137705bfe0
Personal homeserver with bridges deferred. Single host
matrix.{cluster.domain} with path-based routing: /_matrix, /_synapse,
/.well-known/matrix → Synapse; / → Element Web. Both share matrix-tls.
Stack: ananace/matrix-synapse + element-web charts, CNPG postgres
(LC_COLLATE=C), in-cluster alpine redis (no auth, replaces bitnami
subchart), mittwald-generated synapse-secrets for registration_shared/
macaroon/form_secret, custom idempotent signing-key init Job (replaces
chart's bitnami/kubectl publisher).
Sync waves:
-3 Namespace
-2 synapse-secrets (mittwald head-start), signing-key RBAC
-1 signing-key Job, CNPG Cluster, redis
0 Synapse, Element, Ingress
Synapse pod waits in extraCommands until synapse-secrets is populated,
then writes zz-overrides.yaml to override chart placeholders for the
three secret values without churning the chart-managed Secret on every
render. Resources tightened for 1-2 user scale: Synapse 256Mi/512Mi,
Postgres 64Mi/128Mi.
ArgoCD destination.namespace overridden to matrix via prototype-level
argocd overlay so both apps share the matrix ns instead of creating
unused matrix-synapse and element-web namespaces.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
2.3 KiB
YAML
82 lines
2.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
|
labels:
|
|
app.kubernetes.io/instance: element-web
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: element-web
|
|
app.kubernetes.io/version: 1.12.17
|
|
helm.sh/chart: element-web-1.4.36
|
|
name: element-web
|
|
namespace: matrix
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: element-web
|
|
app.kubernetes.io/name: element-web
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: 2d356a5bdaf9a18d891cfa939070f193ac94dc87bcc001a43769c6a0cae50a17
|
|
checksum/config-nginx: 7b910777640c47e06f1153bb1d327cc8b7bbfe8ee1d58e444c5abcc2a4afb7a0
|
|
labels:
|
|
app.kubernetes.io/instance: element-web
|
|
app.kubernetes.io/name: element-web
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: ELEMENT_WEB_PORT
|
|
value: "8080"
|
|
image: ghcr.io/element-hq/element-web:v1.12.17
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
name: element-web
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
protocol: TCP
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
resources:
|
|
limits:
|
|
memory: 64Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: false
|
|
volumeMounts:
|
|
- mountPath: /app/config.json
|
|
name: config
|
|
subPath: config.json
|
|
- mountPath: /etc/nginx/conf.d/config.json
|
|
name: config-nginx
|
|
subPath: config.json
|
|
securityContext:
|
|
fsGroup: 101
|
|
runAsGroup: 101
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: element-web
|
|
volumes:
|
|
- configMap:
|
|
name: element-web
|
|
name: config
|
|
- configMap:
|
|
name: element-web-nginx
|
|
name: config-nginx
|