Skip to content

Commit 6588a93

Browse files
ildocildoc
committed
tmp
1 parent a8d9217 commit 6588a93

13 files changed

+691
-0
lines changed

‎kubernetes/matrix/cloudflared-configmap.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: cloudflared-matrix-stack-config
6+
namespace: apps
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "5"
9+
data:
10+
config.yaml: |
11+
tunnel: YOUR-TUNNEL-ID
12+
credentials-file: /etc/cloudflared/credentials/credentials.json
13+
14+
# Metrics endpoint
15+
metrics: 0.0.0.0:2000
16+
17+
# Ingress rules per Matrix + Element
18+
ingress:
19+
# Element Web - deve essere PRIMA per evitare conflitti
20+
- hostname: element.ildoc.it
21+
service: http://element-web.apps.svc.cluster.local:80
22+
originRequest:
23+
noTLSVerify: false
24+
connectTimeout: 30s
25+
26+
# Matrix Client API
27+
- hostname: matrix.ildoc.it
28+
service: http://matrix-synapse.apps.svc.cluster.local:8008
29+
originRequest:
30+
noTLSVerify: false
31+
connectTimeout: 30s
32+
tlsTimeout: 10s
33+
34+
# Matrix Federation API (path-based routing)
35+
- hostname: matrix.ildoc.it
36+
path: /_matrix/federation/*
37+
service: http://matrix-synapse.apps.svc.cluster.local:8448
38+
originRequest:
39+
noTLSVerify: false
40+
41+
# Catch-all (obbligatorio)
42+
- service: http_status:404

‎kubernetes/matrix/cloudflared-deployment.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: cloudflared-matrix-stack
6+
namespace: apps
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "5"
9+
spec:
10+
selector:
11+
matchLabels:
12+
app: cloudflared-matrix-stack
13+
replicas: 2
14+
strategy:
15+
type: RollingUpdate
16+
revisionHistoryLimit: 3
17+
template:
18+
metadata:
19+
labels:
20+
app: cloudflared-matrix-stack
21+
spec:
22+
containers:
23+
- name: cloudflared
24+
image: cloudflare/cloudflared:2024.12.2
25+
args:
26+
- tunnel
27+
- --config
28+
- /etc/cloudflared/config.yaml
29+
- run
30+
volumeMounts:
31+
- name: config
32+
mountPath: /etc/cloudflared
33+
readOnly: true
34+
- name: credentials
35+
mountPath: /etc/cloudflared/credentials
36+
readOnly: true
37+
resources:
38+
limits:
39+
cpu: 200m
40+
memory: 256Mi
41+
requests:
42+
cpu: 100m
43+
memory: 128Mi
44+
livenessProbe:
45+
httpGet:
46+
path: /ready
47+
port: 2000
48+
initialDelaySeconds: 30
49+
periodSeconds: 30
50+
volumes:
51+
- name: config
52+
configMap:
53+
name: cloudflared-matrix-stack-config
54+
- name: credentials
55+
secret:
56+
secretName: cloudflared-matrix-stack-credentials

‎kubernetes/matrix/cloudflared-secret.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
apiVersion: external-secrets.io/v1
3+
kind: ExternalSecret
4+
metadata:
5+
name: vault-cloudflared-matrix-stack-credentials
6+
namespace: apps
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "5"
9+
spec:
10+
refreshInterval: "1h"
11+
secretStoreRef:
12+
name: vault-kubernetes-secret-store
13+
kind: ClusterSecretStore
14+
target:
15+
name: cloudflared-matrix-stack-credentials
16+
creationPolicy: Owner
17+
template:
18+
type: Opaque
19+
data:
20+
credentials.json: |
21+
{
22+
"AccountTag": "{{ .account_tag }}",
23+
"TunnelSecret": "{{ .tunnel_secret }}",
24+
"TunnelID": "{{ .tunnel_id }}"
25+
}
26+
data:
27+
- secretKey: account_tag
28+
remoteRef:
29+
key: kubernetes/data/apps/matrix/cloudflared
30+
property: account_tag
31+
- secretKey: tunnel_secret
32+
remoteRef:
33+
key: kubernetes/data/apps/matrix/cloudflared
34+
property: tunnel_secret
35+
- secretKey: tunnel_id
36+
remoteRef:
37+
key: kubernetes/data/apps/matrix/cloudflared
38+
property: tunnel_id

