-
-
Notifications
You must be signed in to change notification settings - Fork 8
Expand file tree
/
Copy pathvalues.yaml
More file actions
2865 lines (2551 loc) · 120 KB
/
values.yaml
File metadata and controls
2865 lines (2551 loc) · 120 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
---
# -- override the full name of the chart
fullnameOverride: ""
# -- override the name of the chart
nameOverride: ""
# -- imagePullSecrets to use for all below images
imagePullSecrets: []
networkPolicies:
# -- whether to enable kubernetes network policies or not
enabled: true
# Runtime configuration for Synapse and settings related to the Matrix protocol
matrix:
# -- Manual overrides for homeserver.yaml, the main config file for Synapse
# Its highly recommended that you take a look at the defaults in
# templates/synapse/_homeserver.yaml, to get a sense of the requirements and
# default config options to use other services in this chart.
homeserverOverride: {}
# -- Contents will be appended to the end of the default configuration
homeserverExtra: {}
# -- Domain name of the server: This is not necessarily the host name where
# the service is reachable. In fact, you may want to omit any subdomains from
# this value as the server name set here will be the name of your homeserver
# in the fediverse, & will be the domain name at the end of every username
serverName: "example.com"
# -- Enable anonymous telemetry to matrix.org
telemetry: false
# This is *optional* if an Ingress is configured below.
# -- Hostname where Synapse can be reached, e.g. matrix.mydomain.com
hostname: ""
# -- Set to false to disable presence (online/offline indicators)
presence: true
# -- Set to true to block non-admins from inviting users to any rooms
blockNonAdminInvites: false
# -- Set to false to disable message searching
search: true
# -- Which types of rooms to enable end-to-end encryption on by default.
# options: off (none), all (all rooms), or invite (private msg/room created
# w/ private_chat or trusted_private_chat room presets)
encryptByDefault: invite
# -- Email address of the administrator
adminEmail: "admin@example.com"
# -- Settings related to image and multimedia uploads
uploads:
# -- Max upload size in bytes
maxSize: 10M
# -- Max image size in pixels
maxPixels: 32M
# -- extra sections for the your /.well-known/matrix/client which returns json
# used by clients to know where your matrix sliding sync server is
extra_well_known_client_content: {}
# uncomment for using sliding sync. url must be your sliding sync hostname
# "org.matrix.msc3575.proxy":
# "url": "https://wherever-your-sliding-sync-proxy-is.com"
# -- By default, other servers will try to reach our server on port 8448, which can be inconvenient in some environments. Provided https://<server_name>/ on port 443 is routed to Synapse, this option configures Synapse to serve a file at https://<server_name>/.well-known/matrix/server. This will tell other servers to send traffic to port 443 instead
serve_server_wellknown: false
# Settings related to federation
federation:
# -- Set to true to enable federation
enabled: false
# -- timeout for the federation requests
client_timeout: 60s
# -- maximum delay to be used for the short retry algo
max_short_retry_delay: 2s
# -- maximum delay to be used for the short retry algo
max_long_retry_delay: 60s
# -- maximum number of retries for the short retry algo
max_short_retries: 3
# -- maximum number of retries for the long retry algo
max_long_retries: 10
# -- the initial backoff, after the first request fails
destination_min_retry_interval: 10m
# -- how much we multiply the backoff by after each subsequent fail
destination_retry_multiplier: 2
# -- a cap on the backoff. Defaults to a week
destination_max_retry_interval: 1w
ingress:
# -- enable ingress for federation
enabled: false
tls:
# -- enable a TLS cert
enabled: true
host: matrix-fed.chart-example.local
# -- ingressClassName for the k8s ingress
className: "nginx"
annotations:
# -- required for the Nginx ingress provider. You can remove it if you
# use a different ingress provider
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_intercept_errors off;
# -- required for TLS certs issued by cert-manager
cert-manager.io/cluster-issuer: letsencrypt-staging
# -- Allow members of other homeservers to fetch *public* rooms
allow_public_rooms_over_federation: false
# -- If set to true, removes the need for authentication to access the server's public rooms directory through the client API, meaning that anyone can query the room directory
allow_public_rooms_without_auth: false
# -- Restrict federation to the given whitelist of domains. N.B. we recommend also firewalling your federation listener to limit inbound federation traffic as early as possible, rather than relying purely on this application-layer restriction. If not specified, the default is to whitelist everythingNote
# Note: this does not stop a server from joining rooms that servers not on the whitelist are in. As such, this option is really only useful to establish a "private federation", where a group of servers all whitelist each other and have the same whitelist.
