You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
⚠️ remove sliding sync proxy support; use ghcr.io/element-hq/synapse (#631)
* fix rebase of main
* helm-docs: automated action
* upgrade halfshot/matrix-hookshot tag to v6.0.1
* helm-docs: automated action
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
**NOTE: The most important helm parameter is `matrix.hostname`. Without it, this chart may not work!**
28
+
> [!IMPORTANT]
29
+
> The most important helm parameter is `matrix.hostname`. Without it, this chart may not work!**
30
+
31
+
> [!WARNING]
32
+
> This chart used to support the Sliding Sync Proxy, but as it is deprecated, we no longer support it. See this [matrix blog post](https://matrix.org/blog/2024/11/14/moving-to-native-sliding-sync/) for more info.
29
33
30
34
31
35
## Current Features ✨
32
36
33
37
- Latest version of [Synapse](https://github.com/element-hq/synapse) (the official matrix homeserver)
34
-
- Ingress definitions for federated Synapse (Matrix homeserver) and Element (client for matrix)
38
+
- Ingress definitions for federated Synapse (aka Matrix homeserver) and Element (default client for matrix)
35
39
36
40
### Optional Features
37
41
38
-
- Use (existing) Kubernetes Secrets for confidential data, such as passwords
39
-
- Use OIDC configs for SSO either directly via synapse (see [docs](https://github.com/element-hq/synapse/blob/develop/docs/openid.md) for more info) or via MAS
42
+
- Use existing Persistent Volume Claims
43
+
- Use existing Kubernetes Secrets for confidential data, such as passwords
44
+
- Use OIDC configs for SSO either directly via Synapse (see [docs](https://github.com/element-hq/synapse/blob/develop/docs/openid.md) for more info) or via MAS
40
45
- Use MAS ([matrix-org/matrix-authentication-service](https://github.com/matrix-org/matrix-authentication-service)) via [matrix-authentication-service-chart](https://github.com/small-hack/matrix-authentication-service-chart) as a sub chart for using [element-x] which recommends for OIDC auth
41
46
- Latest version of the [Element web app](https://element.io/) to provide a web interface for chat (you can disable this and still use element apps)
42
-
-[Coturn TURN server subchart](https://github.com/small-hack/coturn-chart) for VoIP calls
43
47
- Use s3 to store media using [element-hq/synapse-s3-storage-provider](https://github.com/matrix-org/synapse-s3-storage-provider/tree/main)
44
-
- Use existing Kubernetes Secrets and existing Persistent Volume Claims
45
-
-[mautrix/discord](https://github.com/mautrix/discord) - Discord bridge for syncing between matrix and Discord
46
48
-[small-hack/matrix-alertmanager](https://github.com/small-hack/matrix-alertmanager) - Prometheus Alertmanager bridge for syncing between matrix and Alertmanager
47
49
48
-
49
-
#### Features that may not be needed anymore
50
-
51
-
- Use [matrix-sliding-sync-chart](https://github.com/small-hack/matrix-sliding-sync-chart) as a sub chart for using [element-x] which requires [matrix-org/sliding-sync](https://github.com/matrix-org/sliding-sync) (Note: as of Synapse [v1.114.0](https://github.com/element-hq/synapse/releases/tag/v1.114.0) you can now use simplified sliding sync, which doesn't require the separate proxy chart [more info here](https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/#1-simplified-sliding-sync))
52
-
53
50
#### ⚠️ Untested Features
54
51
55
-
These features still need to be tested, but are technically baked into the chart from the fork:
52
+
These features still need to be tested, but are technically baked into the chart from the fork or from previous versions of this chart:
56
53
54
+
-[mautrix/discord](https://github.com/mautrix/discord) - Discord bridge for syncing between matrix and Discord (we no longer test this directly but we're open to PRs to improve support!)
