Revert to ESS 26.4.0 to test URL preview functionality

Add Authentik v2026.x with embedded PostgreSQL in new namespace. Includes HelmRelease with valuesFrom injection for encrypted credentials, cert-manager Certificate for auth.axion1337.chat, and Traefik IngressRoute. Authentik serves as OIDC provider for MAS; registration via invitation links only.

DNS A-record setup and Authentik UI configuration (OIDC provider creation) are manual post-deployment steps.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

apps/authentik/authentik-secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: authentik-credentials
+    namespace: authentik
+stringData:
+    secret_key: ENC[AES256_GCM,data:yIyQapbFtFM11LynFtkV3ffExhaDfN9QHeFbI1T0xkIhgsV+9sjg3qwMVmeBlAe7xZl8gsAM4kDj2Q6O91OdDg==,iv:+Cl8vOcxG9/mgRheaCO0bLWyCJXN+f1F2DD3oeHbPFY=,tag:711ytyKf6/tmXomBLoffGA==,type:str]
+    pg-password: ENC[AES256_GCM,data:3w8R9mRjMXMJDLjrC8QYaXFHsCU3yYZs2PcaFQNp3Z4=,iv:G/aXgoGz3vBOzZ5K3Y+DDJsqer4F5gvcMmtkzRx93CU=,tag:dXPs1pY/APvnMlxdvB1EkA==,type:str]
+    smtp-password: ENC[AES256_GCM,data:JpMgaQFPkBzOg5WjvpmhM0kPwvZkH+4tQjT17RJHjG14WjmWtfG9Bg==,iv:zjQRLIlrxKv5hbd4JZowNUEiibiCUMf79acZY0+dYAc=,tag:ORPafTPyOQJvVvHWQGmqhA==,type:str]
+sops:
+    age:
+        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRekJuZythYzliTFJ3RlhS
+            R2p6TG9NeFdabFlPRWtpNHJMYVVxTWZEcmlRClk0WUorSzdxNlcyWHYwWFBTMnlq
+            TlM4dENSSit2S3VGSzJCeTRTYU52dmcKLS0tIEF0WkV0M25OSEo1N0FEYXI5Q0Z6
+            QXVrY1NTeHZkeTlPRWNlVThzWno3T0kKC0KBoLT64GNqb8Ri9u69G7nqb1KftwwP
+            /24aVHrPxKi9d4ij9n3bvCYDF4rhtfexhrE4n7CfuKn2DcSiuTniuw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-29T21:43:59Z"
+    mac: ENC[AES256_GCM,data:Y+dJppkaVZ5NOhlvwbbsF5+vDFqGUI1Ps8IcE4J7FIW4HIdMVf6RKM0EInvPUW1LaBlmelCitcE30w0As7ysNRhLY8yUDaKUvuU6mRejlNUIF8wAHzhciL2jTvAQsArHjybJatEig28+wM9VcY8JEa/d/CmuiB9Nq4WbIV+JXlA=,iv:UQj2rIVLNPjtYp3d/jRyNfJyyyUsZ3+NDCgpI4aztzc=,tag:cwiCzG/A+rfRFfLjXVt82w==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.12.2

apps/authentik/authentik.yaml

@@ -0,0 +1,87 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: authentik
+      version: "2026.2.2"
+      sourceRef:
+        kind: HelmRepository
+        name: goauthentik
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  valuesFrom:
+    - kind: Secret
+      name: authentik-credentials
+      valuesKey: secret_key
+      targetPath: authentik.secret_key
+    - kind: Secret
+      name: authentik-credentials
+      valuesKey: pg-password
+      targetPath: authentik.postgresql.password
+    - kind: Secret
+      name: authentik-credentials
+      valuesKey: pg-password
+      targetPath: postgresql.auth.password
+    - kind: Secret
+      name: authentik-credentials
+      valuesKey: smtp-password
+      targetPath: authentik.email.password
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+
+    authentik:
+      log_level: info
+      error_reporting:
+        enabled: false
+      email:
+        host: smtp.ionos.de
+        port: 587
+        username: gamemaster@axion1337.chat
+        use_tls: true
+        from: "Authentik <gamemaster@axion1337.chat>"
+
+    server:
+      ingress:
+        enabled: false
+      resources:
+        requests:
+          cpu: 100m
+          memory: 512Mi
+        limits:
+          memory: 1Gi
+
+    worker:
+      resources:
+        requests:
+          cpu: 50m
+          memory: 512Mi
+        limits:
+          memory: 1Gi
+
+    postgresql:
+      enabled: true
+      auth:
+        username: authentik
+        database: authentik
+      primary:
+        persistence:
+          enabled: true
+          size: 8Gi
+        resources:
+          requests:
+            cpu: 50m
+            memory: 256Mi
+          limits:
+            memory: 512Mi

apps/authentik/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: auth-axion1337-chat-cert
+  namespace: authentik
+spec:
+  secretName: auth-axion1337-chat-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - auth.axion1337.chat

apps/authentik/helm-repo.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: goauthentik
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://charts.goauthentik.io

apps/authentik/ingress.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    secretName: auth-axion1337-chat-tls
+  routes:
+    - match: Host(`auth.axion1337.chat`)
+      kind: Rule
+      services:
+        - name: authentik-server
+          port: 80

apps/authentik/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repo.yaml
+  - authentik-secret.yaml
+  - certificate.yaml
+  - authentik.yaml
+  - ingress.yaml

apps/authentik/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

apps/monitoring/alloy-config.yaml

@@ -0,0 +1,135 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: alloy-config
+  namespace: monitoring
+data:
+  config.alloy: |
+    // Kubernetes pod discovery
+    discovery.kubernetes "k8s_pods" {
+      role = "pod"
+    }
+
+    // Relabel for Prometheus scrape
+    discovery.relabel "prometheus_pods" {
+      targets = discovery.kubernetes.k8s_pods.targets
+      rule {
+        source_labels = ["__meta_kubernetes_pod_annotation_prometheus_io_scrape"]
+        action = "keep"
+        regex = "true"
+      }
+      rule {
+        source_labels = ["__meta_kubernetes_pod_annotation_prometheus_io_path"]
+        action = "replace"
+        target_label = "__metrics_path__"
+        regex = "(.+)"
+      }
+      rule {
+        source_labels = ["__address__", "__meta_kubernetes_pod_annotation_prometheus_io_port"]
+        action = "replace"
+        regex = "([^:]+)(?::\\d+)?;(\\d+)"
+        replacement = "$1:$2"
+        target_label = "__address__"
+      }
+      rule {
+        source_labels = ["__meta_kubernetes_namespace"]
+        action = "replace"
+        target_label = "namespace"
+      }
+      rule {
+        source_labels = ["__meta_kubernetes_pod_name"]
+        action = "replace"
+        target_label = "pod"
+      }
+    }
+
+    // Scrape Flux controllers (flux-system namespace, port 8080)
+    discovery.kubernetes "flux_pods" {
+      role = "pod"
+      namespaces {
+        names = ["flux-system"]
+      }
+    }
+
+    discovery.relabel "flux_scrape" {
+      targets = discovery.kubernetes.flux_pods.targets
+      rule {
+        source_labels = ["__meta_kubernetes_pod_container_port_number"]
+        action = "keep"
+        regex = "8080"
+      }
+      rule {
+        source_labels = ["__meta_kubernetes_namespace"]
+        action = "replace"
+        target_label = "namespace"
+      }
+      rule {
+        source_labels = ["__meta_kubernetes_pod_name"]
+        action = "replace"
+        target_label = "pod"
+      }
+    }
+
+    // Scrape kube-state-metrics
+    prometheus.scrape "kube_state_metrics" {
+      targets = [{
+        __address__ = "kube-state-metrics.monitoring.svc.cluster.local:8080",
+      }]
+      forward_to = [prometheus.remote_write.selendis.receiver]
+      scrape_interval = "30s"
+      scrape_timeout = "10s"
+    }
+
+    // Scrape Flux controllers
+    prometheus.scrape "flux" {
+      targets = discovery.relabel.flux_scrape.output
+      forward_to = [prometheus.remote_write.selendis.receiver]
+      scrape_interval = "30s"
+      scrape_timeout = "10s"
+      job_name = "flux"
+    }
+
+    // Scrape node-exporter DaemonSet
+    prometheus.scrape "node_exporter" {
+      targets = [{
+        __address__ = "prometheus-node-exporter.monitoring.svc.cluster.local:9100",
+      }]
+      forward_to = [prometheus.remote_write.selendis.receiver]
+      scrape_interval = "30s"
+      scrape_timeout = "10s"
+    }
+
+    // Scrape Synapse metrics
+    prometheus.scrape "synapse" {
+      targets = [{
+        __address__ = "matrix-stack-synapse-main.matrix.svc.cluster.local:9000",
+      }]
+      forward_to = [prometheus.remote_write.selendis.receiver]
+      scrape_interval = "30s"
+      scrape_timeout = "10s"
+    }
+
+    // Kubernetes pod logs to Loki
+    loki.source.kubernetes "k8s_logs" {
+      targets = discovery.kubernetes.k8s_pods.targets
+      forward_to = [loki.write.selendis.receiver]
+    }
+
+    // Remote write to Selendis Prometheus
+    prometheus.remote_write "selendis" {
+      endpoint {
+        url = "http://10.0.0.3:9090/api/v1/write"
+        write_relabel_config {
+          source_labels = ["__name__"]
+          regex = "go_.*|process_.*"
+          action = "drop"
+        }
+      }
+    }
+
+    // Remote write logs to Selendis Loki
+    loki.write "selendis" {
+      endpoint {
+        url = "http://10.0.0.3:3100/loki/api/v1/push"
+      }
+    }