federation_domain_whitelist: []
# -- This option prevents outgoing requests from being sent to the specified blacklisted IP address CIDR ranges. If this option is not specified then it defaults to private IP address ranges (see the example below). The blacklist applies to the outbound requests for federation, identity servers, push servers, and for checking key validity for third-party invite events.
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly listed here, since they correspond to unroutable addresses.)
# This option replaces federation_ip_range_blacklist in Synapse v1.25.0.
# Note: The value is ignored when an HTTP proxy is in use.
ip_range_blacklist:
- '127.0.0.0/8'
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '100.64.0.0/10'
- '192.0.0.0/24'
- '169.254.0.0/16'
- '192.88.99.0/24'
- '198.18.0.0/15'
- '192.0.2.0/24'
- '198.51.100.0/24'
- '203.0.113.0/24'
- '224.0.0.0/4'
- '::1/128'
- 'fe80::/10'
- 'fc00::/7'
- '2001:db8::/32'
- 'ff00::/8'
- 'fec0::/10'
# User registration settings
registration:
# -- Allow new users to register an account
enabled: false
# -- If set, allows registration of standard or admin accounts by anyone who
# has the shared secret, even if registration is otherwise disabled.
# ignored if existingSecret is passed in
sharedSecret: ""
# -- if set, allows user to generate a random shared secret in a k8s secret
# ignored if existingSecret is passed in
generateSharedSecret: false
# -- if set, pull sharedSecret from an existing k8s secret
existingSecret: ""
# -- key in existing k8s secret for registration shared secret
secretKey: "registrationSharedSecret"
# -- Allow users to join rooms as a guest
allowGuests: false
# Required "3PIDs" - third-party identifiers such as email or msisdn (SMS)
# required3Pids:
# - email
# - msisdn
# -- Rooms to automatically join all new users to
autoJoinRooms: []
# - "#welcome:example.com"
# -- Whether to allow token based registration
requiresToken: false
# see: https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html?highlight=password%20disable#password_config
password_config: {}
# -- set to true to enable password authentication
# enabled: false
# localdb_enabled: false
# OpenID Connect integration. The following settings can be used to make Synapse
# use an OpenID Connect Provider for authentication, instead of its internal
# password database. will be considered legacy way of doing things after
# element-x comes out of beta ref:
# https://github.com/element-hq/synapse/blob/develop/docs/openid.md
# https://github.com/element-hq/synapse/blob/develop/docs/openid.md
oidc:
# -- set to true to enable authorization against an OpenID Connect server
# unless using OIDC on synapse AND you want to allow usage of Element-X (the
# beta of element), then you must set experimental_feature.msc3861.enabled
# to True to use the MAS (Matrix Authentication Service) and fill out the values there.
enabled: false
# -- existing secret to use for the OIDC config
existingSecret: ""
# keys in an existing secret to use for oidc config
secretKeys:
# -- key in secret with the issuer
issuer: "issuer"
# -- key in secret with the client_id
client_id: "client_id"
# -- key in secret with the client_secret
client_secret: "client_secret"
# -- key in secret with the authorization_endpoint if discovery is disabled
authorization_endpoint: ""
# -- key in secret with the token_endpoint if discovery is disabled
token_endpoint: ""
# -- key in secret with the userinfo_endpoint if discovery is disabled
userinfo_endpoint: ""
# -- each of these will be templated under oidc_providers in homeserver.yaml
# ref: https://element-hq.github.io/synapse/latest/openid.html?search=
providers:
# -- id of your identity provider, e.g. dex
- idp_id: ""
# -- human readable comment of your identity provider, e.g. "My Dex Server"
idp_name: ""
# -- optional styling hint for clients
idp_brand: ""
