137705bfe0
Personal homeserver with bridges deferred. Single host
matrix.{cluster.domain} with path-based routing: /_matrix, /_synapse,
/.well-known/matrix → Synapse; / → Element Web. Both share matrix-tls.
Stack: ananace/matrix-synapse + element-web charts, CNPG postgres
(LC_COLLATE=C), in-cluster alpine redis (no auth, replaces bitnami
subchart), mittwald-generated synapse-secrets for registration_shared/
macaroon/form_secret, custom idempotent signing-key init Job (replaces
chart's bitnami/kubectl publisher).
Sync waves:
-3 Namespace
-2 synapse-secrets (mittwald head-start), signing-key RBAC
-1 signing-key Job, CNPG Cluster, redis
0 Synapse, Element, Ingress
Synapse pod waits in extraCommands until synapse-secrets is populated,
then writes zz-overrides.yaml to override chart placeholders for the
three secret values without churning the chart-managed Secret on every
render. Resources tightened for 1-2 user scale: Synapse 256Mi/512Mi,
Postgres 64Mi/128Mi.
ArgoCD destination.namespace overridden to matrix via prototype-level
argocd overlay so both apps share the matrix ns instead of creating
unused matrix-synapse and element-web namespaces.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
56 lines
1 KiB
YAML
56 lines
1 KiB
YAML
#@ load("@ytt:overlay", "overlay")
|
|
|
|
#@data/values
|
|
---
|
|
environment:
|
|
id: production
|
|
applications:
|
|
- proto: argocd
|
|
- proto: traefik
|
|
- proto: cert-manager
|
|
- proto: kubernetes-secret-generator
|
|
- proto: forgejo
|
|
- proto: victoria-metrics-single
|
|
- proto: grafana
|
|
- proto: kube-state-metrics
|
|
- proto: node-exporter
|
|
- proto: hcloud-csi
|
|
- proto: cloudnative-pg
|
|
- proto: metrics-server
|
|
- proto: ocis
|
|
- proto: matrix-synapse
|
|
- proto: element-web
|
|
|
|
cluster:
|
|
domain: tr1ceracop.de
|
|
ingress:
|
|
className: traefik
|
|
tls:
|
|
issuer: letsencrypt
|
|
storageClass:
|
|
block: hcloud-volumes
|
|
local: local-path
|
|
|
|
backups:
|
|
enabled: true
|
|
s3:
|
|
endpoint: https://fsn1.your-objectstorage.com
|
|
region: fsn1
|
|
storagebox:
|
|
enabled: true
|
|
|
|
ocis:
|
|
s3:
|
|
external: true
|
|
endpoint: https://nbg1.your-objectstorage.com
|
|
region: nbg1
|
|
bucket: ocis-tr1ceracop
|
|
|
|
forgejo:
|
|
sshPort: 222
|
|
#@overlay/replace
|
|
nodeSelector:
|
|
kubernetes.io/hostname: ubuntu-4gb-nbg1-3
|
|
backup:
|
|
s3Bucket: k8s-and-chill-backups
|