apps/monitoring/alloy.yaml

@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: alloy
+  namespace: monitoring
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: alloy
+      version: "0.x"
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+        namespace: flux-system
+  values:
+    alloy:
+      configMap:
+        name: alloy-config
+    replicaCount: 1
+    serviceAccount:
+      create: true
+      name: alloy
+    rbac:
+      create: true
+    podAnnotations:
+      prometheus.io/scrape: "false"
+    resources:
+      limits:
+        memory: 512Mi
+      requests:
+        cpu: 100m
+        memory: 256Mi

apps/monitoring/helm-repos.yaml

@@ -0,0 +1,18 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://prometheus-community.github.io/helm-charts
+
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://grafana.github.io/helm-charts

apps/monitoring/kube-state-metrics.yaml

@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-state-metrics
+  namespace: monitoring
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: kube-state-metrics
+      version: "5.x"
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  values:
+    replicas: 1
+    service:
+      port: 8080
+    prometheus:
+      monitor:
+        enabled: false

apps/monitoring/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repos.yaml
+  - kube-state-metrics.yaml
+  - node-exporter.yaml
+  - alloy-config.yaml
+  - alloy.yaml

apps/monitoring/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

apps/monitoring/node-exporter.yaml

@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: prometheus-node-exporter
+  namespace: monitoring
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: prometheus-node-exporter
+      version: "4.x"
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  values:
+    hostNetwork: true
+    hostPID: true
+    hostRootFsMount:
+      enabled: true
+    service:
+      port: 9100
+      targetPort: 9100
+    prometheus:
+      monitor:
+        enabled: false
+    tolerations:
+      - effect: NoSchedule
+        operator: Exists

apps/production/apex-ingress.yaml

@@ -0,0 +1,44 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: axion-apex-tls
+  namespace: matrix
+spec:
+  secretName: axion-apex-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - axion1337.chat
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: axion-apex
+  namespace: matrix
+spec:
+  entryPoints: [websecure]
+  tls:
+    secretName: axion-apex-tls
+  routes:
+    # Höchste Priorität: /.well-known/matrix/* -> wellKnownDelegation-Service
+    - match: Host(`axion1337.chat`) && PathPrefix(`/.well-known/matrix`)
+      kind: Rule
+      priority: 100
+      services:
+        - name: matrix-stack-well-known
+          port: 8010
+    # Element Desktop Setup Skripte
+    - match: Host(`axion1337.chat`) && PathPrefix(`/docs/setup`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: element-web-docs
+          port: 80
+    # Niedrigere Priorität: alles andere -> Element Web
+    - match: Host(`axion1337.chat`)
+      kind: Rule
+      priority: 10
+      services:
+        - name: matrix-stack-element-web
+          port: 80

apps/production/coturn-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: coturn-secret
+    namespace: matrix
+stringData:
+    TURN_SECRET: ENC[AES256_GCM,data:SILIqMB+fmAMFITAL7lG1hOgICec6BJf1mOcK0gdmnCHWYqRuJv7jgjfGylG25xzQKi+zE7Qual9PnkZG2KiOA==,iv:+GZqLGusE4Q0x2jEEtFxj06rryyQmQhXdkTy4eE8ZHw=,tag:OpSZkinPTAi1ZKWyo8OX3A==,type:str]
+sops:
+    age:
+        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRk1mK3NWc1l4T0JCOFpF
+            S0RuQ3ViZmo3QTNVL2JvZ0hzMy91R2l0TEhzCk01a1VGdk1sdVg4aWswTzRibXI4
+            ZlJtNFF5MjBONEZOaWVpeU5taHl2bkEKLS0tIGxpUHY3NUFLWFBaWm1QSlZiVFkx
+            MEJleHFnd3oyT3VPL2dsYkpMUlRkOWMKcKUIgsQ/ff49pGGXMnYwJmwqPVC7woAR
+            IEzvhcNX97xx746SnrxZe5t2YadsYMkYIl0nvqBPJhSlvqMNafpQbQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-29T21:06:21Z"
+    mac: ENC[AES256_GCM,data:UhyR5m1HYWrZHwNLW5sg2PxbpaydWbP5cekghGlzSpQg7CYEcvZw3tJ/qB8zA19xZSM7tdSHOXdD+QytRq6qW59M1unqMaumA43B6JxQg1C1NdXAW0mkSc2WiNchvgpVii9P/TVlzSSIRwC3YGCQUsfa3SSfNzI4Z6fMuBnhYLE=,iv:4HYxbrYSRJLe1KcQ6q8bpee8/Lx1m3pPmisb/L2Mu64=,tag:l7n3u+Pg6533OzwtNUZvNw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.12.2

apps/production/coturn.yaml

@@ -0,0 +1,162 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coturn-config
+  namespace: matrix
+data:
+  turnserver.conf: |
+    # TURN Server configuration
+    realm=axion1337.chat
+
+    # Listen ports
+    listening-port=3478
+    listening-ip=0.0.0.0
+    alt-listening-port=5349
+    alt-listening-ip=0.0.0.0
+
+    # External IPs (for clients behind NAT)
+    relay-ip=49.13.132.245
+    external-ip=49.13.132.245
+
+    # Relay port range
+    min-bps=0
+    bps-capacity=0
+
+    # Authentication
+    use-auth-secret
+    static-auth-secret=$TURN_SECRET
+
+    # HTTPS/TLS
+    cert=/etc/coturn/tls/tls.crt
+    pkey=/etc/coturn/tls/tls.key
+
+    # Performance tuning
+    max-bps=0
+    bps-capacity=0
+    log-file=stdout
+
+    # Logging
+    verbose
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: coturn
+  namespace: matrix
+spec:
+  type: ClusterIP
+  ports:
+    - name: stun-udp
+      port: 3478
+      protocol: UDP
+    - name: stun-tcp
+      port: 3478
+      protocol: TCP
+    - name: turns-tcp
+      port: 5349
+      protocol: TCP
+  selector:
+    app: coturn
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coturn
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: coturn
+  template:
+    metadata:
+      labels:
+        app: coturn
+      annotations:
+        prometheus.io/scrape: "false"
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      initContainers:
+      - name: init-config
+        image: busybox:1.28
+        command:
+        - sh
+        - -c
+        - |
+          TURN_SECRET=$(cat /etc/coturn-secret/TURN_SECRET)
+          sed "s|\$TURN_SECRET|$TURN_SECRET|g" /etc/coturn-template/turnserver.conf > /etc/coturn/turnserver.conf
+          chmod 644 /etc/coturn/turnserver.conf
+        resources:
+          limits:
+            cpu: 100m
+            memory: 64Mi
+          requests:
+            cpu: 50m
+            memory: 32Mi
+        volumeMounts:
+        - name: config-template
+          mountPath: /etc/coturn-template
+        - name: config
+          mountPath: /etc/coturn
+        - name: secret
+          mountPath: /etc/coturn-secret
+          readOnly: true
+      containers:
+      - name: coturn
+        image: coturn/coturn:latest
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: stun-udp
+          containerPort: 3478
+          protocol: UDP
+        - name: stun-tcp
+          containerPort: 3478
+          protocol: TCP
+        - name: turns-tcp
+          containerPort: 5349
+          protocol: TCP
+        volumeMounts:
+        - name: config
+          mountPath: /etc/coturn
+        - name: tls
+          mountPath: /etc/coturn/tls
+          readOnly: true
+        resources:
+          limits:
+            cpu: 500m
+            memory: 256Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - "netstat -uln | grep 3478 || exit 1"
+          initialDelaySeconds: 30
+          periodSeconds: 10
+      volumes:
+      - name: config
+        emptyDir: {}
+      - name: config-template
+        configMap:
+          name: coturn-config
+      - name: secret
+        secret:
+          secretName: coturn-secret
+          defaultMode: 0400
+      - name: tls
+        secret:
+          secretName: turn-axion1337-chat-tls
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - matrix

