feat: add synapse communication

clusters/homelab/apps/synapse.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: synapse
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./clusters/homelab/apps/synapse
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/homelab/apps/synapse/cnpg-cluster-mas.yaml

@@ -0,0 +1,26 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: mas-db
+  namespace: synapse
+spec:
+  instances: 3
+  storage:
+    size: 2Gi
+    storageClass: longhorn
+  backup:
+    barmanObjectStore:
+      destinationPath: s3://cnpg-backups/mas
+      endpointURL: http://192.168.2.107:9010
+      s3Credentials:
+        accessKeyId:
+          name: minio-cnpg-credentials
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: minio-cnpg-credentials
+          key: ACCESS_SECRET_KEY
+    retentionPolicy: "30d"
+  bootstrap:
+    initdb:
+      database: mas
+      owner: mas

clusters/homelab/apps/synapse/cnpg-cluster-synapse.yaml

@@ -0,0 +1,26 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: synapse-db
+  namespace: synapse
+spec:
+  instances: 3
+  storage:
+    size: 5Gi
+    storageClass: longhorn
+  backup:
+    barmanObjectStore:
+      destinationPath: s3://cnpg-backups/synapse
+      endpointURL: http://192.168.2.107:9010
+      s3Credentials:
+        accessKeyId:
+          name: minio-cnpg-credentials
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: minio-cnpg-credentials
+          key: ACCESS_SECRET_KEY
+    retentionPolicy: "30d"
+  bootstrap:
+    initdb:
+      database: synapse
+      owner: synapse

clusters/homelab/apps/synapse/cnpg-scheduledbackup-mas.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: mas-db-backup
+  namespace: synapse
+spec:
+  schedule: "0 3 * * *"
+  backupOwnerReference: self
+  cluster:
+    name: mas-db

clusters/homelab/apps/synapse/cnpg-scheduledbackup-synapse.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: synapse-db-backup
+  namespace: synapse
+spec:
+  schedule: "0 3 * * *"
+  backupOwnerReference: self
+  cluster:
+    name: synapse-db

clusters/homelab/apps/synapse/helmrelease.yaml

@@ -0,0 +1,78 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ess
+  namespace: synapse
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: matrix-stack
+      version: ">=0.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: ess-helm
+        namespace: synapse
+  values:
+    # Server-Identität — permanent, niemals ändern nach erstem Deploy
+    serverName: commatrix.net-scope.org  # VERIFY: ggf. matrix.hostname
+
+    # Internes PostgreSQL deaktivieren — wir nutzen CNPG
+    postgresql:
+      enabled: false
+
+    synapse:
+      enabled: true
+      # Kein Kubernetes Ingress — Cloudflare Tunnel routet direkt zum Service
+      ingress:
+        enabled: false
+      # Signing Key aus SOPS Secret (einmalig generiert, nie ersetzen)
+      signingKey:  # VERIFY: exakten Pfad gegen values.yaml prüfen
+        existingSecret:
+          name: synapse-secret
+          key: SIGNING_KEY
+      # Externe CNPG-Datenbank
+      postgresql:  # VERIFY
+        host: synapse-db-rw.synapse.svc.cluster.local
+        port: 5432
+        database: synapse
+        username: synapse
+        sslMode: require
+        password:
+          existingSecret:
+            name: synapse-secret
+            key: SYNAPSE_DB_PASSWORD
+
+    matrixAuthenticationService:
+      enabled: true
+      ingress:
+        enabled: false
+      postgresql:  # VERIFY
+        host: mas-db-rw.synapse.svc.cluster.local
+        port: 5432
+        database: mas
+        username: mas
+        sslMode: require
+        password:
+          existingSecret:
+            name: synapse-secret
+            key: MAS_DB_PASSWORD
+
+    elementWeb:
+      enabled: true
+      ingress:
+        enabled: false
+
+    elementAdmin:
+      enabled: false
+
+    # Element Call braucht UDP — nicht über Cloudflare Tunnel möglich
+    matrixRtc:
+      enabled: false
+
+    # Medien-Storage: lokale PVC — ausreichend für Homelab
+    synapse:
+      persistence:  # VERIFY
+        enabled: true
+        size: 10Gi
+        storageClass: longhorn

clusters/homelab/apps/synapse/helmrepository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ess-helm
+  namespace: synapse
+spec:
+  interval: 1h
+  type: oci
+  url: oci://ghcr.io/element-hq/ess-helm

