Add Matrix.
This commit is contained in:
221
matrix/deployment.yaml
Normal file
221
matrix/deployment.yaml
Normal file
@@ -0,0 +1,221 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: matrix-synapse
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: matrix-synapse
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: matrix-synapse
|
||||
component: synapse
|
||||
spec:
|
||||
initContainers:
|
||||
- name: generate-signing-key
|
||||
image: "{{ .image }}"
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
if [ ! -f /data/keys/signing.key ]; then
|
||||
echo "Generating signing key..."
|
||||
mkdir -p /data/keys
|
||||
# Use Synapse's generate-keys command
|
||||
python3 -m synapse.app.homeserver \
|
||||
--generate-keys \
|
||||
--config-path=/config/homeserver.yaml
|
||||
echo "Signing key generated successfully"
|
||||
ls -la /data/keys/
|
||||
else
|
||||
echo "Signing key already exists"
|
||||
fi
|
||||
env:
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: dbPassword
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: redis.password
|
||||
- name: REGISTRATION_SHARED_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: registrationSharedSecret
|
||||
- name: MACAROON_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: macaroonSecretKey
|
||||
- name: FORM_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: formSecret
|
||||
- name: SMTP_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: smtp.password
|
||||
volumeMounts:
|
||||
- name: matrix-data
|
||||
mountPath: /data
|
||||
- name: matrix-config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
securityContext:
|
||||
runAsUser: 991
|
||||
runAsGroup: 991
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: false
|
||||
containers:
|
||||
- name: synapse
|
||||
image: "{{ .image }}"
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
echo "Starting config substitution..."
|
||||
|
||||
# Substitute environment variables in the config using Python
|
||||
python3 -c "
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
|
||||
print('Reading config from /config/homeserver.yaml', file=sys.stderr)
|
||||
try:
|
||||
with open('/config/homeserver.yaml', 'r') as f:
|
||||
content = f.read()
|
||||
print(f'Config file read: {len(content)} bytes', file=sys.stderr)
|
||||
except Exception as e:
|
||||
print(f'Error reading config: {e}', file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
# Replace \${VAR} with environment variable values
|
||||
def replace_var(match):
|
||||
var_name = match.group(1)
|
||||
value = os.environ.get(var_name, match.group(0))
|
||||
print(f'Replacing {var_name}: {\"***\" if \"PASSWORD\" in var_name or \"SECRET\" in var_name else value}', file=sys.stderr)
|
||||
return value
|
||||
|
||||
content = re.sub(r'\\\$\{([A-Z_]+)\}', replace_var, content)
|
||||
|
||||
print('Writing processed config to /data/homeserver.yaml', file=sys.stderr)
|
||||
try:
|
||||
with open('/data/homeserver.yaml', 'w') as f:
|
||||
f.write(content)
|
||||
print('Config file written successfully', file=sys.stderr)
|
||||
except Exception as e:
|
||||
print(f'Error writing config: {e}', file=sys.stderr)
|
||||
sys.exit(1)
|
||||
" || { echo "Python script failed with exit code $?"; exit 1; }
|
||||
|
||||
echo "Config substitution complete"
|
||||
ls -la /data/homeserver.yaml
|
||||
|
||||
# Start Synapse with the processed config
|
||||
exec /start.py
|
||||
ports:
|
||||
- containerPort: {{ .port }}
|
||||
protocol: TCP
|
||||
name: http
|
||||
- containerPort: {{ .federationPort }}
|
||||
protocol: TCP
|
||||
name: federation
|
||||
env:
|
||||
- name: SYNAPSE_CONFIG_PATH
|
||||
value: /data/homeserver.yaml
|
||||
- name: TZ
|
||||
value: "{{ .timezone }}"
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: dbPassword
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: redis.password
|
||||
- name: REGISTRATION_SHARED_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: registrationSharedSecret
|
||||
- name: MACAROON_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: macaroonSecretKey
|
||||
- name: FORM_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: formSecret
|
||||
- name: SMTP_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-secrets
|
||||
key: smtp.password
|
||||
volumeMounts:
|
||||
- name: matrix-config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: matrix-data
|
||||
mountPath: /data
|
||||
- name: matrix-media
|
||||
mountPath: /data/media_store
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: {{ .port }}
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: {{ .port }}
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
requests:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
limits:
|
||||
memory: "2Gi"
|
||||
cpu: "2000m"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: false
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 991
|
||||
runAsGroup: 991
|
||||
fsGroup: 991
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: matrix-config
|
||||
configMap:
|
||||
name: matrix-config
|
||||
- name: matrix-data
|
||||
persistentVolumeClaim:
|
||||
claimName: matrix-data-pvc
|
||||
- name: matrix-media
|
||||
persistentVolumeClaim:
|
||||
claimName: matrix-media-pvc
|
||||
Reference in New Issue
Block a user