apps/production/custom-configs/element-values.yaml

@@ -9,16 +9,213 @@ data:
       additional:
         config.json: |
           {
+            "configUrl": "https://axion1337.chat/config.json",
             "brand": "aXion1337.Chat",
             "default_theme": "aXion1337 Dark",
+            "show_labs_settings": true,
+            "features": {
+              "feature_qr_code_login": true,
+              "feature_new_room_list": false
+            },
             "setting_defaults": {
               "custom_themes": [
                 {
                   "name": "aXion1337 Dark",
                   "is_dark": true,
                   "colors": {
-                    "accent-color": "#ffaf0f"
-                    // Deine restlichen Theme-Farben hier...
+                    "accent-color": "#ffaf0f",
+                    "primary-color": "#ffaf0f",
+                    "secondary-color": "#ffaf0f"
+                  }
+                },
+                {
+                  "name": "Deep Purple",
+                  "is_dark": true,
+                  "colors": {
+                    "accent-color": "#6503b3",
+                    "primary-color": "#368bd6",
+                    "warning-color": "#b30356",
+                    "sidebar-color": "#15171B",
+                    "roomlist-background-color": "#22262E",
+                    "roomlist-text-color": "#A1B2D1",
+                    "roomlist-text-secondary-color": "#EDF3FF",
+                    "roomlist-highlights-color": "#343A46",
+                    "roomlist-separator-color": "#a1b2d1",
+                    "timeline-background-color": "#181b21",
+                    "timeline-text-color": "#EDF3FF",
+                    "timeline-text-secondary-color": "#A1B2D1",
+                    "timeline-highlights-color": "#22262E"
+                  }
+                },
+                {
+                  "name": "Discord Dark",
+                  "is_dark": true,
+                  "colors": {
+                    "accent-color": "#747ff4",
+                    "accent": "#747ff4",
+                    "primary-color": "#00aff4",
+                    "warning-color": "#faa81ad9",
+                    "alert": "#faa81ad9",
+                    "sidebar-color": "#202225",
+                    "roomlist-background-color": "#2f3136",
+                    "roomlist-text-color": "#dcddde",
+                    "roomlist-text-secondary-color": "#8e9297",
+                    "roomlist-highlights-color": "#4f545c52",
+                    "roomlist-separator-color": "#40444b",
+                    "timeline-background-color": "#36393f",
+                    "timeline-text-color": "#dcddde",
+                    "secondary-content": "#dcddde",
+                    "tertiary-content": "#dcddde",
+                    "timeline-text-secondary-color": "#b9bbbe",
+                    "timeline-highlights-color": "#04040512",
+                    "reaction-row-button-selected-bg-color": "#4752c4",
+                    "menu-selected-color": "#4752c4",
+                    "focus-bg-color": "#4752c4",
+                    "room-highlight-color": "#4752c4",
+                    "other-user-pill-bg-color": "#4752c4",
+                    "togglesw-off-color": "#72767d"
+                  },
+                  "compound": {
+                    "--cpd-color-theme-bg": "#0019ff",
+                    "--cpd-color-bg-canvas-default": "#2f3136",
+                    "--cpd-color-bg-subtle-secondary": "#2f3136",
+                    "--cpd-color-bg-subtle-primary": "#4f545c52",
+                    "--cpd-color-bg-action-primary-rest": "#dcddde",
+                    "--cpd-color-bg-action-secondary-rest": "#2f3136",
+                    "--cpd-color-bg-critical-primary": "#fd3f3c",
+                    "--cpd-color-bg-critical-subtle": "#745862",
+                    "--cpd-color-bg-critical-hovered": "#fd3f3c",
+                    "--cpd-color-bg-accent-rest": "#4cb387",
+                    "--cpd-color-text-primary": "#dcddde",
+                    "--cpd-color-text-secondary": "#b9bbbe",
+                    "--cpd-color-text-action-accent": "#b9bbbe",
+                    "--cpd-color-text-critical-primary": "#fd3f3c",
+                    "--cpd-color-text-success-primary": "#4cb387",
+                    "--cpd-color-icon-primary": "#dcddde",
+                    "--cpd-color-icon-secondary": "#dcddde",
+                    "--cpd-color-icon-tertiary": "#a7a0a7",
+                    "--cpd-color-icon-accent-tertiary": "#4cb387",
+                    "--cpd-color-border-interactive-primary": "#5d6064",
+                    "--cpd-color-border-interactive-secondary": "#5d6064",
+                    "--cpd-color-border-critical-primary": "#fd3f3c",
+                    "--cpd-color-border-success-subtle": "#4cb387"
+                  }
+                },
+                {
+                  "name": "Electric Blue",
+                  "is_dark": false,
+                  "colors": {
+                    "accent-color": "#3596fc",
+                    "primary-color": "#368bd6",
+                    "warning-color": "#ff4b55",
+                    "sidebar-color": "#27303a",
+                    "roomlist-background-color": "#f3f8fd",
+                    "roomlist-text-color": "#2e2f32",
+                    "roomlist-text-secondary-color": "#61708b",
+                    "roomlist-highlights-color": "#ffffff",
+                    "roomlist-separator-color": "#e3e8f0",
+                    "timeline-background-color": "#ffffff",
+                    "timeline-text-color": "#2e2f32",
+                    "timeline-text-secondary-color": "#61708b",
+                    "timeline-highlights-color": "#f3f8fd",
+                    "username-colors": ["#ff0000", "#ff7f00", "#ffff00", "#00ff00", "#0000ff", "#4b0082", "#9400d3", "#ff1493"],
+                    "avatar-background-colors": ["#cc0000", "#cc6600", "#cccc00", "#00cc00", "#0000cc", "#3b0066", "#7a00b3", "#cc1077"]
+                  },
+                  "compound": {
+                    "--cpd-color-icon-accent-tertiary": "var(--cpd-color-blue-800)",
+                    "--cpd-color-text-action-accent": "var(--cpd-color-blue-900)"
+                  }
+                },
+                {
+                  "name": "Everforest dark hard",
+                  "is_dark": true,
+                  "colors": {
+                    "accent-color": "#a7c080",
+                    "primary-color": "#a7c080",
+                    "warning-color": "#e67e80",
+                    "sidebar-color": "#323d43",
+                    "roomlist-background-color": "#2f383e",
+                    "roomlist-text-color": "#d3c6aa",
+                    "roomlist-text-secondary-color": "#d3c6aa",
+                    "roomlist-highlights-color": "#4b565c",
+                    "roomlist-separator-color": "#4b565c",
+                    "timeline-background-color": "#2b3339",
+                    "timeline-text-color": "#d3c6aa",
+                    "secondary-content": "#d3c6aa",
+                    "tertiary-content": "#d3c6aa",
+                    "timeline-text-secondary-color": "#a7c080",
+                    "timeline-highlights-color": "#4b565c",
+                    "reaction-row-button-selected-bg-color": "#4b565c"
+                  }
+                },
+                {
+                  "name": "Gruvbox Dark",
+                  "is_dark": true,
+                  "colors": {
+                    "accent-color": "#bd93f9",
+                    "primary-color": "#fe8019",
+                    "warning-color": "#fb4934",
+                    "sidebar-color": "#282828",
+                    "roomlist-background-color": "#1d2021",
+                    "roomlist-text-color": "#a89984",
+                    "roomlist-text-secondary-color": "#00ff00",
+                    "roomlist-highlights-color": "#00000030",
+                    "roomlist-separator-color": "#4d4d4d90",
+                    "timeline-background-color": "#282828",
+                    "timeline-text-color": "#ebdbb2",
+                    "secondary-content": "#928374",
+                    "tertiary-content": "#928374",
+                    "quinary-content": "#504945",
+                    "timeline-text-secondary-color": "#a89984",
+                    "timeline-highlights-color": "#00000030",
+                    "reaction-row-button-selected-bg-color": "#689d6a",
+                    "menu-selected-color": "#504945",
+                    "icon-button-color": "#928374",
+                    "accent": "#689d6a",
+                    "alert": "#cc241d",
+                    "username-colors": [
+                      "#cc241d",
+                      "#98971a",
+                      "#d79921",
+                      "#458588",
+                      "#b16286",
+                      "#689d6a",
+                      "#a89984",
+                      "#d65d0e"
+                    ],
+                    "avatar-background-colors": ["#458588", "#b16286", "#689d6a"]
+                  }
+                },
+                {
+                  "name": "Wal",
+                  "is_dark": true,
+                  "colors": {
+                    "accent-color": "#888888",
+                    "accent": "#888888",
+                    "primary-color": "#4a90e2",
+                    "warning-color": "#e74c3c",
+                    "alert": "#e74c3c",
+                    "sidebar-color": "#2b2d31",
+                    "roomlist-background-color": "#e74c3c",
+                    "roomlist-text-color": "#888888",
+                    "roomlist-text-secondary-color": "#c0c0c0",
+                    "roomlist-highlights-color": "#b8b8b8",
+                    "roomlist-separator-color": "#5e81ac",
+                    "timeline-background-color": "#2b2d31",
+                    "timeline-text-color": "#888888",
+                    "timeline-text-secondary-color": "#888888",
+                    "timeline-highlights-color": "#e74c3c",
+                    "username-colors": ["#22222a", "#e74c3c", "#b8bb26", "#fabd2f", "#4a90e2", "#b16286", "#8ec07c", "#ebdbb2"],
+                    "avatar-background-colors": ["#fabd2f", "#4a90e2", "#b16286"],
+                    "reaction-row-button-selected-bg-color": "#4a90e2",
+                    "menu-selected-color": "#4a90e2",
+                    "focus-bg-color": "#4a90e2",
+                    "room-highlight-color": "#4a90e2",
+                    "other-user-pill-bg-color": "#4a90e2",
+                    "icon-button-color": "#8ec07c",
+                    "togglesw-off-color": "#4a90e2",
+                    "secondary-content": "#888888",
+                    "tertiary-content": "#888888"
                   }
                 }
               ]