# -- turn off discovery by setting this to false
discover: true
# set to true to skip metadata verification. Defaults to false. Use this if
# you are connecting to a provider that is not OpenID Connect compliant.
# Avoid this in production.
skip_verification: false
# -- OIDC issuer. Used to validate tokens and (if discovery is enabled) to
# discover the provider's endpoints. Required if 'enabled' is true.
issuer: "https://accounts.example.com/"
# -- oauth2 client id to use. Required if 'enabled' is true.
client_id: "provided-by-your-issuer"
# -- oauth2 client secret to use. Required if 'enabled' is true.
client_secret: "provided-by-your-issuer"
# -- auth method to use when exchanging the token. Valid values are:
# 'client_secret_basic' (default), 'client_secret_post' and 'none'.
client_auth_method: client_secret_post
# -- list of scopes to request. should normally include the "openid" scope.
# Defaults to ["openid"].
scopes:
- "openid"
- "profile"
# -- oauth2 authorization endpoint. Required if provider discovery disabled.
authorization_endpoint: "https://accounts.example.com/oauth2/auth"
# -- the oauth2 token endpoint. Required if provider discovery is disabled.
token_endpoint: "https://accounts.example.com/oauth2/token"
# -- the OIDC userinfo endpoint. Required if discovery is disabled and the
# "openid" scope is not requested.
userinfo_endpoint: "https://accounts.example.com/userinfo"
# An external module can be provided here as a custom solution to mapping
# attributes returned from a OIDC provider onto a matrix user.
user_mapping_provider:
config:
# -- name of the claim containing a unique identifier for user. Defaults
# to `sub`, which OpenID Connect compliant providers should provide.
subject_claim: ""
# -- This must be configured if using the default mapping provider.
localpart_template: ""
# -- Jinja2 template for the display name to set on first login.
# If unset, no displayname will be set.
display_name_template: ""
# for X (formally twitter):
# https://element-hq.github.io/synapse/latest/openid.html?highlight=twitter#twitter
picture_template: "{{ user.data.profile_image_url }}"
# -- optional - maybe useful for keycloak
backchannel_logout_enabled: true
# -- require auth for profile requests, not useful if federation is enable
require_auth_for_profile_requests: true
# -- require a user to share a room with another user in order
# to retrieve their profile information. Only checked on Client-Server
# requests. Profile requests from other servers should be checked by the
# requesting server.
limit_profile_requests_to_users_who_share_rooms: true
# -- minimum required tls version support. set to 1.3 if you know all clients implement this. may break public servers
federation_client_minimum_tls_version: 1.2
# Settings for the URL preview crawler
urlPreviews:
# -- Enable URL previews. WARN: Make sure to review default rules below to
# ensure that users cannot crawl sensitive internal endpoints on yr cluster
enabled: false
# Blacklists and whitelists for the URL preview crawler
rules:
# -- Max size of a crawlable page. Keep this low to prevent a DOS vector
maxSize: 10M
# Whitelist and blacklist for crawlable IP addresses
ip:
whitelist: []
blacklist:
- '127.0.0.0/8'
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '100.64.0.0/10'
- '169.254.0.0/16'
- '::1/128'
- 'fe80::/64'
- 'fc00::/7'
# -- Whitelist and blacklist based on URL pattern matching
url: {}
# whitelist:
# blacklist:
# # blacklist any URL with a username in its URI
# - username: '*'
#
# # blacklist all *.google.com URLs
# - netloc: 'google.com'
# - netloc: '*.google.com'
#
# # blacklist all plain HTTP URLs
# - scheme: 'http'
#
# # blacklist http(s)://www.acme.com/foo
# - netloc: 'www.acme.com'
# path: '/foo'
#
# # blacklist any URL with a literal IPv4 address
# - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
# -- How long to keep redacted events in unredacted form in the database
retentionPeriod: 7d
security:
