33+
- secretKey: tunnel_id
34+
remoteRef:
35+
key: kubernetes/data/apps/matrix-stack/cloudflared
36+
property: tunnel_id

0 commit comments

Comments
 (0)