From 4f2353385188f5bf6186fd6ab403cd550bdedfde Mon Sep 17 00:00:00 2001 From: admin Date: Wed, 22 Apr 2026 21:09:20 +0200 Subject: [PATCH] feat: add synapse communication --- clusters/homelab/apps/synapse.yaml | 16 ++++ .../apps/synapse/cnpg-cluster-mas.yaml | 26 +++++++ .../apps/synapse/cnpg-cluster-synapse.yaml | 26 +++++++ .../synapse/cnpg-scheduledbackup-mas.yaml | 10 +++ .../synapse/cnpg-scheduledbackup-synapse.yaml | 10 +++ .../homelab/apps/synapse/helmrelease.yaml | 78 +++++++++++++++++++ .../homelab/apps/synapse/helmrepository.yaml | 9 +++ .../apps/synapse/minio-secret.sops.yaml | 28 +++++++ clusters/homelab/apps/synapse/namespace.yaml | 4 + .../homelab/apps/synapse/secret.sops.yaml | 29 +++++++ 10 files changed, 236 insertions(+) create mode 100644 clusters/homelab/apps/synapse.yaml create mode 100644 clusters/homelab/apps/synapse/cnpg-cluster-mas.yaml create mode 100644 clusters/homelab/apps/synapse/cnpg-cluster-synapse.yaml create mode 100644 clusters/homelab/apps/synapse/cnpg-scheduledbackup-mas.yaml create mode 100644 clusters/homelab/apps/synapse/cnpg-scheduledbackup-synapse.yaml create mode 100644 clusters/homelab/apps/synapse/helmrelease.yaml create mode 100644 clusters/homelab/apps/synapse/helmrepository.yaml create mode 100644 clusters/homelab/apps/synapse/minio-secret.sops.yaml create mode 100644 clusters/homelab/apps/synapse/namespace.yaml create mode 100644 clusters/homelab/apps/synapse/secret.sops.yaml diff --git a/clusters/homelab/apps/synapse.yaml b/clusters/homelab/apps/synapse.yaml new file mode 100644 index 0000000..c8b3b97 --- /dev/null +++ b/clusters/homelab/apps/synapse.yaml @@ -0,0 +1,16 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: synapse + namespace: flux-system +spec: + interval: 10m + path: ./clusters/homelab/apps/synapse + prune: true + sourceRef: + kind: GitRepository + name: flux-system + decryption: + provider: sops + secretRef: + name: sops-age diff --git a/clusters/homelab/apps/synapse/cnpg-cluster-mas.yaml b/clusters/homelab/apps/synapse/cnpg-cluster-mas.yaml new file mode 100644 index 0000000..9efbd6a --- /dev/null +++ b/clusters/homelab/apps/synapse/cnpg-cluster-mas.yaml @@ -0,0 +1,26 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: mas-db + namespace: synapse +spec: + instances: 3 + storage: + size: 2Gi + storageClass: longhorn + backup: + barmanObjectStore: + destinationPath: s3://cnpg-backups/mas + endpointURL: http://192.168.2.107:9010 + s3Credentials: + accessKeyId: + name: minio-cnpg-credentials + key: ACCESS_KEY_ID + secretAccessKey: + name: minio-cnpg-credentials + key: ACCESS_SECRET_KEY + retentionPolicy: "30d" + bootstrap: + initdb: + database: mas + owner: mas diff --git