55
+
-[Coturn TURN server subchart](https://github.com/small-hack/coturn-chart) for VoIP calls (may not be needed in Matrix 2.0 API)
To use [sliding sync](https://github.com/matrix-org/sliding-sync), which is required for [element-x], you'll need to ensure that requests to `.well-known/matrix/client` return the [correct json](https://github.com/matrix-org/sliding-sync/blob/main/README.md). To do that, you'll want update your `matrix.extra_well_known_client_content` values and set `syncv3.enabled` to `true`. Example below:
206
-
207
-
```yaml
208
-
matrix:
209
-
hostname: my-synapse-hostname.com
210
-
extra_well_known_client_content:
211
-
"org.matrix.msc3575.proxy":
212
-
"url": "https://your-sliding-sync-hostname.com"
213
-
214
-
215
-
syncv3:
216
-
# this enables this subchart: https://github.com/small-hack/matrix-sliding-sync-chart
217
-
# which deploys this: https://github.com/matrix-org/sliding-sync
218
-
enabled: true
219
-
server: "https://my-synapse-hostname.com"
220
-
secret: "this.is.a.test.secret"
221
-
bindaddr: "127.0.0.1:8008"
222
-
# note: you'll still have to actually fill out parameters
223
-
# under slidingSync.postgresql, but it is truncated here for brevity
224
-
# check out values.yaml for all possible slidingSync.postgresql values
225
-
postgresql:
226
-
enabled: true
227
-
```
228
-
229
-
After synapse is up, you should be able to verify it's returning correctly by doing:
## Notes on using MAS (Matrix Authentication Service)
248
202
249
203
MAS is currently the only way to use OIDC with [element-x]. If you're using MAS (Matrix Authentication Service), you'll need to set `mas.enabled` to `true`. You'll also need to setup proper routes for synapse to redirect to MAS. See example below:
@@ -561,4 +515,3 @@ Our goal is to provide regular updates using renovatebot and provide some level
561
515
562
516
<!-- links -->
563
517
[element-x]: https://element.io/labs/element-x "element x link"
| bridges.hookshot.passkey | string |`""`| If bridges.hookshot.passkey AND bridges.hookshot.existingSecret.passkey are BOTH empty strings, we will generate a passkey for you. To Generate yourself: openssl genpkey -out passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096 |
290
289
| bridges.hookshot.podSecurityContext | object |`{}`| hookshot pod security context |
| synapse.service.port | int |`80`| service port for synapse |
826
825
| synapse.service.type | string |`"ClusterIP"`| service type for synpase |
827
-
| syncv3.enabled | bool |`false`| enable the sliding sync proxy (required for using element-x if using Synapse older than v1.114). You can see all possible values [here](https://github.com/small-hack/matrix-sliding-sync-chart). If enabled, you must also provide `matrix.extra_well_known_client_content`. After Synapse v1.114, this is no longer required. Learn more in the matrix [blog post](https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/#1-simplified-sliding-sync)|
828
-
| syncv3.existingEnvSecret | string |`""`| existing kubernetes secret for ALL syncv3 env vars listed below. if set, ignores all values under syncv3 including syncv3.db and syncv3.otlp. |
829
-
| syncv3.externalDatabase.database | string |`"syncv3"`| name of the database to try and connect to |
830
-
| syncv3.externalDatabase.enabled | bool |`false`| enable using an external database *instead of* the Bitnami PostgreSQL sub-chart if externalDatabase.enabled is set to true, postgresql.enabled must be set to false |
831
-
| syncv3.externalDatabase.hostname | string |`""`| hostname of db server. Can be left blank if using postgres subchart |
832
-
| syncv3.externalDatabase.password | string |`"changeme"`| password of matrix-sliding-sync postgres user - ignored using exsitingSecret |
833
-
| syncv3.externalDatabase.port | int |`5432`| which port to use to connect to your database server |
| syncv3.networkPolicies.enabled | bool |`true`| whether to enable kubernetes network policies or not |
847
-
| syncv3.postgresql.enabled | bool |`false`| Whether to deploy the Bitnami Postgresql sub chart If postgresql.enabled is set to true, externalDatabase.enabled must be set to false else if externalDatabase.enabled is set to true, postgresql.enabled must be set to false |
848
-
| syncv3.postgresql.global.postgresql.auth.database | string |`"syncv3"`| name of the database |
849
-
| syncv3.postgresql.global.postgresql.auth.existingSecret | string |`""`| Name of existing secret to use for PostgreSQL credentials |
850
-
| syncv3.postgresql.global.postgresql.auth.password | string |`"changeme"`| password of matrix-sliding-sync postgres user - ignored using exsitingSecret |
851
-
| syncv3.postgresql.global.postgresql.auth.port | int |`5432`| which port to use to connect to your database server |
852
-
