axion1337.chat-gitops

6 Commits

Include renames

Author	SHA1	Message	Date
Thore Cimbal	32e2c8e556	feat: deploy client-side ClamAV scan service for encrypted rooms Auto-Deploy on Push / verify-and-notify (push) Successful in 53s Synapse's own media-scanning module (Issue #19) can never see E2EE attachment content - a structural limit, not a bug. This adds a small standalone HTTP wrapper around the same ClamAV instance, reachable from browser JS at /_scan, so the ThreadNet-Web client fork can scan plaintext both before encrypting/uploading and after downloading/ decrypting - covering both directions regardless of room encryption. Auth via Synapse's own /whoami endpoint, no separate auth system.	2026-07-29 16:25:16 +02:00
Thore Cimbal	db77785b6b	feat: real media antivirus scanning via custom Synapse module (Issue #19 ) Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s Deploys ClamAV and a small stdlib-only Synapse spam-checker module implementing check_media_file_for_spam over clamd's INSTREAM protocol. Unlike the originally-considered matrix-content-scanner proxy (which needs client-side cooperation neither Element Web nor Element X provide), this hooks Synapse's own module API directly - transparent to every client for unencrypted media. No custom Synapse image needed: the module is mounted via a ConfigMap onto PYTHONPATH using the ESS chart's extraVolumes/extraVolumeMounts/extraEnv support. Fails open on scanner errors so a ClamAV outage can't block all uploads.	2026-07-29 15:29:47 +02:00
Thore Cimbal	7f42a456eb	feat: deploy Draupnir moderation bot (Issue #18 ) Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s Bot account registered via mas-cli, compatibility token issued and stored via sops. Adds an explicit NetworkPolicy allow-rule since Draupnir needs to reach Synapse's client-server API in-namespace, which the existing default-deny policy would otherwise silently block.	2026-07-29 08:47:07 +02:00
Thore CimbalandClaude Sonnet 5	f5e9fc5d2b	feat(backup): add nightly Borg backups to Hetzner Storage Box Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s Closes issues #6 and #15 (treated jointly, per combined analysis in their comments). Two CronJobs, one per namespace, each pushing to its own Borg repo on the newly booked Storage Box (u641795.your-storagebox.de:23, BX11 1TB) with its own repo passphrase - a leaked passphrase for one doesn't expose the other: - matrix: synapse-backup dumps the synapse + matrixauthenticationservice DBs (shared postgres, existing chart-generated POSTGRES_ADMIN_PASSWORD) and the Synapse media_store PVC (read-only mount) - authentik: authentik-backup dumps the authentik DB (existing authentik-credentials pg-password) Custom image (rohana.axion1337.de/sorb/axion-backup:v1, postgres:17-alpine + borgbackup + openssh-client - matches the live Postgres major version exactly, unlike Alpine's stock postgresql16-client) pushed as a public package, same pattern as the existing threadnet-web image (no imagePullSecret needed). SSH host key pinned via known_hosts ConfigMap (captured via ssh-keyscan ahead of time) rather than trusting on first connect in an unattended job. Retention: 7 daily / 4 weekly / 6 monthly via borg prune. Schedule: 03:00 and 03:15, offset to avoid resource contention. NetworkPolicy: added each backup job's pod as an allowed source to its namespace's existing postgres ingress rule (matrix's allow-ingress-postgres, authentik's allow-ingress-authentik-postgresql from #37). Egress already unrestricted in both namespaces, so no change needed for the outbound SSH connection to the Storage Box. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-28 20:21:40 +02:00
Thore Cimbal	703cf1ff1c	fix: Allow synapse-main to reach MAS's port 8080 for token introspection Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s Second port-config incident from this rollout: synapse calls MAS's oauth2/introspect endpoint on port 8080 (not 8081 as assumed) for every single authenticated request (sync, pushrules, capabilities, etc). The rule only allowed kube-system (Traefik) on 8080, so every authenticated API call failed with 503 "Unable to introspect the access token" - all clients showed a lost connection. Patched live immediately, this commit brings Git back in sync with that patch.	2026-07-28 15:27:45 +02:00
Thore Cimbal	30578abaaf	feat: Default-deny ingress NetworkPolicy for matrix namespace Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s Ingress-only default-deny plus per-component allow rules, using named container ports throughout (not Service ports) after the authentik port-mismatch incident. Traefik -> element-web/element-admin/haproxy (fronts both matrix.axion1337.chat and well-known)/MAS; synapse <- haproxy+MAS; postgres <- synapse+MAS; RTC signalling via Traefik, RTC media NodePorts left open to the internet by design; monitoring scrape allows for synapse/postgres/rtc-sfu metrics; ACME solver allow. coturn (hostNetwork) needs nothing - NetworkPolicy doesn't apply to it. Part of issue #10.	2026-07-28 15:16:37 +02:00