a/clusters/homelab/apps/synapse/cnpg-cluster-synapse.yaml b/clusters/homelab/apps/synapse/cnpg-cluster-synapse.yaml new file mode 100644 index 0000000..1e06187 --- /dev/null +++ b/clusters/homelab/apps/synapse/cnpg-cluster-synapse.yaml @@ -0,0 +1,26 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: synapse-db + namespace: synapse +spec: + instances: 3 + storage: + size: 5Gi + storageClass: longhorn + backup: + barmanObjectStore: + destinationPath: s3://cnpg-backups/synapse + endpointURL: http://192.168.2.107:9010 + s3Credentials: + accessKeyId: + name: minio-cnpg-credentials + key: ACCESS_KEY_ID + secretAccessKey: + name: minio-cnpg-credentials + key: ACCESS_SECRET_KEY + retentionPolicy: "30d" + bootstrap: + initdb: + database: synapse + owner: synapse diff --git a/clusters/homelab/apps/synapse/cnpg-scheduledbackup-mas.yaml b/clusters/homelab/apps/synapse/cnpg-scheduledbackup-mas.yaml new file mode 100644 index 0000000..b89be5c --- /dev/null +++ b/clusters/homelab/apps/synapse/cnpg-scheduledbackup-mas.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: ScheduledBackup +metadata: + name: mas-db-backup + namespace: synapse +spec: + schedule: "0 3 * * *" + backupOwnerReference: self + cluster: + name: mas-db diff --git a/clusters/homelab/apps/synapse/cnpg-scheduledbackup-synapse.yaml b/clusters/homelab/apps/synapse/cnpg-scheduledbackup-synapse.yaml new file mode 100644 index 0000000..cb6e9cc --- /dev/null +++ b/clusters/homelab/apps/synapse/cnpg-scheduledbackup-synapse.yaml @@ -0,0 +1,10 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: ScheduledBackup +metadata: + name: synapse-db-backup + namespace: synapse +spec: + schedule: "0 3 * * *" + backupOwnerReference: self + cluster: + name: synapse-db diff --git a/clusters/homelab/apps/synapse/helmrelease.yaml b/clusters/homelab/apps/synapse/helmrelease.yaml new file mode 100644 index 0000000..9bffbb7 --- /dev/null +++ b/clusters/homelab/apps/synapse/helmrelease.yaml @@ -0,0 +1,78 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: ess + namespace: synapse +spec: + interval: 1h + chart: + spec: + chart: matrix-stack + version: ">=0.1.0" + sourceRef: + kind: HelmRepository + name: ess-helm + namespace: synapse + values: + # Server-Identität — permanent, niemals ändern nach erstem Deploy + serverName: commatrix.net-scope.org # VERIFY: ggf. matrix.hostname + + # Internes PostgreSQL deaktivieren — wir nutzen CNPG + postgresql: + enabled: false + + synapse: + enabled: true + # Kein Kubernetes Ingress — Cloudflare Tunnel routet direkt zum Service + ingress: + enabled: false + # Signing Key aus SOPS Secret (einmalig generiert, nie ersetzen) + signingKey: # VERIFY: exakten Pfad gegen values.yaml prüfen + existingSecret: + name: synapse-secret + key: SIGNING_KEY + # Externe CNPG-Datenbank + postgresql: # VERIFY + host: synapse-db-rw.synapse.svc.cluster.local + port: 5432 + database: synapse + username: synapse + sslMode: require + password: + existingSecret: + name: synapse-secret + key: SYNAPSE_DB_PASSWORD + + matrixAuthenticationService: + enabled: true + ingress: + enabled: false + postgresql: # VERIFY + host: mas-db-rw.synapse.svc.cluster.local + port: 5432 + database: mas + username: mas + sslMode: require + password: + existingSecret: + name: synapse-secret + key: MAS_DB_PASSWORD + + elementWeb: + enabled: true + ingress: + enabled: false + + elementAdmin: + enabled: false + + # Element Call braucht UDP — nicht über Cloudflare Tunnel möglich + matrixRtc: + enabled: false + + # Medien-Storage: lokale PVC — ausreichend für Homelab + synapse: + persistence: # VERIFY + enabled: true + size: 10Gi + storageClass: longhorn diff --git a/clusters/homelab/apps/synapse/helmrepository.yaml b/clusters/homelab/apps/synapse/helmrepository.yaml new file mode 100644 index 0000000..efc4ddb --- /dev/null +++ b/clusters/homelab/apps/synapse/helmrepository.yaml @@ -0,0 +1,9 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: ess-helm + namespace: synapse +spec: + interval: 1h + type: oci + url: oci://ghcr.io/element-hq/ess-helm diff --git a/clusters/homelab/apps/synapse/minio-secret.sops.yaml b/clusters/homelab/apps/synapse/minio-secret.sops.yaml new file mode 100644 index 0000000..6bf5f21 --- /dev/null +++ b/clusters/homelab/apps/synapse/minio-secret.sops.yaml @@ -0,0 +1,28 @@ +apiVersion: ENC[AES256_GCM,data:xsE=,iv:T5w04FbQfmMKkL0j1g2SSAS/1l+Fk6g/Bi0ZVm1khHs=,tag:xQWUU+WiDTpiT3j09QX2og==,type:str] +kind: ENC[AES256_GCM,data:nIIgKVva,iv:Ij1+no4db0KNdQChZzrtp0T8pn8diApmZb/f+kaYRxM=,tag:UCanL/X6rQxPGfxnqkVxTQ==,type:str] +metadata: + name: ENC[AES256_GCM,data:VZOY5WgV7Oz8Rzs+8rksm0L4J26cRg==,iv:iAMMJOYnFJFmAwVIYo3t3aJHbbW8vJqeQRv6joYNcOM=,tag:AbOeC3WlwnbvRMjrkTQ1UA==,type:str] + namespace: ENC[AES256_GCM,data:e4fJWCfKfA==,iv:yFHPwAmWqYBjqdrJcyYsdRT7b0jeFjG4mfk2lAh3k5U=,tag:7xXLXdmQy+4t31PfQatWMw==,type:str] +stringData: + ACCESS_KEY_ID: ENC[AES256_GCM,data:1no6G3U9pJSuFUNtYDUsjNREIC8=,iv:p7hy6PmVg0OVaFR1btrZBwJIuBZGmAIO3smuRBNzvl8=,tag:91Wdr2phhR0imEJdXWFMQw==,type:str] + ACCESS_SECRET_KEY: ENC[AES256_GCM,data:UJxAubCw01I9p6ZrK8ebNpbPpbytUvkAOX3kziSKCHwgEmNG8XmGLw==,iv:toLrbTFLB3K2cnuv20s2hiuCiWI+0La+M0tN85b95OU=,tag:BW885iIh2wwiwbxuQ46sHA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGczhpcnhFNm1vTVlVZ2pr + QnRDOUZYZVZ6cE56VnM2NjQ3OWVHM2cwWEI0CndMK2dNemJBdlFZTGpweWMrYnZD + MkUrU1hldXhmVDBmaGNCRU5zaUFPS3cKLS0tIEUvNnA3UGtVams1cThHcXhrdXF4 + VGZrQnhROXlkT01jSXZTclljU1RwczgKuKoQS8KFFmRvDqkRfhBOVIj1h+jRreXg + /dB0/gRm8rdMOjQJ+efDMD3dVqakQjM0o7LRol/FGNDnf/FrpNzHNw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-04-22T18:51:59Z" + mac: ENC[AES256_GCM,data:CF6yAODac/fYF7Qv5UnLggrsKqWBrFr0F7rKosq8Am7bzjUJ398B2MAl4g80IM+cwj4VSxBi2Ejltin/yhaTz2FhbR6Nmx4k4p8TCJFRUkKjx3rLw2WMNM0taYTvis0FPJjbMYshgF3eweaqq0LXNb7x3RooaaC47ouOfj3K3Gg=,iv:FgDkQdGCV1RyI3rZ7d6hWsCpqQDXHEA1UrmccwjXnPU=,tag:81huyBSdcOhsCG6/WMhIiw==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.4 diff --git a/clusters/homelab/apps/synapse/namespace.yaml b/clusters/homelab/apps/synapse/namespace.yaml new file mode 100644 index 0000000..4ffb611 --- /dev/null +++ b/clusters/homelab/apps/synapse/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: synapse diff --git a/clusters/homelab/apps/synapse/secret.sops.yaml b/clusters/homelab/apps/synapse/secret.sops.yaml new file mode 100644 index 0000000..97e6871 --- /dev/null +++ b/clusters/homelab/apps/synapse/secret.sops.yaml @@ -0,0 +1,29 @@ +apiVersion: ENC[AES256_GCM,data:goE=,iv:H1pzxncLUgHixtEgZyjTWBKj5iKrz42jGrczl1P50Ws=,tag:VZir/D6mWBmJwKUYqjrd4g==,type:str] +kind: ENC[AES256_GCM,data:D8Llc1/A,iv:cPjR+vLED+CX+Pdwcjc+L2v0yNZ3ZdjkO4D667M9/7k=,tag:0aqTslgYBl96X9l6lx3i5Q==,type:str] +metadata: + name: ENC[AES256_GCM,data:SmBtH0O3vw//AWWFZ5Y=,iv:gnQCyuTRZ1st9VU3hPDXkLi5gn9nii7Q3+lvkt7EP0I=,tag:9O/NQiE3qpsTLPgInLK25A==,type:str] + namespace: ENC[AES256_GCM,data:CEpwrvcCsA==,iv:0dFRs0WqHEaDWX/0TclxK2ZVcHcoCNuLsC8h3d6JDWI=,tag:ocCzvNRrXLICrQHZlDGvtw==,type:str] +stringData: + SYNAPSE_DB_PASSWORD: ENC[AES256_GCM,data:lopLbr7npKA=,iv:mfQ5kqAouOaI3Ako0sEoqQC5JMm5WNKNlDiAiW8R8GA=,tag:LSEiJStxtLCSHEn8NEe6ig==,type:str] + MAS_DB_PASSWORD: ENC[AES256_GCM,data:+yDolnP5aQc=,iv:Tnvytm8h90Joy3AQTEwEVgX6WpyejfjEMscnh/ryQ4w=,tag:9FGYGudnmbqhioZKRWs8Ag==,type:str] + SIGNING_KEY: ENC[AES256_GCM,data:SPfN1H56/58/YZJbgVyi1H5laOh+8ddJ1uAlmohBRJWOt28HKmERfpizyYsMssVFA99rZV8=,iv:wgP+dT1Oi+CofC+lSE+rfOdWBBxgUnBwrlMYtowYq8I=,tag:4c6rYHuP0CE/tpqJ4Xbcog==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNjIybzUyZzdMRWlhckhp + cWkwdW1LWFJzbUllbzg5S2V2RjBmSEtaaUMwCm5XMlhHVHI3VnYzTExGVlNLYllJ + N0Y1Sk4vWjBYZmFaZmpPV3psSFZPcWMKLS0tIG5yRFluV2FEbE9teFhpZTlOQjls + aStHQVhEcGdNQVFVcXVlcUQ2c1I5RFkKs412eV6uT7glhdQYQliApizmGwxRiM5k + p9FK94nfEC/I43yOhg84o7hInk944LVmqMlTRwGf7JSyFecuVBf3/Q== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-04-22T19:00:16Z" + mac: ENC[AES256_GCM,data:ES1qvs4VAi2jQsIQ8AEdZVZIiQiXg3B50nChijUXi9R2Nc9efe48lZ/luwIbxDXv/ps0oASp5VhKiuGy5zQS2Z0Dxon7CgwKlIlm+lRjirthTzmCGB+xik6aCVkBFn2fpLBMoBZEfZOrarVr7kLX4/zdEttczLv8ecvI4tJodjI=,iv:Jpge5tp+B7PykOqXiV7V1aZGfWCPqmOuWrR4U9D9i/U=,tag:YUyjaliOKzCDLwhGtkJXDw==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.4