apps/production/custom-configs/mas-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ess-mas-values-secret
+    namespace: matrix
+stringData:
+    values.yaml: ENC[AES256_GCM,data:tPLcPvoTa2Qs49JSDW6CqiYMIrjsoKrExCl+hOm5R3/o+O9Lf4UqyMC4QY6T303m7GMU3tIDGX4js8NS7Fdcs9YOKoInUKlYqCYzNio+BRsl1DGtzEtcUWhXZQC58RHbI8jiLhXsI1x2vSYsMj5MkymVe9Kmjw91vxEivzn8dC2zae4rFGk/LyLoI5BHzSCT6csUGtGZe01rN/DsGpHxkYNbzinBK3uFM43IgcjCrkBK8jzsxUYA4JWvzBJ1tB5TyyTgZBBe2Baxj7vHf9SysGwbRl4TBzY5at8cPKKnmh7qaHQO3FHCCqfHi1ymt1vNRtPPGRGAKWqC8AroXTPUUe4oSQ7wakhuQwPAhQJn0FHjIJNbp2J7M9K3nWnf0eugDPcp1pQ7Iv0tUQ/2hd5Q8Xmiv7qCCBuhOGnAokUwkRnZu124PEhPwDa/PSA6bB/5dCwj8rzZOyEXJsz12cRtSPK8Kqff+bp2MSFEA8iETm40k/BxybyC2odWEhkPDlRl+YDe8rJxkGGLwP5PEgiQp5RK4ZftQ6Cgc5loUHDAar10tMsqg++iQeyeb/o=,iv:PSo85CoDdWajU3j4vHsaNCHI6UbMbII01nskXNyotVU=,tag:OBVkKsBnCv9bloORukDgcQ==,type:str]
+sops:
+    age:
+        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWOVd0enFxNE85WnN1eTRD
+            MjdVSE90NUd6MWFBbCtzZFRTK0NQYllUTGdVCk9aWGNGLzNvLzU3S09la2RiY1hv
+            bXdNZjFxaVM5aUF3MTA1bWx4WU1TR0EKLS0tIFp6RmdCVlE5Zk53RjF3MnZveHo4
+            eUpzQTBCRjM0a2FmZzNkdmFKWUVPODQKqpA3drI6JV67Y3P/l8Ql5xwtohVi9D3P
+            6iAcFoqrVZMSKkkiHDvAcdUexIO/BKddjC5N608MLUz7tcxyWfMqeg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-23T13:17:31Z"
+    mac: ENC[AES256_GCM,data:V4l8oScpWwC95gg9UQpaV0oKn292Y6WoRZdWlqF3I8BWCGV4LVvLE7KxC9lqHdt/Mcgb6yuaDSv3ZMERl81QOMSMcPVfk/F0LoabP/dFiz1ogxOezHOfJJ2mTu+4yAOkK73RQY68ui5UGAV5FFu3tecE0AAouSt0YrOTBALtLpY=,iv:WBFy/v6gRBil30Oqdew3JW5XVz5wmaO0Uj7J+MfSrss=,tag:CvTEdnbs4dJ0qlnefvXIag==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.12.2

apps/production/custom-configs/mas-secrets.sops.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ess-mas-custom-secrets
-    namespace: matrix
-stringData:
-    values.yaml: ENC[AES256_GCM,data:K+L4N3tdwZn6u2InPkOgk+hKIp8vp+cy8rE3mbBCXCXpsluxZPDJhhyZ+iNu3enhQBe4CfY+7bND6iGJnmWlkh8hwclLpT1MsG/nIOVwNiV6xaNAwBcdqMe6WMbucvlhQ/fT3JSKt9Eds/Q/O0UyhJE0RGGCVW5jc6ahnud9TqvMY/wqwgtBLbF7mKy9VTwUJIIFVtpC3NKJiwAVEkNJ8p1oDfTzo4MuXURyLdoQH+MClMAs/BCEwrszQv38YS/6kbki7OUurv26caK+PrTsrA2eBZIunMuXPTlUzrb+nI9XgBaj/Ccq4YkTHE9zUXD/fFnOYKy6EwrsBkF0vYmZtMwyRUeNE9V10xL68d1vG8K9,iv:/6eaFfPvFt1RrhBwuiDsudzn+fbAQW5wcxbRjKWH9Og=,tag:ADRRhusFIuJ2Z78wDmxMQw==,type:str]
-sops:
-    age:
-        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUeENKREZQU0k5aTk0RTY1
-            REl2S3VCNEFPSjMwcURIeVNQUHgwaEs4VzBZCjZQeWFKWStUUDlhZElBV2JGb21h
-            Sk9tUHYyT0VIZFZjdm0xRGtXU0NORGMKLS0tIHAzbDNTNThxbCt1a0k0S0gzWTd2
-            bjlBU0ZkU2EreXROeSttSVVUeVpmaTQKhzIFvPZSCaX2ocBOCQQ47Xax96XYb/8B
-            PVNP8QAkQabMXsPPyaTbccTHe6GBu4fQ1Kw8f7JVkL0Ml+Ss6uSyaA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-21T21:31:26Z"
-    mac: ENC[AES256_GCM,data:2GHrA5POscfBk/uBQjP+9vxcrR6WpaGDO8dRU/y/3hBlVRJuqGKmblLLEdFglsTFa7OvNKIfsMDJmgHkki3iCwwOf6ItxqOUmcN/HjDzHH2JuuQE/w0kx0WAOYqTmBAj2nP8pskbCeca/irZvENtBXrqEp4cMZDa0nqkD2AGHlc=,iv:oOF+7MwY2lv8NKYr+OsXzr6Q1W8edIG0s2MQck24Lyk=,tag:3k4pMloKtm6UxVi8IYMHjw==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.12.2

apps/production/custom-configs/synapse-values.yaml

@@ -14,5 +14,56 @@ data:
         url-previews:
           config: |
             url_preview_enabled: true
+            url_preview_ip_range_blacklist:
+            - '127.0.0.0/8'
+            - '10.0.0.0/8'
+            - '172.16.0.0/12'
+            - '192.168.0.0/16'
+            - '::1/128'
+            - 'fe80::/10'
+            - 'fc00::/7'
             max_spider_size: 10M
-            # Deine restlichen URL-Preview und Retention Settings hier...
+        retention:
+          config: |
+            retention:
+              enabled: true
+              default_policy:
+                min_lifetime: 1d
+                max_lifetime: 1y
+              allowed_lifetime_min: 1d
+              allowed_lifetime_max: 2y
+              purge_jobs:
+                - longest_max_lifetime: 3d
+                  interval: 12h
+                - shortest_max_lifetime: 3d
+                  longest_max_lifetime: 1w
+                  interval: 1d
+                - shortest_max_lifetime: 1w
+                  interval: 2d
+
+            media_retention:
+              local_media_lifetime: 365d
+              remote_media_lifetime: 90d
+
+            redaction_retention_period: 7d
+            forgotten_room_retention_period: 28d
+            user_ips_max_age: 90d
+        auto_join:
+          config: |
+            auto_join_rooms:
+              - "#onboarding:axion1337.chat"
+            auto_join_rooms_for_guests: false
+        room_publish:
+          config: |
+            room_list_publication_rules:
+              - user_id: "*"
+                action: allow
+        turn:
+          config: |
+            turn_uris:
+              - "turn:turn.axion1337.chat?transport=udp"
+              - "turn:turn.axion1337.chat?transport=tcp"
+              - "turns:turn.axion1337.chat?transport=tcp"
+            turn_shared_secret: "cab3c8408363515d9b4cdc3384a1f76ca17a973242fdfdc72b67ac4d86158527"
+            turn_user_lifetime: 86400000
+            turn_allow_guests: false

apps/production/element-server-suite.yaml

@@ -23,7 +23,7 @@ spec:
       name: ess-element-custom
       valuesKey: values.yaml
     - kind: Secret
-      name: ess-mas-custom-secrets
+      name: ess-mas-values-secret
       valuesKey: values.yaml
       