| syncv3.postgresql.global.postgresql.auth.secretKeys.adminPasswordKey | string |`"postgresPassword"`| key in existingSecret with the admin postgresql password |
853
-
| syncv3.postgresql.global.postgresql.auth.secretKeys.database | string |`"database"`| key in existingSecret with name of the database |
854
-
| syncv3.postgresql.global.postgresql.auth.secretKeys.databaseHostname | string |`"hostname"`| key in existingSecret with hostname of the database |
855
-
| syncv3.postgresql.global.postgresql.auth.secretKeys.databaseUsername | string |`"username"`| key in existingSecret with username for matrix to connect to db |
856
-
| syncv3.postgresql.global.postgresql.auth.secretKeys.userPasswordKey | string |`"password"`| key in existingSecret with password for matrix to connect to db |
857
-
| syncv3.postgresql.global.postgresql.auth.username | string |`"syncv3"`| username of matrix-sliding-sync postgres user |
| syncv3.postgresql.volumePermissions.enabled | bool |`true`| Enable init container that changes the owner and group of the PVC |
860
-
| syncv3.syncv3.bindaddr | string |`"0.0.0.0:8008"`| SYNCV3_BINDADDR - The interface and port to listen on. (Supports unix socket: /path/to/socket) |
861
-
| syncv3.syncv3.db | string |`""`| SYNCV3_DB - db connection string: https://www.postgresql.org/docs/current/libpq-connect.html if db is empty, you must either provide postgresql or externalDatabase parameters, OR set syncv3.existingDbSecret and syncv3.dbSecretKey |
862
-
| syncv3.syncv3.dbSecretKey | string |`"SYNCV3_DB"`| db key in existing Db Secret for |
863
-
| syncv3.syncv3.existingDbSecret | string |`""`| use an existing kubernetes secret for the db connection connection string. if set, ignores syncv3.db |
864
-
| syncv3.syncv3.existingSyncv3Secret | string |`""`| if set, we'll grab your SYNCV3_SECRET from an existing kubernetes secret and ignore syncv3.secret |
865
-
| syncv3.syncv3.logLevel | string |`"info"`| SYNCV3_LOG_LEVEL - The level of verbosity for messages logged. Available values are trace, debug, info, warn, error and fatal |
866
-
| syncv3.syncv3.maxDbConn | string |`""`| SYNCV3_MAX_DB_CONN - Default: unset. Max database connections to use when communicating with postgres. Unset or 0 means no limit. |
| syncv3.syncv3.otlp.password | string |`""`| SYNCV3_OTLP_PASSWORD - Default: unset. The OTLP password for Basic auth. If unset, does not send an Authorization header. |
869
-
| syncv3.syncv3.otlp.url | string |`""`| SYNCV3_OTLP_URL - Default: unset. The OTLP HTTP URL to send spans to e.g https://localhost:4318 - if unset does not send OTLP traces. |
870
-
| syncv3.syncv3.otlp.username | string |`""`| SYNCV3_OTLP_USERNAME - Default: unset. The OTLP username for Basic auth. If unset, does not send an Authorization header. |
871
-
| syncv3.syncv3.pprof | string |`""`| SYNCV3_PPROF - Default: unset. The bind addr for pprof debugging e.g ':6060'. If not set, does not listen. |
872
-
| syncv3.syncv3.prom | string |`""`| SYNCV3_PROM - Default: unset. The bind addr for Prometheus metrics, which will be accessible at /metrics at this address. |
873
-
| syncv3.syncv3.secret | string |`""`| SYNCV3_SECRET - Required. A secret to use to encrypt access tokens. Must remain the same for the lifetime of the database. If both syncv3.secret and syncv3.existingSecret are not set, we will autogenerate this value |
874
-
| syncv3.syncv3.sentryDsn | string |`""`| SYNCV3_SENTRY_DSN - Default: unset. The Sentry DSN to report events to e.g https://[email protected]/123 - if unset does not send sentry events. |
875
-
| syncv3.syncv3.server | string |`""`| SYNCV3_SERVER - Required. The destination homeserver to talk to (CS API HTTPS URL) e.g 'https://matrix-client.matrix.org' (Supports unix socket: /path/to/socket) |
876
-
| syncv3.syncv3.syncv3SecretKey | string |`"SYNCV3_SECRET"`| secret key to get synvcv3 secret from in existing kubernetes secret. |
877
-
| syncv3.syncv3.tlsCert | string |`""`| SYNCV3_TLS_CERT - Default: unset. Path to a certificate file to serve to HTTPS clients. Specifying this enables TLS on the bound address. |
878
-
| syncv3.syncv3.tlsKey | string |`""`| SYNCV3_TLS_KEY - Default: unset. Path to a key file for the certificate. Must be provided along with the certificate file. |
879
826
| volumes.extraPipPackages.capacity | string |`"100Mi"`| Capacity of the extra pip packages PVC. Note: 1Mi is more than enough, but some cloud providers set a min PVC size of 1Mi or 1Gi, adjust as necessary |
880
827
| volumes.extraPipPackages.existingClaim | string |`""`| name of an existing persistent volume claim for the extra pip packages |
881
828
| volumes.extraPipPackages.storageClass | string |`""`| Storage class (optional) |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments