Adds synapse app.

synapse/app.yaml

@@ -0,0 +1,5 @@
+name: synapse
+is: synapse
+description: Synapse is the reference Matrix homeserver for self-hosted, federated, end-to-end encrypted messaging.
+icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/matrix.svg
+latest: "v1"

synapse/versions/v1/README.md

@@ -0,0 +1,38 @@
+# Synapse
+
+Synapse is the reference Matrix homeserver for self-hosted, federated, end-to-end encrypted messaging.
+
+## Dependencies
+
+- **PostgreSQL** - Database for storing messages and account data
+- **Redis** - Used for inter-worker communication
+
+## Configuration
+
+Key settings configured through your instance's `config.yaml`:
+
+- **domain** - Where the Synapse web client will be accessible (default: `synapse.{your-cloud-domain}`)
+- **serverName** - Your Matrix server identity, used in user IDs like `@user:{serverName}` (default: `{your-cloud-domain}`)
+- **enableRegistration** - Whether to allow public account creation (default: `false`)
+- **storage** - Persistent volume for Synapse data (default: `2Gi`)
+- **mediaStorage** - Persistent volume for uploaded media (default: `2Gi`)
+- **SMTP** - Email delivery settings inherited from your Wild Cloud instance
+
+## Access
+
+After deployment, the Synapse homeserver will be available at:
+- `https://synapse.{your-cloud-domain}`
+
+Connect using any Matrix client (Element, FluffyChat, etc.) with your server name.
+
+## First-Time Setup
+
+1. Add and deploy the app:
+   ```bash
+   wild app add synapse
+   wild app deploy synapse
+   ```
+
+2. Use the registration shared secret (in your `secrets.yaml`) to create your first admin account, or enable public registration temporarily
+
+3. Connect with a Matrix client and start messaging

synapse/versions/v1/configmap.yaml

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: synapse-config
+data:
+  homeserver.yaml: |
+    server_name: "{{ .serverName }}"
+    public_baseurl: https://{{ .domain }}
+
+    listeners:
+      - port: 8008
+        tls: false
+        type: http
+        x_forwarded: true
+        bind_addresses: ['::']
+        resources:
+          - names: [client, federation]
+            compress: false
+
+    database:
+      name: psycopg2
+      args:
+        user: {{ .db.user }}
+        password: ${DB_PASSWORD}
+        database: {{ .db.name }}
+        host: {{ .db.host }}
+        port: 5432
+        cp_min: 5
+        cp_max: 10
+
+    redis:
+      enabled: true
+      host: {{ .redis.host }}
+      port: 6379
+      password: ${REDIS_PASSWORD}
+
+    media_store_path: /data/media_store
+    uploads_path: /data/uploads
+
+    max_upload_size: 100M
+
+    enable_registration: {{ .enableRegistration }}
+    enable_registration_without_verification: {{ .enableRegistration }}
+    registration_shared_secret: "${REGISTRATION_SHARED_SECRET}"
+
+    macaroon_secret_key: "${MACAROON_SECRET_KEY}"
+    form_secret: "${FORM_SECRET}"
+
+    signing_key_path: /data/keys/signing.key
+
+    trusted_key_servers:
+      - server_name: "matrix.org"
+
+    email:
+      smtp_host: "{{ .smtp.host }}"
+      smtp_port: {{ .smtp.port }}
+      smtp_user: "{{ .smtp.user }}"
+      smtp_pass: "${SMTP_PASSWORD}"
+      require_transport_security: {{ .smtp.requireTls }}
+      notif_from: "{{ .smtp.from }}"
+      app_name: Matrix
+
+    report_stats: false
+
+    enable_metrics: true
+
+    suppress_key_server_warning: true

synapse/versions/v1/db-init-job.yaml

@@ -0,0 +1,57 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: synapse-db-init
+spec:
+  template:
+    spec:
+      containers:
+        - name: db-init
+          image: postgres:17
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              PGPASSWORD=${POSTGRES_ADMIN_PASSWORD} psql -h ${DB_HOSTNAME} -U postgres <<EOF
+              DO \$\$
+              BEGIN
+                IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_USERNAME}') THEN
+                  CREATE USER ${DB_USERNAME} WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+                ELSE
+                  ALTER USER ${DB_USERNAME} WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+                END IF;
+              END
+              \$\$;
+
+              SELECT 'CREATE DATABASE ${DB_DATABASE_NAME} ENCODING ''UTF8'' LC_COLLATE ''C'' LC_CTYPE ''C'' TEMPLATE template0' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_DATABASE_NAME}')\gexec
+              ALTER DATABASE ${DB_DATABASE_NAME} OWNER TO ${DB_USERNAME};
+              GRANT ALL PRIVILEGES ON DATABASE ${DB_DATABASE_NAME} TO ${DB_USERNAME};
+              EOF
+          env:
+            - name: POSTGRES_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: postgres.password
+            - name: DB_HOSTNAME
+              value: "{{ .db.host }}"
+            - name: DB_DATABASE_NAME
+              value: "{{ .db.name }}"
+            - name: DB_USERNAME
+              value: "{{ .db.user }}"
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: dbPassword
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      restartPolicy: OnFailure

synapse/versions/v1/deployment.yaml

@@ -0,0 +1,220 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: synapse
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      component: synapse
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        component: synapse
+    spec:
+      initContainers:
+        - name: generate-signing-key
+          image: "matrixdotorg/synapse:v1.144.0"
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              if [ ! -f /data/keys/signing.key ]; then
+                echo "Generating signing key..."
+                mkdir -p /data/keys
+                # Use Synapse's generate-keys command
+                python3 -m synapse.app.homeserver \
+                  --generate-keys \
+                  --config-path=/config/homeserver.yaml
+                echo "Signing key generated successfully"
+                ls -la /data/keys/
+              else
+                echo "Signing key already exists"
+              fi
+          env:
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: dbPassword
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: redis.password
+            - name: REGISTRATION_SHARED_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: registrationSharedSecret
+            - name: MACAROON_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: macaroonSecretKey
+            - name: FORM_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: formSecret
+            - name: SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: smtp.password
+          volumeMounts:
+            - name: synapse-data
+              mountPath: /data
+            - name: synapse-config
+              mountPath: /config
+              readOnly: true
+          securityContext:
+            runAsUser: 991
+            runAsGroup: 991
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+      containers:
+        - name: synapse
+          image: "matrixdotorg/synapse:v1.144.0"
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -e
+              echo "Starting config substitution..."
+
+              # Substitute environment variables in the config using Python
+              python3 -c "
+              import os
+              import re
+              import sys
+
+              print('Reading config from /config/homeserver.yaml', file=sys.stderr)
+              try:
+                  with open('/config/homeserver.yaml', 'r') as f:
+                      content = f.read()
+                  print(f'Config file read: {len(content)} bytes', file=sys.stderr)
+              except Exception as e:
+                  print(f'Error reading config: {e}', file=sys.stderr)
+                  sys.exit(1)
+
+              # Replace \${VAR} with environment variable values
+              def replace_var(match):
+                  var_name = match.group(1)
+                  value = os.environ.get(var_name, match.group(0))
+                  print(f'Replacing {var_name}: {\"***\" if \"PASSWORD\" in var_name or \"SECRET\" in var_name else value}', file=sys.stderr)
+                  return value
+
+              content = re.sub(r'\\\$\{([A-Z_]+)\}', replace_var, content)
+
+              print('Writing processed config to /data/homeserver.yaml', file=sys.stderr)
+              try:
+                  with open('/data/homeserver.yaml', 'w') as f:
+                      f.write(content)
+                  print('Config file written successfully', file=sys.stderr)
+              except Exception as e:
+                  print(f'Error writing config: {e}', file=sys.stderr)
+                  sys.exit(1)
+              " || { echo "Python script failed with exit code $?"; exit 1; }
+
+              echo "Config substitution complete"
+              ls -la /data/homeserver.yaml
+
+              # Start Synapse with the processed config
+              exec /start.py
+          ports:
+            - containerPort: 8008
+              protocol: TCP
+              name: http
+            - containerPort: 8448
+              protocol: TCP
+              name: federation
+          env:
+            - name: SYNAPSE_CONFIG_PATH
+              value: /data/homeserver.yaml
+            - name: TZ
+              value: "UTC"
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: dbPassword
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: redis.password
+            - name: REGISTRATION_SHARED_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: registrationSharedSecret
+            - name: MACAROON_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: macaroonSecretKey
+            - name: FORM_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: formSecret
+            - name: SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: synapse-secrets
+                  key: smtp.password
+          volumeMounts:
+            - name: synapse-config
+              mountPath: /config
+              readOnly: true
+            - name: synapse-data
+              mountPath: /data
+            - name: synapse-media
+              mountPath: /data/media_store
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8008
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8008
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 50m
+            limits:
+              memory: "2Gi"
+              cpu: "2000m"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 991
+        runAsGroup: 991
+        fsGroup: 991
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: synapse-config
+          configMap:
+            name: synapse-config
+        - name: synapse-data
+          persistentVolumeClaim:
+            claimName: synapse-data-pvc
+        - name: synapse-media
+          persistentVolumeClaim:
+            claimName: synapse-media-pvc

synapse/versions/v1/ingress.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: synapse-client-ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+spec:
+  tls:
+    - hosts:
+        - {{ .domain }}
+      secretName: {{ .tlsSecretName }}
+  rules:
+    - host: {{ .domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse
+                port:
+                  number: 8008
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: synapse-federation-ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+spec:
+  tls:
+    - hosts:
+        - {{ .serverName }}
+      secretName: {{ .tlsSecretName }}
+  rules:
+    - host: {{ .serverName }}
+      http:
+        paths:
+          - path: /.well-known/matrix
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse
+                port:
+                  number: 8008
+          - path: /_matrix
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse
+                port:
+                  number: 8008

synapse/versions/v1/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: {{ .namespace }}
+labels:
+  - includeSelectors: true
+    pairs:
+      app: synapse
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - pvc.yaml
+  - db-init-job.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