clusters/homelab/apps/synapse/minio-secret.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: ENC[AES256_GCM,data:xsE=,iv:T5w04FbQfmMKkL0j1g2SSAS/1l+Fk6g/Bi0ZVm1khHs=,tag:xQWUU+WiDTpiT3j09QX2og==,type:str]
+kind: ENC[AES256_GCM,data:nIIgKVva,iv:Ij1+no4db0KNdQChZzrtp0T8pn8diApmZb/f+kaYRxM=,tag:UCanL/X6rQxPGfxnqkVxTQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:VZOY5WgV7Oz8Rzs+8rksm0L4J26cRg==,iv:iAMMJOYnFJFmAwVIYo3t3aJHbbW8vJqeQRv6joYNcOM=,tag:AbOeC3WlwnbvRMjrkTQ1UA==,type:str]
+    namespace: ENC[AES256_GCM,data:e4fJWCfKfA==,iv:yFHPwAmWqYBjqdrJcyYsdRT7b0jeFjG4mfk2lAh3k5U=,tag:7xXLXdmQy+4t31PfQatWMw==,type:str]
+stringData:
+    ACCESS_KEY_ID: ENC[AES256_GCM,data:1no6G3U9pJSuFUNtYDUsjNREIC8=,iv:p7hy6PmVg0OVaFR1btrZBwJIuBZGmAIO3smuRBNzvl8=,tag:91Wdr2phhR0imEJdXWFMQw==,type:str]
+    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:UJxAubCw01I9p6ZrK8ebNpbPpbytUvkAOX3kziSKCHwgEmNG8XmGLw==,iv:toLrbTFLB3K2cnuv20s2hiuCiWI+0La+M0tN85b95OU=,tag:BW885iIh2wwiwbxuQ46sHA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGczhpcnhFNm1vTVlVZ2pr
+            QnRDOUZYZVZ6cE56VnM2NjQ3OWVHM2cwWEI0CndMK2dNemJBdlFZTGpweWMrYnZD
+            MkUrU1hldXhmVDBmaGNCRU5zaUFPS3cKLS0tIEUvNnA3UGtVams1cThHcXhrdXF4
+            VGZrQnhROXlkT01jSXZTclljU1RwczgKuKoQS8KFFmRvDqkRfhBOVIj1h+jRreXg
+            /dB0/gRm8rdMOjQJ+efDMD3dVqakQjM0o7LRol/FGNDnf/FrpNzHNw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-22T18:51:59Z"
+    mac: ENC[AES256_GCM,data:CF6yAODac/fYF7Qv5UnLggrsKqWBrFr0F7rKosq8Am7bzjUJ398B2MAl4g80IM+cwj4VSxBi2Ejltin/yhaTz2FhbR6Nmx4k4p8TCJFRUkKjx3rLw2WMNM0taYTvis0FPJjbMYshgF3eweaqq0LXNb7x3RooaaC47ouOfj3K3Gg=,iv:FgDkQdGCV1RyI3rZ7d6hWsCpqQDXHEA1UrmccwjXnPU=,tag:81huyBSdcOhsCG6/WMhIiw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

clusters/homelab/apps/synapse/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: synapse

clusters/homelab/apps/synapse/secret.sops.yaml

@@ -0,0 +1,29 @@
+apiVersion: ENC[AES256_GCM,data:goE=,iv:H1pzxncLUgHixtEgZyjTWBKj5iKrz42jGrczl1P50Ws=,tag:VZir/D6mWBmJwKUYqjrd4g==,type:str]
+kind: ENC[AES256_GCM,data:D8Llc1/A,iv:cPjR+vLED+CX+Pdwcjc+L2v0yNZ3ZdjkO4D667M9/7k=,tag:0aqTslgYBl96X9l6lx3i5Q==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:SmBtH0O3vw//AWWFZ5Y=,iv:gnQCyuTRZ1st9VU3hPDXkLi5gn9nii7Q3+lvkt7EP0I=,tag:9O/NQiE3qpsTLPgInLK25A==,type:str]
+    namespace: ENC[AES256_GCM,data:CEpwrvcCsA==,iv:0dFRs0WqHEaDWX/0TclxK2ZVcHcoCNuLsC8h3d6JDWI=,tag:ocCzvNRrXLICrQHZlDGvtw==,type:str]
+stringData:
+    SYNAPSE_DB_PASSWORD: ENC[AES256_GCM,data:lopLbr7npKA=,iv:mfQ5kqAouOaI3Ako0sEoqQC5JMm5WNKNlDiAiW8R8GA=,tag:LSEiJStxtLCSHEn8NEe6ig==,type:str]
+    MAS_DB_PASSWORD: ENC[AES256_GCM,data:+yDolnP5aQc=,iv:Tnvytm8h90Joy3AQTEwEVgX6WpyejfjEMscnh/ryQ4w=,tag:9FGYGudnmbqhioZKRWs8Ag==,type:str]
+    SIGNING_KEY: ENC[AES256_GCM,data:SPfN1H56/58/YZJbgVyi1H5laOh+8ddJ1uAlmohBRJWOt28HKmERfpizyYsMssVFA99rZV8=,iv:wgP+dT1Oi+CofC+lSE+rfOdWBBxgUnBwrlMYtowYq8I=,tag:4c6rYHuP0CE/tpqJ4Xbcog==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNjIybzUyZzdMRWlhckhp
+            cWkwdW1LWFJzbUllbzg5S2V2RjBmSEtaaUMwCm5XMlhHVHI3VnYzTExGVlNLYllJ
+            N0Y1Sk4vWjBYZmFaZmpPV3psSFZPcWMKLS0tIG5yRFluV2FEbE9teFhpZTlOQjls
+            aStHQVhEcGdNQVFVcXVlcUQ2c1I5RFkKs412eV6uT7glhdQYQliApizmGwxRiM5k
+            p9FK94nfEC/I43yOhg84o7hInk944LVmqMlTRwGf7JSyFecuVBf3/Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-22T19:00:16Z"
+    mac: ENC[AES256_GCM,data:ES1qvs4VAi2jQsIQ8AEdZVZIiQiXg3B50nChijUXi9R2Nc9efe48lZ/luwIbxDXv/ps0oASp5VhKiuGy5zQS2Z0Dxon7CgwKlIlm+lRjirthTzmCGB+xik6aCVkBFn2fpLBMoBZEfZOrarVr7kLX4/zdEttczLv8ecvI4tJodjI=,iv:Jpge5tp+B7PykOqXiV7V1aZGfWCPqmOuWrR4U9D9i/U=,tag:YUyjaliOKzCDLwhGtkJXDw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4