# a secret which is used to sign access tokens. If none is specified,
# the registration_shared_secret is used, if one is given; otherwise,
# a secret key is derived from the signing key.
#
# macaroonSecretKey: <PRIVATE STRING>
# This disables the warning that is emitted when the
# trustedKeyServers include 'matrix.org'. See below.
# Set to false to re-enable the warning.
#
surpressKeyServerWarning: true
# The trusted servers to download signing keys from.
#
# When we need to fetch a signing key, each server is tried in parallel.
#
# Normally, the connection to the key server is validated via TLS certs.
# Additional security can be provided by configuring a `verify key`, which
# will make synapse check that the response is signed by that key.
#
# This setting supercedes an older setting named `perspectives`. Old format
# is still supported for backwards-compatibility, but it is deprecated.
#
# 'trustedKeyServers' defaults to matrix.org, but using it will generate a
# warning on start-up. To suppress this warning, set
# 'surpressKeyServerWarning' to true.
#
# Options for each entry in the list include:
#
# serverName: the name of the server. required.
#
# verifyKeys: an optional map from key id to base64-encoded public key.
# If specified, we will check that the response is signed by at least
# one of the given keys.
#
# acceptKeysInsecurely: a boolean. Normally, if `verify_keys` is unset,
# and federation_verify_certificates is not `true`, synapse will refuse
# to start, because this would allow anyone who can spoof DNS responses
# to masquerade as the trusted key server. If you know what you are doing
# and are sure that your network environment provides a secure connection
# to the key server, you can set this to `true` to override this
# behaviour.
#
# An example configuration might look like:
#
# trustedKeyServers:
# - serverName: my_trusted_server.example.com
# verifyKeys:
# - id: "ed25519:auto"
# key: "abcdefghijklmnopqrstuvwxyzabcdefghijklmopqr"
# acceptKeysInsecurely: false
# - serverName: my_other_trusted_server.example.com
trustedKeyServers: []
# -- use an existing Kubernetes Secret for trusted server list instead of
# matrix.security.trustedKeyServers
trustedKeyServersExistingSecret: ""
# -- key in existing Kubernetes Secret for trusted server list
trustedKeyServersSecretKey: "trustedKeys"
# -- Set to true to globally block access to the homeserver
disabled: false
# -- Human readable reason for why the homeserver is blocked
disabledMessage: ""
logging:
# -- Root log level is the default log level for log outputs that don't
# have more specific settings.
rootLogLevel: WARNING
# -- beware: increasing this to DEBUG will make synapse log sensitive
# information such as access tokens.
sqlLogLevel: WARNING
# -- The log level for the synapse server
synapseLogLevel: WARNING
# -- use an existing secret for all msc3861 (matrix authentication service) related values
# if set, all other msc3861 values are ignored (issuer, client_id,
# client_auth_method, client_secret, admin_token, account_management_url)
msc3861ExistingSecret: ""
msc3861SecretKeys:
# -- secret key to use in existing secret for msc3861 issuer
issuer: ""
# -- secret key to use in existing secret for msc3861 client id
client_id: ""
# -- secret key to use in existing secret for msc3861 client secret
client_secret: ""
# -- secret key to use in existing secret for msc3861 admin_token
admin_token: ""
# -- secret key to use in existing secret for msc3861 account_management_url
account_management_url: ""
experimental_features:
msc3861:
# -- experimental_feature msc3861 - enable this if you want to use the matrix authentication service
# Likely needed if using OIDC on synapse and you want to allow usage of Element-X (the beta of element)
# See: [Matrix authentication service home server docs](https://matrix-org.github.io/matrix-authentication-service/setup/homeserver.html#configure-the-homeserver-to-delegate-authentication-to-the-service), [full matrix authentication service docs](https://matrix-org.github.io/matrix-authentication-service/index.html), and [issue#1915](https://github.com/element-hq/element-meta/issues/1915#issuecomment-2119297748) where this is being discussed
enabled: false
# -- Synapse will call `{issuer}/.well-known/openid-configuration` to get the OIDC configuration
issuer: http://localhost:8080/