synapse/versions/v1/manifest.yaml

@@ -0,0 +1,48 @@
+version: v1.144.0-9
+requires:
+  - name: postgres
+  - name: redis
+  - name: smtp
+defaultConfig:
+  namespace: synapse
+  externalDnsDomain: '{{ .cloud.domain }}'
+  storage: 2Gi
+  mediaStorage: 2Gi
+  serverName: '{{ .cloud.domain }}'
+  domain: synapse.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  enableRegistration: false
+  db:
+    host: '{{ .apps.postgres.host }}'
+    name: synapse
+    user: synapse
+  redis:
+    host: '{{ .apps.redis.host }}'
+  smtp:
+    host: '{{ .apps.smtp.host }}'
+    port: '{{ .apps.smtp.port }}'
+    from: synapse@{{ .cloud.domain }}
+    user: '{{ .apps.smtp.user }}'
+    requireTls: '{{ .apps.smtp.tls }}'
+defaultSecrets:
+  - key: dbPassword
+  - key: registrationSharedSecret
+  - key: macaroonSecretKey
+  - key: formSecret
+requiredSecrets:
+  - postgres.password
+  - redis.password
+  - smtp.password
+scripts:
+  - name: create-user
+    path: scripts/create-user.sh
+    description: "Create a Matrix user on this Synapse homeserver."
+    params:
+      - name: USERNAME
+        description: Matrix localpart (e.g. alice)
+        required: true
+      - name: ADMIN
+        description: Create as server admin (true or false)
+        required: true
+      - name: PASSWORD
+        description: Password (leave blank to generate a random one)

synapse/versions/v1/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .namespace }}

synapse/versions/v1/pvc.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: synapse-data-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .storage }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: synapse-media-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .mediaStorage }}

synapse/versions/v1/scripts/create-user.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# Create a Matrix user on this Synapse homeserver.
+#
+# Element 1.11+ requires OIDC for self-service registration and does not
+# support the traditional open-registration flow. Use this script to create
+# the initial admin account and any subsequent accounts.
+set -e
+set -o pipefail
+
+if [ -z "${KUBECONFIG}" ] || [ -z "${WILD_INSTANCE}" ] || [ -z "${WILD_API_DATA_DIR}" ]; then
+    echo "ERROR: KUBECONFIG, WILD_INSTANCE, and WILD_API_DATA_DIR must be set"
+    exit 1
+fi
+
+if [ -z "${USERNAME}" ]; then
+    echo "ERROR: USERNAME is required"
+    exit 1
+fi
+
+if [ -z "${ADMIN}" ]; then
+    echo "ERROR: ADMIN is required (true or false)"
+    exit 1
+fi
+
+SECRETS_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/secrets.yaml"
+CONFIG_FILE="${WILD_API_DATA_DIR}/instances/${WILD_INSTANCE}/config.yaml"
+
+REGISTRATION_SHARED_SECRET="$(yq '.apps.synapse.registrationSharedSecret' "${SECRETS_FILE}" | tr -d '"')"
+if [ -z "${REGISTRATION_SHARED_SECRET}" ] || [ "${REGISTRATION_SHARED_SECRET}" = "null" ]; then
+    echo "ERROR: apps.synapse.registrationSharedSecret not found in secrets.yaml"
+    exit 1
+fi
+
+NAMESPACE="$(yq '.apps.synapse.namespace' "${CONFIG_FILE}" | tr -d '"')"
+NAMESPACE="${NAMESPACE:-synapse}"
+
+SERVER_NAME="$(yq '.apps.synapse.serverName' "${CONFIG_FILE}" | tr -d '"')"
+
+POD="$(kubectl get pods -n "${NAMESPACE}" -l component=synapse --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)"
+if [ -z "${POD}" ]; then
+    echo "ERROR: No running Synapse pod found in namespace ${NAMESPACE}"
+    exit 1
+fi
+
+if [ -z "${PASSWORD}" ]; then
+    PASSWORD="$(openssl rand -base64 24 | tr -d '/+=' | head -c 24)"
+fi
+
+if [ "${ADMIN}" = "true" ] || [ "${ADMIN}" = "1" ]; then
+    ADMIN_FLAG="-a"
+else
+    ADMIN_FLAG="--no-admin"
+fi
+
+echo "Creating user '@${USERNAME}:${SERVER_NAME}' (admin: ${ADMIN})..."
+
+kubectl exec -n "${NAMESPACE}" "${POD}" -- \
+    register_new_matrix_user \
+    -k "${REGISTRATION_SHARED_SECRET}" \
+    -u "${USERNAME}" \
+    -p "${PASSWORD}" \
+    ${ADMIN_FLAG} \
+    http://localhost:8008
+
+echo ""
+echo "=== User created ==="
+echo "Username: @${USERNAME}:${SERVER_NAME}"
+echo "Password: ${PASSWORD}"
+echo ""
+echo "Save this password — it will not be shown again."

synapse/versions/v1/service.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: synapse
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8008
+      targetPort: 8008
+      protocol: TCP
+  selector:
+    component: synapse