   values:
@@ -69,6 +69,8 @@ spec:
         host: admin.axion1337.chat
 
     # Well-Known auf der Apex-Domain (axion1337.chat/.well-known/matrix/*)
-    # Deaktiviert — verursacht ACME-Konflikt mit elementWeb auf gleicher Domain
+    # Aktiviert – notwendig für MatrixRTC-Discovery
     wellKnownDelegation:
-      enabled: false
+      enabled: true
+      ingress:
+        className: "none"  # Deaktiviert den Chart-Ingress, wir erstellen einen eigenen

apps/production/element-web-docs-configmap.yaml

@@ -0,0 +1,402 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ess-element-web-docs
+  namespace: matrix
+data:
+  # HTML Index Page
+  "index.html": |
+    <!DOCTYPE html>
+    <html lang="de">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>Element Desktop Setup - aXion1337.Chat</title>
+      <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body {
+          font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif;
+          background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+          min-height: 100vh;
+          padding: 40px 20px;
+        }
+        .container {
+          max-width: 800px;
+          margin: 0 auto;
+          background: white;
+          border-radius: 12px;
+          box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+          padding: 40px;
+        }
+        h1 {
+          color: #333;
+          margin-bottom: 10px;
+          font-size: 2.5em;
+        }
+        .subtitle {
+          color: #666;
+          margin-bottom: 40px;
+          font-size: 1.1em;
+        }
+        .section {
+          margin-bottom: 40px;
+        }
+        .section h2 {
+          color: #667eea;
+          font-size: 1.5em;
+          margin-bottom: 20px;
+          border-bottom: 3px solid #667eea;
+          padding-bottom: 10px;
+        }
+        .download-grid {
+          display: grid;
+          grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+          gap: 20px;
+          margin-bottom: 30px;
+        }
+        .download-card {
+          background: #f8f9fa;
+          border: 2px solid #e9ecef;
+          border-radius: 8px;
+          padding: 20px;
+          text-align: center;
+          transition: all 0.3s ease;
+          text-decoration: none;
+          color: #333;
+        }
+        .download-card:hover {
+          border-color: #667eea;
+          background: #f0f3ff;
+          transform: translateY(-5px);
+          box-shadow: 0 10px 30px rgba(102, 126, 234, 0.2);
+        }
+        .download-card .icon {
+          font-size: 2.5em;
+          margin-bottom: 10px;
+        }
+        .download-card .name {
+          font-weight: 600;
+          font-size: 1.1em;
+          margin-bottom: 5px;
+        }
+        .download-card .desc {
+          font-size: 0.9em;
+          color: #666;
+        }
+        .themes {
+          background: #f8f9fa;
+          border-left: 4px solid #667eea;
+          padding: 20px;
+          border-radius: 4px;
+          margin-bottom: 20px;
+        }
+        .themes h3 {
+          color: #333;
+          margin-bottom: 15px;
+        }
+        .theme-list {
+          display: grid;
+          grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+          gap: 10px;
+        }
+        .theme-item {
+          background: white;
+          padding: 10px;
+          border-radius: 4px;
+          text-align: center;
+          color: #667eea;
+          font-weight: 500;
+          border: 1px solid #667eea;
+        }
+        .instructions {
+          background: #e7f3ff;
+          border-left: 4px solid #0066cc;
+          padding: 15px;
+          border-radius: 4px;
+          margin: 15px 0;
+          line-height: 1.6;
+        }
+        .instructions code {
+          background: #f0f0f0;
+          padding: 2px 6px;
+          border-radius: 3px;
+          font-family: monospace;
+        }
+        .support {
+          text-align: center;
+          color: #666;
+          margin-top: 40px;
+          padding-top: 20px;
+          border-top: 1px solid #e9ecef;
+        }
+        .support a {
+          color: #667eea;
+          text-decoration: none;
+          font-weight: 500;
+        }
+        .support a:hover {
+          text-decoration: underline;
+        }
+      </style>
+    </head>
+    <body>
+      <div class="container">
+        <h1>🎨 Element Desktop Setup</h1>
+        <p class="subtitle">Automatische Konfiguration mit Custom Themes für aXion1337.Chat</p>
+
+        <div class="section">
+          <h2>📥 Download Setup-Script</h2>
+          <div class="download-grid">
+            <a href="element-setup-windows.cmd" class="download-card" download>
+              <div class="icon">🪟</div>
+              <div class="name">Windows</div>
+              <div class="desc">.cmd Datei</div>
+            </a>
+            <a href="element-setup-macos.command" class="download-card" download>
+              <div class="icon">🍎</div>
+              <div class="name">macOS</div>
+              <div class="desc">.command Datei</div>
+            </a>
+            <a href="element-setup-linux.sh" class="download-card" download>
+              <div class="icon">🐧</div>
+              <div class="name">Linux</div>
+              <div class="desc">.sh Datei</div>
+            </a>
+          </div>
+
+          <div class="instructions">
+            <strong>Anleitung:</strong><br><br>
+            <strong>🪟 Windows:</strong> Datei herunterladen → Doppelklick → Script läuft automatisch<br><br>
+            <strong>🍎 macOS:</strong> Datei herunterladen → Doppelklick im Finder → Script läuft automatisch<br><br>
+            <strong>🐧 Linux:</strong><br>
+            <code>chmod +x element-setup-linux.sh</code><br>
+            <code>./element-setup-linux.sh</code>
+          </div>
+        </div>
+
+        <div class="section">
+          <h2>🎨 Verfügbare Themes</h2>
+          <div class="themes">
+            <h3>Automatisch geladen in Element:</h3>
+            <div class="theme-list">
+              <div class="theme-item">aXion1337 Dark</div>
+              <div class="theme-item">Deep Purple</div>
+              <div class="theme-item">Discord Dark</div>
+              <div class="theme-item">Electric Blue</div>
+              <div class="theme-item">Everforest dark hard</div>
+              <div class="theme-item">Gruvbox Dark</div>
+              <div class="theme-item">Wal</div>
+            </div>
+          </div>
+        </div>
+
+        <div class="section">
+          <h2>❓ Support</h2>
+          <p>Für weitere Hilfe besuche: <a href="https://element.io/help" target="_blank">element.io/help</a></p>
+        </div>
+
+        <div class="support">
+          <p>Element wird automatisch installiert und konfiguriert.<br>
+          <small>Bei Fragen oder Problemen: <a href="https://element.io/help">Element Support</a></small></p>
+        </div>
+      </div>
+    </body>
+    </html>
+
+  # README
+  "README-Element-Setup.md": |
+    # Element Desktop Setup Scripts
+
+    Automatische Konfiguration und Installation von Element Desktop mit Custom Themes für aXion1337.Chat
+
+    ## 🎨 Verfügbare Themes
+    - aXion1337 Dark
+    - Deep Purple
+    - Discord Dark
+    - Electric Blue
+    - Everforest dark hard
+    - Gruvbox Dark
+    - Wal
+
+    ## 🪟 Windows
+    Herunterladen: `element-setup-windows.cmd` → Doppelklick
+
+    ## 🍎 macOS
+    Herunterladen: `element-setup-macos.command` → Doppelklick im Finder
+
+    ## 🐧 Linux
+    ```bash
+    chmod +x element-setup-linux.sh
+    ./element-setup-linux.sh
+    ```
+
+    Support: https://element.io/help
+
+  # Windows Script
+  "element-setup-windows.cmd": |
+    @echo off
+    REM Element Desktop Setup Script for Windows
+    setlocal enabledelayedexpansion
+    echo ========================================
+    echo Element Desktop Konfiguration Setup
+    echo ========================================
+    echo.
+    set APPDATA_PATH=%APPDATA%\Element
+    set CONFIG_FILE=%APPDATA_PATH%\config.json
+    if not exist "%APPDATA_PATH%" (
+        echo Erstelle Element Verzeichnis...
+        mkdir "%APPDATA_PATH%"
+    )
+    echo Erstelle config.json...
+    (
+        echo {
+        echo   "configUrl": "https://axion1337.chat/config.json",
+        echo   "brand": "aXion1337.Chat",
+        echo   "default_theme": "aXion1337 Dark",
+        echo   "show_labs_settings": true,
+        echo   "features": {
+        echo     "feature_qr_code_login": true
+        echo   },
+        echo   "setting_defaults": {
+        echo     "custom_themes": []
+        echo   }
+        echo }
+    ) > "%CONFIG_FILE%"
+    echo Config erstellt: %CONFIG_FILE%
+    echo.
+    echo Ueberpruefen Sie ob Element Desktop installiert ist...
+    where element >nul 2>nul
+    if %ERRORLEVEL% == 0 (
+        echo Starte Element Desktop...
+        start element
+        timeout /t 2 >nul
+        echo Done!
+        pause
+        exit /b 0
+    )
+    winget list --name "Element" >nul 2>nul
+    if %ERRORLEVEL% == 0 (
+        echo WinGet gefunden. Installiere Element...
+        winget install Element.Element --silent
+        timeout /t 3 >nul
+        start element
+        pause
+        exit /b 0
+    )
+    echo.
+    echo Element Desktop konnte nicht automatisch installiert werden.
+    echo Bitte installiere Element Desktop manuell:
+    echo https://element.io/download
+    echo.
+    pause
+
+  # macOS Script
+  "element-setup-macos.command": |
+    #!/bin/bash
+    echo "========================================"
+    echo "Element Desktop Konfiguration Setup"
+    echo "========================================"
+    echo ""
+    CONFIG_DIR="$HOME/Library/Application Support/Element"
+    CONFIG_FILE="$CONFIG_DIR/config.json"
+    if [ ! -d "$CONFIG_DIR" ]; then
+        echo "Erstelle Element Verzeichnis..."
+        mkdir -p "$CONFIG_DIR"
+    fi
+    echo "Erstelle config.json..."
+    cat > "$CONFIG_FILE" << 'EOF'
+    {
+      "configUrl": "https://axion1337.chat/config.json",
+      "brand": "aXion1337.Chat",
+      "default_theme": "aXion1337 Dark",
+      "show_labs_settings": true,
+      "features": {
+        "feature_qr_code_login": true
+      },
+      "setting_defaults": {
+        "custom_themes": []
+      }
+    }
+    EOF
+    echo "Config erstellt: $CONFIG_FILE"
+    echo ""
+    echo "Ueberpruefen Sie ob Element Desktop installiert ist..."
+    if [ -d "/Applications/Element.app" ]; then
+        echo "Element im Applications Folder gefunden. Starte Element..."
+        open -a Element
+        sleep 2
+        exit 0
+    fi
+    if command -v brew &> /dev/null; then
+        echo "Installiere Element uber Homebrew..."
+        brew install element --cask
+        sleep 2
+        open -a Element
+        exit 0
+    else
+        echo ""
+        echo "Homebrew nicht gefunden. Bitte installiere zuerst:"
+        echo "https://brew.sh"
+        echo ""
+        echo "Deine config.json wurde erstellt unter:"
+        echo "$CONFIG_FILE"
+        echo ""
+    fi
+    read -p "Druecke Enter zum Beenden..."
+
+  # Linux Script
+  "element-setup-linux.sh": |
+    #!/bin/bash
+    echo "========================================"
+    echo "Element Desktop Konfiguration Setup"
+    echo "========================================"
+    echo ""
+    CONFIG_DIR="$HOME/.config/Element"
+    CONFIG_FILE="$CONFIG_DIR/config.json"
+    if [ ! -d "$CONFIG_DIR" ]; then
+        echo "Erstelle Element Verzeichnis..."
+        mkdir -p "$CONFIG_DIR"
+    fi
+    echo "Erstelle config.json..."
+    cat > "$CONFIG_FILE" << 'EOF'
+    {
+      "configUrl": "https://axion1337.chat/config.json",
+      "brand": "aXion1337.Chat",
+      "default_theme": "aXion1337 Dark",
+      "show_labs_settings": true,
+      "features": {
+        "feature_qr_code_login": true
+      },
+      "setting_defaults": {
+        "custom_themes": []
+      }
+    }
+    EOF
+    echo "Config erstellt: $CONFIG_FILE"
+    echo ""
+    if command -v apt &> /dev/null; then
+        echo "Installiere Element uber apt..."
+        sudo apt update && sudo apt install -y element-desktop
+        element &
+        exit 0
+    fi
+    if command -v dnf &> /dev/null; then
+        echo "Installiere Element uber dnf..."
+        sudo dnf install -y element-desktop
+        element &
+        exit 0
+    fi
+    if command -v pacman &> /dev/null; then
+        echo "Installiere Element uber pacman..."
+        sudo pacman -S --noconfirm element-web
+        element &
+        exit 0
+    fi
+    echo "Element Desktop konnte nicht automatisch installiert werden."
+    echo "Bitte installiere Element Desktop manuell:"
+    echo "Ubuntu/Debian: sudo apt install element-desktop"
+    echo "Fedora/RHEL: sudo dnf install element-desktop"
+    echo "Arch: sudo pacman -S element-web"
+    echo ""
+    echo "Deine config.json wurde erstellt unter:"
+    echo "$CONFIG_FILE"