# -- Matches the `mas.mas.clients[0].client_id` in the auth service config
client_id: 0000000000000000000SYNAPSE
# -- Matches the `client_auth_method` in the auth service config
client_auth_method: client_secret_basic
# -- Matches the `mas.mas.clients[0].client_secret` in the auth service config
client_secret: "SomeRandomSecret"
# -- Matches the `mas.mas.matrix.secret` in the auth service config
admin_token: "AnotherRandomSecret"
# -- URL to advertise to clients where users can self-manage their account
# this is typically https://your-mas-domain.com/account
account_management_url: ""
s3:
# -- enable s3 storage via https://github.com/matrix-org/synapse-s3-storage-provider
enabled: false
# -- your s3 endpoint
endpoint: ""
# -- name of the bucket to use
bucket: ""
# -- optional region to use for s3
region: ""
# -- optional Server Side Encryption for Customer-provided keys
sse_c_key: ""
# -- optional SSE-C algorithm - very likely AES256
sse_algorithm: "AES256"
# -- use credentials from an existing kubernetes secret
existingSecret: ""
# these are the keys within the existing k8s secret to use for s3 credentials
secretKeys:
# -- key in existing secret fo the S3 key
accessKey: "S3_ACCESS_KEY"
# -- key in existing secret fo the S3 secret
secretKey: "S3_SECRET_KEY"
cronjob:
# -- enable a regular cleanup k8s cronjob to automatically backup everything
# to your s3 bucket for you and delete it from local disk ref:
# https://github.com/matrix-org/synapse-s3-storage-provider/tree/main#regular-cleanup-job
enabled: false
# -- cron schedule to run the k8s cronjob. Defaults to every day at midnight
schedule: "0 0 * * *"
# -- this is the age of files you'd like to clean up, defaults files not used
# within two months (2m)
file_age: 2m
# Persistent volumes configuration
volumes:
# Uploaded attachments/multimedia
media:
# -- Capacity of the media PVC - ignored if using exsitingClaim
capacity: 10Gi
# -- Storage class of the media PVC - ignored if using exsitingClaim
storageClass: ""
# -- name of an existing PVC to use for uploaded attachments and multimedia
existingClaim: ""
signingKey:
# -- Capacity of the signing key PVC. Note: 1Mi is more than enough, but
# some cloud providers set a min PVC size of 1Mi or 1Gi, adjust as necessary
capacity: 1Mi
# -- Storage class (optional)
storageClass: ""
# -- name of an existing persistent volume claim to use for signing key
existingClaim: ""
synapseConfig:
# -- Capacity of the signing key PVC. Note: 1Mi is more than enough, but
# some cloud providers set a min PVC size of 1Mi or 1Gi, adjust as necessary
capacity: 1Mi
# -- Storage class (optional)
storageClass: ""
# -- name of an existing persistent volume claim for synapse config file
existingClaim: ""
# optional PVC used only when s3.enabled is set to true, to install synapse-s3-storage-provider
extraPipPackages:
# -- Capacity of the extra pip packages PVC. Note: 1Mi is more than enough, but
# some cloud providers set a min PVC size of 1Mi or 1Gi, adjust as necessary
capacity: 100Mi
# -- Storage class (optional)
storageClass: ""
# -- name of an existing persistent volume claim for the extra pip packages
existingClaim: ""
externalDatabase:
# -- enable using an external database *instead of* the Bitnami PostgreSQL sub-chart
# if externalDatabase.enabled is set to true, postgresql.enabled must be set to false
enabled: false
# optional SSL parameters for postgresql, if using your own db instead of the subchart
# ref: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
# -- sslmode to use, example: verify-full
sslmode: ""
# make sure any paths here are reflected in synapse.extraVolumes and synapse.extraVolumeMounts
# -- optional: tls/ssl root cert for postgresql connections
sslrootcert: ""
# -- optional: tls/ssl cert for postgresql connections
sslcert: ""
# -- optional: tls/ssl key for postgresql connections
sslkey: ""
# database credentials to use if you don't use an existingSecret
# -- username of matrix postgres user
username: matrix
# -- password of matrix postgres user - ignored using exsitingSecret
password: changeme
# -- which port to use to connect to your database server
port: 5432
# -- hostname of db server. Can be left blank if using postgres subchart
hostname: ""
# -- name of the database to try and connect to
database: "matrix"
# -- Name of existing secret to use for PostgreSQL credentials
existingSecret: ""
# if externalDatabase.existingSecret is provided, the following are ignored
# password, username, hostname, database
# secretKeys to grab from existingSecret
secretKeys:
# -- key in existingSecret with hostname of the database
databaseHostname: hostname
# -- key in existingSecret with name of the database
database: database
# -- key in existingSecret with username for matrix to connect to db
databaseUsername: username
# -- key in existingSecret with password for matrix to connect to db
userPasswordKey: password
# -- key in existingSecret with the admin postgresql password
adminPasswordKey: postgresPassword
# PostgreSQL Database configuration for synapse, for more options:
# https://github.com/bitnami/charts/tree/main/bitnami/postgresql
postgresql:
# -- Whether to deploy the Bitnami Postgresql sub chart
# If postgresql.enabled is set to true, externalDatabase.enabled must be set to false
# else if externalDatabase.enabled is set to true, postgresql.enabled must be set to false
enabled: true
persistence:
enabled: false
volumePermissions:
# -- Enable init container that changes the owner and group of the PVC
enabled: true
global:
postgresql:
# global.postgresql.auth overrides postgresql.auth
auth:
# database credentials to use if you don't use an existingSecret
# -- username of matrix postgres user
username: matrix
# -- password of matrix postgres user - ignored using exsitingSecret
password: changeme
# -- which port to use to connect to your database server
port: 5432
# -- Name of existing secret to use for PostgreSQL credentials
existingSecret: ""
# secretKeys to grab from existingSecret
# if postgresql.existingSecret is provided, the following are ignored
# postgresql.password/username/hostname/database
secretKeys:
# -- key in existingSecret with hostname of the database
databaseHostname: hostname
# -- key in existingSecret with name of the database
database: database
# -- key in existingSecret with username for matrix to connect to db
databaseUsername: username
# -- key in existingSecret with password for matrix to connect to db
userPasswordKey: password
# -- key in existingSecret with the admin postgresql password
adminPasswordKey: postgresPassword
# primary database node config
primary:
# -- run the scripts in templates/postgresql/initdb-configmap.yaml
# If using an external Postgres server, make sure to configure the database
# ref: https://github.com/element-hq/synapse/blob/develop/docs/postgres.md
initdb:
scriptsConfigMap: "{{ .Release.Name }}-postgresql-initdb"
podSecurityContext:
enabled: true
runAsUser: 1000
fsGroup: 1000
# Synapse (home server that implements matrix) Kubernetes resource settings
synapse:
image:
# -- image registry and repository to use for synapse
repository: "matrixdotorg/synapse"
# -- tag of synapse docker image to use. change this to latest to grab the
# cutting-edge release of synapse
tag: ""
# -- pullPolicy for synapse image, Use Always if using image.tag: latest
pullPolicy: IfNotPresent
service:
# -- service type for synpase
type: ClusterIP
# -- service port for synapse
port: 80
federation:
type: ClusterIP
port: 80
ingress:
# -- enable ingress for synapse, so the server is reachable outside the cluster
enabled: true
# -- @DEPRECATION: hostname for your synapse server, please use
# synapse.ingress.hosts for ingress instead. This has been removed in helm
# chart verison 13.0.0. You must also set matrix.hostname for all to work normally
# host: ""
# -- ingressClassName for the k8s ingress
className: "nginx"
annotations:
# required for TLS certs issued by cert-manager
# cert-manager.io/cluster-issuer: letsencrypt-staging
# -- This annotation is required for the Nginx ingress provider. You can
# remove it if you use a different ingress provider
nginx.ingress.kubernetes.io/configuration-snippet: |
proxy_intercept_errors off;
hosts:
- host: "matrix.chart-example.local"
paths:
- path: /
pathType: ImplementationSpecific
# if mas.enabled is set to true, you want pathType for / to be Prefix
# pathType: Prefix
# if mas.enabled is set to true, you want to uncomment the following:
# - path: "/_matrix/client/(r0|v3)/(refresh|login|logout).*"
# pathType: ImplementationSpecific
# backend:
# service:
# value: release-name-mas
# port:
# name: http
# if bridges.hookshot.generic.enabled, you want to uncomment the following:
# - path: /webhook
# pathType: ImplementationSpecific
# backend:
# service:
# value: release-name-bridge-hookshot
# port:
# name: http
# -- enable tls for synapse ingress
tls: []
# to enable tls for synapse remove the [] on the line above and uncomment the
# following lines, replacing matrix.chart-example.local with your synapse domain
# - secretName: "matrix-tls"
# hosts:
# - matrix.chart-example.local
# -- replica count of the synapse pods
replicaCount: 1
# -- set the revisionHistoryLimit to decide how many replicaSets are
# kept when you change a deployment. Explicitly setting this field to 0,
# will result in cleaning up all the history of your Deployment thus that
# Deployment will not be able to roll back.
revisionHistoryLimit: 2
# -- resource requests and limits for synapse
resources: {}
# Configure timings for readiness, startup, and liveness probes here
probes:
readiness:
# -- readiness probe seconds before timing out
timeoutSeconds: 5
# -- readiness probe seconds trying again
periodSeconds: 10
startup:
# -- startup probe seconds before timing out
timeoutSeconds: 5
# -- startup probe seconds trying again
periodSeconds: 5
# -- startup probe times to try and fail before giving up
failureThreshold: 6
liveness:
# -- liveness probe seconds before timing out
timeoutSeconds: 5
# -- liveness probe seconds trying again
periodSeconds: 10
# -- securityContext for the synapse CONTAINER ONLY
# Does not work by default in all cloud providers, disable by default
securityContext:
# -- user ID to run the synapse container as
runAsUser: 1000
# -- group ID to run the synapse container as
runAsGroup: 1000
# -- Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed.
runAsNonRoot: true
# -- Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
readOnlyRootFilesystem: false
# -- AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.
allowPrivilegeEscalation: false
# -- securityContext for the entire synapse pod, including the all containers
# Does not work by default in all cloud providers, disable by default
podSecurityContext:
# -- user ID to run the synapse POD as
runAsUser: 1000
# -- group ID to run the synapse POD as
runAsGroup: 1000
# -- A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.
fsGroup: 1000
# -- Indicates that the pod's containers must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed.
runAsNonRoot: true
# -- Enable if your k8s environment allows containers to chuser/setuid
# https://github.com/matrix-org/synapse/blob/96cf81e312407f0caba1b45ba9899906b1dcc098/docker/start.py#L196
env: false
# -- Labels to be appended to all Synapse resources
labels:
component: synapse
# Prometheus metrics for Synapse
# https://github.com/element-hq/synapse/blob/develop/docs/metrics-howto.md
metrics:
# -- Whether Synapse should capture metrics on an additional endpoint
enabled: true
# -- Port to listen on for metrics scraping
port: 9092
annotations: true
serviceMonitor:
# -- enable a prometheus ServiceMonitor to send metrics to prometheus
enabled: false
# -- optiona: extra env variables to pass to the matrix synapse deployment
extraEnv: []
# -- optional: extra volumes for the matrix synapse deployment
extraVolumes: []
# -- optional: extra volume mounts for the matrix synapse deployment
extraVolumeMounts: []
mas:
# -- enable the MAS (Matrix Authentication Service) sub chart to use OIDC
# This is the only way that's tested to use with element-x beta right now
# You must also fill out matrix.experimental_feature.msc3861 if you use this method
enabled: false
replicaCount: 1
image:
repository: ghcr.io/matrix-org/matrix-authentication-service
# -- image pull policy. if image.tag is set to "latest", set to "Always"
pullPolicy: IfNotPresent
# -- Overrides the image tag whose default is the chart appVersion.
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Automatically mount a ServiceAccount's API credentials?
automount: true
# -- Annotations to add to the service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
podAnnotations: {}
podLabels: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
service:
# -- annotations for your service
annotations: {}
# -- type of service
type: ClusterIP
# -- targetPort of service. should be the same as port for bindaddr
targetPort: 8080
# -- Port of service
port: 80
ingress:
# -- enable ingress for matrix authentication service
enabled: true
className: ""
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
hosts:
- host: chart-example.local
paths:
- path: /
pathType: ImplementationSpecific
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
livenessProbe:
# -- enable a liveness probe on the deployment
enabled: false
httpGet:
path: /
port: http
readinessProbe:
# -- enable a readiness probe on the deployment
enabled: false
httpGet:
path: /
port: http
autoscaling:
enabled: false
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
# Additional volumes on the output Deployment definition.
extravolumes: []
# - name: foo
# secret:
# secretName: mysecret
# optional: false
# Additional volumeMounts on the output Deployment definition.
extraVolumeMounts: []
# - name: foo
# mountPath: "/etc/foo"
# readOnly: true
nodeSelector: {}
tolerations: []
affinity: {}
# PostgreSQL Database configuration for matrix-authentication-service, for more options:
# https://github.com/bitnami/charts/tree/main/bitnami/postgresql
postgresql:
# -- Whether to deploy the Bitnami Postgresql sub chart
# If postgresql.enabled is set to true, externalDatabase.enabled must be set to false
# else if externalDatabase.enabled is set to true, postgresql.enabled must be set to false
enabled: false
# persistence:
# enabled: false
volumePermissions:
# -- Enable init container that changes the owner and group of the PVC
enabled: true
tls:
# -- Enable TLS traffic support for postgresql, see [bitnami/charts/postgresql#securing-traffic-using-tls](https://github.com/bitnami/charts/tree/main/bitnami/postgresql#securing-traffic-using-tls)
enabled: false
# -- Generate automatically self-signed TLS certificates
autoGenerated: false
# -- Whether to use the server's TLS cipher preferences rather than the client's
preferServerCiphers: true
# -- Name of an existing secret that contains the certificates
certificatesSecret: ""
# -- Certificate filename
certFilename: ""
# -- Certificate key filename
certKeyFilename: ""
# -- CA Certificate filename
certCAFilename: ""
# -- File containing a Certificate Revocation List
crlFilename: ""
global:
postgresql:
# global.postgresql.auth overrides postgresql.auth
auth:
# database credentials to use if you don't use an existingSecret
# -- username of matrix-authentication-service postgres user
username: mas
# -- password of matrix-authentication-service postgres user - ignored using exsitingSecret
password: changeme
# -- which port to use to connect to your database server
port: '5432'
# -- name of the database
database: mas
# -- Name of existing secret to use for PostgreSQL credentials
existingSecret: ""
# secretKeys to grab from existingSecret
# if postgresql.existingSecret is provided, the following are ignored
# postgresql.password/username/hostname/database
secretKeys:
# -- key in existingSecret with hostname of the database
databaseHostname: hostname
# -- key in existingSecret with name of the database
database: database
# -- key in existingSecret with username for matrix-authentication-service to connect to db
databaseUsername: username
# -- key in existingSecret with password for matrix-authentication-service to connect to db
userPasswordKey: password
# -- key in existingSecret with the admin postgresql password
adminPasswordKey: postgresPassword
# primary database node config
primary:
# -- run the scripts in templates/postgresql/initdb-configmap.yaml
# If using an external Postgres server, make sure to configure the database
# ref: https://github.com/element-hq/synapse/blob/develop/docs/postgres.md
initdb:
scriptsConfigMap: "{{ .Release.Name }}-postgresql-initdb"
podSecurityContext:
enabled: true
runAsUser: 1000
fsGroup: 1000
externalDatabase:
# -- enable using an external database *instead of* the Bitnami PostgreSQL sub-chart
# if externalDatabase.enabled is set to true, postgresql.enabled must be set to false
enabled: false
# optional SSL parameters for postgresql, if using your own db instead of the subchart
# ref: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
# -- sslmode to use, example: verify-full
sslmode: ""
# make sure any paths here are reflected in extraVolumes and extraVolumeMounts
# -- optional: tls/ssl root cert for postgresql connections
sslrootcert: ""
# -- optional: tls/ssl cert for postgresql connections
sslcert: ""
# -- optional: tls/ssl key for postgresql connections
sslkey: ""
# database credentials to use if you don't use an existingSecret
# -- username of matrix-authentication-service postgres user
username: mas