‎kubernetes/matrix/configmap.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: matrix-config
6+
namespace: apps
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "1"
9+
data:
10+
homeserver.yaml: |
11+
server_name: "matrix.ildoc.it"
12+
public_baseurl: "https://matrix.ildoc.it"
13+
14+
listeners:
15+
- port: 8008
16+
tls: false
17+
type: http
18+
x_forwarded: true
19+
bind_addresses: ['0.0.0.0']
20+
resources:
21+
- names: [client, federation]
22+
compress: false
23+
24+
# Database - usa env vars
25+
database:
26+
name: psycopg2
27+
args:
28+
user: ${POSTGRES_USER}
29+
password: ${POSTGRES_PASSWORD}
30+
database: ${POSTGRES_DB}
31+
host: ${POSTGRES_HOST}
32+
port: ${POSTGRES_PORT}
33+
cp_min: 5
34+
cp_max: 10
35+
36+
# Redis - usa env vars con username
37+
redis:
38+
enabled: true
39+
host: ${SYNAPSE_REDIS_HOST}
40+
port: ${SYNAPSE_REDIS_PORT}
41+
password: ${SYNAPSE_REDIS_PASSWORD}
42+
43+
log_config: "/data/log.config"
44+
media_store_path: "/data/media_store"
45+
max_upload_size: "50M"
46+
max_image_pixels: "32M"
47+
url_preview_enabled: false
48+
49+
enable_registration: false
50+
enable_registration_without_verification: false
51+
registration_requires_token: false
52+
53+
# Usa env vars per i secret
54+
registration_shared_secret: ${REGISTRATION_SHARED_SECRET}
55+
macaroon_secret_key: ${MACAROON_SECRET_KEY}
56+
form_secret: ${FORM_SECRET}
57+
58+
enable_3pid_lookup: false
59+
allow_public_rooms_without_auth: false
60+
allow_public_rooms_over_federation: false
61+
62+
rc_message:
63+
per_second: 0.2
64+
burst_count: 10
65+
66+
rc_registration:
67+
per_second: 0.17
68+
burst_count: 3
69+
70+
rc_login:
71+
address:
72+
per_second: 0.17
73+
burst_count: 3
74+
account:
75+
per_second: 0.17
76+
burst_count: 3
77+
failed_attempts:
78+
per_second: 0.17
79+
burst_count: 3
80+
81+
federation_domain_whitelist: []
82+
signing_key_path: "/data/keys/signing.key"
83+
84+
trusted_key_servers:
85+
- server_name: "matrix.org"
86+
87+
report_stats: false
88+
enable_metrics: true
89+
metrics_port: 9000
90+
91+
log.config: |
92+
version: 1
93+
94+
formatters:
95+
precise:
96+
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
97+
98+
handlers:
99+
console:
100+
class: logging.StreamHandler
101+
formatter: precise
102+
stream: ext://sys.stdout
103+
104+
loggers:
105+
synapse.storage.SQL:
106+
level: INFO
107+
108+
root:
109+
level: INFO
110+
handlers: [console]
111+
112+
disable_existing_loggers: false

‎kubernetes/matrix/deployment.yaml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: matrix-synapse
6+
namespace: apps
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "4"
9+
spec:
10+
selector:
11+
matchLabels:
12+
app: matrix-synapse
13+
strategy:
14+
type: Recreate
15+
revisionHistoryLimit: 3
16+
template:
17+
metadata:
18+
labels:
19+
app: matrix-synapse
20+
spec:
21+
containers:
22+
- name: synapse
23+
image: ghcr.io/element-hq/synapse:v1.123.0
24+
env:
25+
- name: SYNAPSE_SERVER_NAME
26+
value: "matrix.ildoc.it"
27+
- name: SYNAPSE_REPORT_STATS
28+
value: "no"
29+
- name: UID
30+
value: "991"
31+
- name: GID
32+
value: "991"
33+
- name: TZ
34+
value: "Europe/Rome"
35+
36+
# PostgreSQL configuration (da cross-secrets)
37+
- name: POSTGRES_HOST
38+
value: "192.168.0.40"
39+
- name: POSTGRES_PORT
40+
value: "5432"
41+
- name: POSTGRES_DB
42+
value: "matrix_db"
43+
- name: POSTGRES_USER
44+
value: "matrix_user"
45+
- name: POSTGRES_PASSWORD
46+
valueFrom:
47+
secretKeyRef:
48+
name: matrix-cross-secrets # DA CROSS
49+
key: postgres-password
50+
51+
- name: SYNAPSE_REDIS_HOST
52+
value: "matrix-redis.apps.svc.cluster.local" # Service interno
53+
- name: SYNAPSE_REDIS_PORT
54+
value: "6379"
55+
- name: SYNAPSE_REDIS_PASSWORD
56+
valueFrom:
57+
secretKeyRef:
58+
name: matrix-redis-secret
59+
key: password
60+
61+
# Synapse secrets (da k8s-secrets)
62+
- name: REGISTRATION_SHARED_SECRET
63+
valueFrom:
64+
secretKeyRef:
65+
name: matrix-k8s-secrets # DA KUBERNETES
66+
key: registration-shared-secret
67+
- name: MACAROON_SECRET_KEY
68+
valueFrom:
69+
secretKeyRef:
70+
name: matrix-k8s-secrets # DA KUBERNETES
71+
key: macaroon-secret-key
72+
- name: FORM_SECRET
73+
valueFrom:
74+
secretKeyRef:
75+
name: matrix-k8s-secrets # DA KUBERNETES
76+
key: form-secret
77+
78+
ports:
79+
- containerPort: 8008
80+
name: http
81+
protocol: TCP
82+
- containerPort: 8448
83+
name: federation
84+
protocol: TCP
85+
86+
volumeMounts:
87+
- name: data
88+
mountPath: /data
89+
- name: config
90+
mountPath: /data/homeserver.yaml
91+
subPath: homeserver.yaml
92+
- name: config
93+
mountPath: /data/log.config
94+
subPath: log.config
95+
96+
resources:
97+
limits:
98+
cpu: 2000m
99+
memory: 4Gi
100+
requests:
101+
cpu: 500m
102+
memory: 1Gi
103+
104+
livenessProbe:
105+
httpGet:
106+
path: /health
107+
port: http
108+
initialDelaySeconds: 60
109+
periodSeconds: 30
110+
timeoutSeconds: 5
111+
failureThreshold: 3
112+
113+
readinessProbe:
114+
httpGet:
115+
path: /health
116+
port: http
117+
initialDelaySeconds: 30
118+
periodSeconds: 10
119+
timeoutSeconds: 5
120+
failureThreshold: 3
121+
122+
volumes:
123+
- name: data
124+
persistentVolumeClaim:
125+
claimName: matrix-synapse
126+
- name: config
127+
configMap:
128+
name: matrix-config

0 commit comments

Comments
 (0)