apps/production/element-web-docs-server.yaml

@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: element-web-docs
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: element-web-docs
+  template:
+    metadata:
+      labels:
+        app: element-web-docs
+    spec:
+      initContainers:
+      - name: copy-files
+        image: busybox:1.36
+        command: ["/bin/sh", "-c"]
+        args:
+        - |
+          mkdir -p /html/docs/setup
+          cp /config/index.html /html/docs/setup/
+          cp /config/README-Element-Setup.md /html/docs/setup/
+          cp /config/element-setup-windows.cmd /html/docs/setup/
+          cp /config/element-setup-macos.command /html/docs/setup/
+          cp /config/element-setup-linux.sh /html/docs/setup/
+          chmod 644 /html/docs/setup/*
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: html
+          mountPath: /html
+      containers:
+      - name: nginx
+        image: nginx:1.26-alpine
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+        - name: nginx-conf
+          mountPath: /etc/nginx/conf.d/default.conf
+          subPath: nginx.conf
+        - name: html
+          mountPath: /usr/share/nginx/html
+      volumes:
+      - name: config
+        configMap:
+          name: ess-element-web-docs
+      - name: nginx-conf
+        configMap:
+          name: element-web-docs-nginx
+      - name: html
+        emptyDir: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: element-web-docs
+  namespace: matrix
+spec:
+  selector:
+    app: element-web-docs
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 8080
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: element-web-docs-nginx
+  namespace: matrix
+data:
+  nginx.conf: |
+    server {
+        listen 8080;
+        server_name _;
+
+        root /usr/share/nginx/html;
+
+        location /docs/setup/ {
+            index index.html;
+            try_files $uri $uri/ =404;
+        }
+
+        location / {
+            return 404;
+        }
+    }

apps/production/kustomization.yaml

@@ -3,9 +3,17 @@ kind: Kustomization
 resources:
   - matrix-postgres-auth.yaml
   - cert-issuer.yaml
+  - matrix-certificates.yaml
   # Neue Dateien:
   - custom-configs/synapse-values.yaml
   - custom-configs/element-values.yaml
-  - custom-configs/mas-secrets.yaml # (oder .sops.yaml, je nach deiner SOPS-Einrichtung)
+  - custom-configs/mas-secret.yaml
+  - element-web-docs-configmap.yaml
+  - element-web-docs-server.yaml
+  # TURN Server für WebRTC
+  - coturn-secret.yaml
+  - coturn.yaml
   # HelmRelease (muss ganz unten stehen, damit die ConfigMaps vorher da sind!)
-  - element-server-suite.yaml
+  - element-server-suite.yaml
+  # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
+  - apex-ingress.yaml  # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat

apps/production/matrix-certificates.yaml

@@ -62,3 +62,16 @@ spec:
     kind: ClusterIssuer
   dnsNames:
     - admin.axion1337.chat
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: turn-axion1337-chat-cert
+  namespace: matrix
+spec:
+  secretName: turn-axion1337-chat-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - turn.axion1337.chat

clusters/matrix/flux-system/authentik-sync.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: authentik-apps
+  namespace: flux-system
+spec:
+  interval: 1m
+  path: ./apps/authentik
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+    - name: infra-apps

clusters/matrix/flux-system/kustomization.yaml

@@ -4,4 +4,6 @@ resources:
   - gotk-components.yaml
   - gotk-sync.yaml
   - infra-sync.yaml
+  - monitoring-sync.yaml
   - production-sync.yaml
+  - authentik-sync.yaml

clusters/matrix/flux-system/monitoring-sync.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: monitoring-apps
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./apps/monitoring
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  dependsOn:
+    - name: infra-apps

docs/install.md

@@ -0,0 +1,78 @@
+## 🚀 Step-by-Step Installationsanleitung (From Scratch)
+
+Diese Anleitung geht davon aus, dass du einen frischen Server (Ubuntu/Debian) mit öffentlicher IP hast und deine lokalen Tools (Flux CLI, kubectl, sops, age) installiert sind.
+
+### Schritt 1: Kubernetes (K3s) auf dem Server installieren
+Logge dich per SSH auf deinem Server ein und installiere ein frisches K3s. Wir nutzen K3s mit dem Standard-Traefik-Ingress.
+
+```bash
+# Auf dem Server ausführen:
+curl -sfL https://get.k3s.io | sh -
+
+# Kubeconfig kopieren und Berechtigungen setzen (für den lokalen Zugriff)
+sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
+sudo chown $USER ~/.kube/config
+```
+*Kopiere dir den Inhalt der `~/.kube/config` auf deinen lokalen Rechner, damit dein lokales `kubectl` den Server steuern kann. Vergiss nicht, die IP `127.0.0.1` in der Datei durch die öffentliche IP deines Servers zu ersetzen.*
+
+### Schritt 2: Den SOPS-Verschlüsselungs-Key generieren
+Damit Flux deine verschlüsselten Passwörter (SMTP, Datenbank) im Cluster lesen kann, braucht es einen privaten Schlüssel. Wir nutzen `age`.
+
+```bash
+# Auf deinem lokalen Rechner ausführen:
+# 1. Key generieren
+age-keygen -o age.agekey
+
+# 2. Den Public Key (steht in der Datei) in die .sops.yaml des Repos eintragen!
+
+# 3. Den Private Key als Secret in den Cluster laden (in den flux-system Namespace)
+cat age.agekey | kubectl create secret generic sops-age \
+--namespace=flux-system \
+--from-file=age.agekey=/dev/stdin
+```
+
+### Schritt 3: Das Git-Repository vorbereiten
+Stelle sicher, dass deine GitOps-Struktur gepusht ist und du ein Personal Access Token (PAT) für dein Git-Repository hast (bei GitHub/GitLab). 
+* Das Token benötigt Lese- und Schreibrechte auf das Repository.
+
+### Schritt 4: Flux Bootstrap (Der Startschuss)
+Das ist der magische Befehl. Er installiert den Flux-Controller in deinem Cluster und verbindet ihn mit deinem Repository. Ab diesem Moment übernimmt Flux das Steuer.
+
+**Für GitHub:**
+```bash
+export GITHUB_TOKEN="dein-personal-access-token"
+export GITHUB_USER="dein-github-username"
+
+flux bootstrap github \
+  --owner=$GITHUB_USER \
+  --repository=dein-repo-name \
+  --branch=main \
+  --path=prod/gitops/clusters/matrix \
+  --personal
+```
+
+**Für Gitea/GitLab/Generisches Git (wie in deinem Setup scheinbar genutzt):**
+```bash
+flux bootstrap git \
+  --url=https://rohana.axion1337.de/sorb/axion1337.chat-gitops.git \
+  --branch=main \
+  --path=prod/gitops/clusters/matrix \
+  --username=dein-git-user \
+  --password=dein-git-token
+```
+
+### Schritt 5: Zurücklehnen und beobachten
+Flux klont jetzt dein Repo, liest die Kustomizations und wendet sie in der richtigen Reihenfolge an (`infra-apps` -> `production-apps`).
+
+Du kannst den Fortschritt live verfolgen:
+```bash
+# Zeigt den GitOps-Sync-Status:
+flux get kustomizations --watch
+
+# Zeigt das Helm-Deployment der Element Server Suite:
+flux get helmreleases -n matrix --watch
+
+# Zeigt, wie die Pods hochfahren:
+kubectl get pods -n matrix -w
+```
+Sobald alle Pods auf `Running` stehen und die Zertifikate über Let's Encrypt validiert wurden (`kubectl get certificate -n matrix`), ist dein Matrix-Stack unter `https://axion1337.chat` erreichbar.

docs/setup/README-Element-Setup.md

@@ -0,0 +1,206 @@
+# Element Desktop Setup Scripts
+
+Automatische Konfiguration und Installation von Element Desktop mit Custom Themes für aXion1337.Chat
+
+## 📋 Systemanforderungen
+
+- **Windows 10/11**
+- **macOS 10.13+**
+- **Linux** (Ubuntu, Debian, Fedora, Arch, openSUSE, etc.)
+
+---
+
+## 🪟 Windows
+
+### Installation
+
+1. **Lade die Datei herunter**: `element-setup-windows.cmd`
+2. **Doppelklick** auf die Datei
+3. Das Skript wird automatisch:
+   - ✅ Die config.json erstellen
+   - ✅ Element Desktop installieren (falls nötig)
+   - ✅ Element starten
+
+**Oder manuell:**
+```cmd
+element-setup-windows.cmd
+```
+
+### Voraussetzungen
+
+Das Skript versucht automatisch, Element zu installieren über:
+- Windows Store (Microsoft Store)
+- WinGet (Windows Package Manager)
+- Chocolatey
+
+Falls nichts davon vorhanden ist, installiere Element manuell:
+https://element.io/download
+
+---
+
+## 🍎 macOS
+
+### Installation
+
+1. **Lade die Datei herunter**: `element-setup-macos.command`
+2. **Doppelklick** im Finder
+3. Das Skript wird automatisch:
+   - ✅ Die config.json erstellen
+   - ✅ Element Desktop installieren (über Homebrew falls nötig)
+   - ✅ Element starten
+
+**Oder im Terminal:**
+```bash
+chmod +x element-setup-macos.command
+./element-setup-macos.command
+```
+
+### Voraussetzungen
+
+Das Skript nutzt **Homebrew** (falls vorhanden):
+```bash
+/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+```
+
+Oder installiere Element manuell:
+https://element.io/download
+
+---
+
+## 🐧 Linux
+
+### Installation
+
+1. **Lade die Datei herunter**: `element-setup-linux.sh`
+2. **Im Terminal:**
+   ```bash
+   chmod +x element-setup-linux.sh
+   ./element-setup-linux.sh
+   ```
+
+3. Das Skript wird automatisch:
+   - ✅ Die config.json erstellen
+   - ✅ Element Desktop installieren (über apt/dnf/pacman/zypper)
+   - ✅ Element starten
+
+### Unterstützte Distributionen
+
+- **Ubuntu/Debian**: `apt`
+- **Fedora/RHEL**: `dnf`
+- **Arch Linux**: `pacman`
+- **openSUSE**: `zypper`
+
+---
+
+## ✅ Was die Skripte machen
+
+Alle Skripte führen diese Schritte aus:
+
+1. **config.json erstellen** im richtigen Verzeichnis:
+   - **Windows**: `%APPDATA%\Element\config.json`
+   - **macOS**: `~/Library/Application Support/Element/config.json`
+   - **Linux**: `~/.config/Element/config.json`
+
+2. **Automatische Konfiguration**:
+   ```json
+   {
+     "configUrl": "https://axion1337.chat/config.json",
+     "brand": "aXion1337.Chat",
+     "default_theme": "aXion1337 Dark",
+     "show_labs_settings": true,
+     "features": {
+       "feature_qr_code_login": true
+     }
+   }
+   ```
+
+3. **Element Desktop installieren** (falls nicht vorhanden)
+
+4. **Element starten** und deine Custom Themes laden
+
+---
+
+## 🎨 Themes nach Setup
+
+Nach dem Setup hat dein Element Desktop:
+
+1. **Automatisch geladene Themes** von: `https://axion1337.chat/config.json`
+2. **Standard Theme**: aXion1337 Dark
+3. **Verfügbare Themes**:
+   - aXion1337 Dark
+   - Deep Purple
+   - Discord Dark
+   - Electric Blue
+   - Everforest dark hard
+   - Gruvbox Dark
+   - Wal
+
+---
+
+## ⚙️ Manuelle Konfiguration (falls Skript nicht funktioniert)
+
+Falls die Skripte nicht funktionieren, erstelle manuell die config.json:
+
+### Windows
+```
+%APPDATA%\Element\config.json
+```
+
+### macOS
+```
+~/Library/Application Support/Element/config.json
+```
+
+### Linux
+```
+~/.config/Element/config.json
+```
+
+**Inhalt** (copy-paste):
+```json
+{
+  "configUrl": "https://axion1337.chat/config.json",
+  "brand": "aXion1337.Chat",
+  "default_theme": "aXion1337 Dark",
+  "show_labs_settings": true,
+  "features": {
+    "feature_qr_code_login": true
+  },
+  "setting_defaults": {
+    "custom_themes": []
+  }
+}
+```
+
+---
+
+## 🆘 Troubleshooting
+
+### Element startet nicht
+- Stelle sicher, dass Element Desktop installiert ist
+- Überprüfe den Installationspfad
+- Starten manuell: `element` (Terminal/CMD)
+
+### config.json wird nicht geladen
+- Überprüfe, dass die Datei im richtigen Verzeichnis ist
+- Beende Element vollständig (auch in der Taskbar)
+- Starte Element neu
+
+### Themes nicht sichtbar
+- Überprüfe Internetverbindung
+- `https://axion1337.chat/config.json` sollte erreichbar sein
+- Öffne Settings > Appearance > Theme und wähle manuell
+
+---
+
+## 📞 Support
+
+Bei Fragen oder Problemen:
+- https://element.io/help
+- https://axion1337.chat
+
+---
+
+**Version**: 1.0  
+**Letztes Update**: 2026-04-23  
+**Kompatibilität**: Element Desktop 1.11+

docs/setup/element-setup-linux.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# Element Desktop Setup Script for Linux
+# Ausführung: chmod +x element-setup-linux.sh && ./element-setup-linux.sh
+
+echo "========================================"
+echo "Element Desktop Konfiguration Setup"
+echo "========================================"
+echo ""
+
+# Erkenne Linux Distribution
+if [ -f /etc/os-release ]; then
+    . /etc/os-release
+    OS=$ID
+else
+    OS=$(uname -s)
+fi
+
+# Config-Verzeichnis
+CONFIG_DIR="$HOME/.config/Element"
+CONFIG_FILE="$CONFIG_DIR/config.json"
+
+# Erstelle Verzeichnis falls nicht vorhanden
+if [ ! -d "$CONFIG_DIR" ]; then
+    echo "Erstelle Element Verzeichnis..."
+    mkdir -p "$CONFIG_DIR"
+fi
+
+# Erstelle config.json
+echo "Erstelle config.json..."
+cat > "$CONFIG_FILE" << 'EOF'
+{
+  "configUrl": "https://axion1337.chat/config.json",
+  "brand": "aXion1337.Chat",
+  "default_theme": "aXion1337 Dark",
+  "show_labs_settings": true,
+  "features": {
+    "feature_qr_code_login": true
+  },
+  "setting_defaults": {
+    "custom_themes": []
+  }
+}
+EOF
+
+echo "✅ Config erstellt: $CONFIG_FILE"
+echo ""
+
+# Versuche Element zu starten/installieren
+echo "Überprüfe Element Desktop Installation..."
+
+# Methode 1: Element ist bereits installiert
+if command -v element &> /dev/null; then
+    echo "Element gefunden. Starte Element..."
+    element &
+    sleep 2
+    exit 0
+fi
+
+# Methode 2: Apt (Debian/Ubuntu)
+if command -v apt &> /dev/null; then
+    echo ""
+    echo "Installiere Element über apt..."
+    sudo apt update
+    sudo apt install -y element-desktop
+    echo "Starte Element..."
+    element &
+    exit 0
+fi
+
+# Methode 3: Pacman (Arch Linux)
+if command -v pacman &> /dev/null; then
+    echo ""
+    echo "Installiere Element über pacman..."
+    sudo pacman -S --noconfirm element-web
+    echo "Starte Element..."
+    element &
+    exit 0
+fi
+
+# Methode 4: DNF (Fedora/RHEL)
+if command -v dnf &> /dev/null; then
+    echo ""
+    echo "Installiere Element über dnf..."
+    sudo dnf install -y element-desktop
+    echo "Starte Element..."
+    element &
+    exit 0
+fi
+
+# Methode 5: Zypper (openSUSE)
+if command -v zypper &> /dev/null; then
+    echo ""
+    echo "Installiere Element über zypper..."
+    sudo zypper install -y element-desktop
+    echo "Starte Element..."
+    element &
+    exit 0
+fi
+
+# Fallback
+echo ""
+echo "⚠️  Element Desktop konnte nicht automatisch installiert werden."
+echo ""
+echo "Bitte installiere Element Desktop manuell:"
+echo "  Ubuntu/Debian:  sudo apt install element-desktop"
+echo "  Fedora/RHEL:    sudo dnf install element-desktop"
+echo "  Arch:           sudo pacman -S element-web"
+echo "  openSUSE:       sudo zypper install element-desktop"
+echo ""
+echo "Oder: https://element.io/download"
+echo ""
+echo "✅ Deine config.json wurde erstellt unter:"
+echo "$CONFIG_FILE"
+echo ""

docs/setup/element-setup-macos.command

@@ -0,0 +1,84 @@
+#!/bin/bash
+# Element Desktop Setup Script for macOS
+# Doppelklick im Finder zum Ausführen
+
+echo "========================================"
+echo "Element Desktop Konfiguration Setup"
+echo "========================================"
+echo ""
+
+# Config-Verzeichnis
+CONFIG_DIR="$HOME/Library/Application Support/Element"
+CONFIG_FILE="$CONFIG_DIR/config.json"
+
+# Erstelle Verzeichnis falls nicht vorhanden
+if [ ! -d "$CONFIG_DIR" ]; then
+    echo "Erstelle Element Verzeichnis..."
+    mkdir -p "$CONFIG_DIR"
+fi
+
+# Erstelle config.json
+echo "Erstelle config.json..."
+cat > "$CONFIG_FILE" << 'EOF'
+{
+  "configUrl": "https://axion1337.chat/config.json",
+  "brand": "aXion1337.Chat",
+  "default_theme": "aXion1337 Dark",
+  "show_labs_settings": true,
+  "features": {
+    "feature_qr_code_login": true
+  },
+  "setting_defaults": {
+    "custom_themes": []
+  }
+}
+EOF
+
+echo "Config erstellt: $CONFIG_FILE"
+echo ""
+
+# Versuche Element zu installieren/starten
+echo "Überprüfe Element Desktop Installation..."
+
+# Methode 1: Über Homebrew (falls installiert)
+if command -v brew &> /dev/null; then
+    if brew list element &> /dev/null; then
+        echo "Element über Homebrew gefunden. Starte Element..."
+        open -a Element
+        sleep 2
+        exit 0
+    fi
+fi
+
+# Methode 2: Direkte App im Applications Folder
+if [ -d "/Applications/Element.app" ]; then
+    echo "Element im Applications Folder gefunden. Starte Element..."
+    open -a Element
+    sleep 2
+    exit 0
+fi
+
+# Methode 3: Homebrew Installation
+if command -v brew &> /dev/null; then
+    echo ""
+    echo "Installiere Element über Homebrew..."
+    brew install element --cask
+    echo "Starte Element..."
+    sleep 2
+    open -a Element
+    exit 0
+else
+    echo ""
+    echo "⚠️  Homebrew nicht gefunden. Bitte installiere zuerst:"
+    echo "https://brew.sh"
+    echo ""
+    echo "Oder installiere Element manuell:"
+    echo "https://element.io/download"
+    echo ""
+    echo "✅ Deine config.json wurde erstellt unter:"
+    echo "$CONFIG_FILE"
+    echo ""
+fi
+
+# Warte auf Benutzer-Input vor dem Schließen
+read -p "Drücke Enter zum Beenden..."

docs/setup/element-setup-windows.cmd

@@ -0,0 +1,89 @@
+@echo off
+REM Element Desktop Setup Script for Windows
+REM Doppelklick zum Ausführen
+
+setlocal enabledelayedexpansion
+
+echo ========================================
+echo Element Desktop Konfiguration Setup
+echo ========================================
+echo.
+
+REM Config-Verzeichnis
+set APPDATA_PATH=%APPDATA%\Element
+set CONFIG_FILE=%APPDATA_PATH%\config.json
+
+REM Erstelle Verzeichnis falls nicht vorhanden
+if not exist "%APPDATA_PATH%" (
+    echo Erstelle Element Verzeichnis...
+    mkdir "%APPDATA_PATH%"
+)
+
+REM Erstelle config.json
+echo Erstelle config.json...
+(
+    echo {
+    echo   "configUrl": "https://axion1337.chat/config.json",
+    echo   "brand": "aXion1337.Chat",
+    echo   "default_theme": "aXion1337 Dark",
+    echo   "show_labs_settings": true,
+    echo   "features": {
+    echo     "feature_qr_code_login": true
+    echo   },
+    echo   "setting_defaults": {
+    echo     "custom_themes": []
+    echo   }
+    echo }
+) > "%CONFIG_FILE%"
+
+echo Config erstellt: %CONFIG_FILE%
+echo.
+
+REM Versuche Element zu installieren/starten
+echo Überprüfe Element Desktop Installation...
+
+REM Methode 1: Über Microsoft Store (wenn verfügbar)
+where element >nul 2>nul
+if %ERRORLEVEL% == 0 (
+    echo Starte Element Desktop...
+    start element
+    timeout /t 2 >nul
+    echo Done!
+    pause
+    exit /b 0
+)
+
+REM Methode 2: WinGet (Falls installiert)
+winget list --name "Element" >nul 2>nul
+if %ERRORLEVEL% == 0 (
+    echo WinGet gefunden. Installiere Element...
+    winget install Element.Element --silent
+    echo Starte Element...
+    timeout /t 3 >nul
+    start element
+    pause
+    exit /b 0
+)
+
+REM Methode 3: Chocolatey (Falls installiert)
+choco list element >nul 2>nul
+if %ERRORLEVEL% == 0 (
+    echo Chocolatey gefunden. Installiere Element...
+    choco install element -y
+    echo Starte Element...
+    timeout /t 3 >nul
+    start element
+    pause
+    exit /b 0
+)
+
+REM Fallback: Manueller Download
+echo.
+echo Element Desktop konnte nicht automatisch installiert werden.
+echo Bitte installiere Element Desktop manuell:
+echo https://element.io/download
+echo.
+echo Deine config.json wurde erstellt unter:
+echo %CONFIG_FILE%
+echo.
+pause