Add Gitea Actions workflows for CI/CD automation

- deploy-on-push.yml: Verify YAML, check SOPS encryption, notify on deployments - milestone-release.yml: Auto-create releases on milestone tags Triggers: - deploy-on-push: On any push to main (apps/clusters changes) - milestone-release: On git tag m*-*-complete Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Add status summary and prioritized next steps to TASKS.md
2026-05-14 23:29:50 +02:00 · 2026-05-14 23:08:00 +02:00 · 2026-05-14 23:05:33 +02:00 · 2026-05-14 22:47:38 +02:00 · 2026-05-14 22:46:00 +02:00 · 2026-05-14 22:27:52 +02:00
52 changed files with 3765 additions and 35 deletions
@@ -0,0 +1,56 @@
 FROM debian:bookworm-slim
 # Install base tools
 RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    wget \
    git \
    ca-certificates \
    gnupg \
    lsb-release \
    apt-transport-https \
    vim \
    nano \
    jq \
    yq \
    zsh \
    sudo \
    openssh-client \
    && rm -rf /var/lib/apt/lists/*
 # Install kubectl
 RUN curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg && \
    echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | tee /etc/apt/sources.list.d/kubernetes.list && \
    apt-get update && apt-get install -y kubectl && \
    rm -rf /var/lib/apt/lists/*
 # Install Helm
 RUN curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 # Install Flux CLI
 RUN curl -s https://fluxcd.io/install.sh | bash
 # Install sops
 RUN SOPS_VERSION=$(curl -s https://api.github.com/repos/getsops/sops/releases/latest | grep tag_name | cut -d '"' -f 4) && \
    curl -sL -o /usr/local/bin/sops https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.amd64 && \
    chmod +x /usr/local/bin/sops
 # Install age
 RUN apt-get update && apt-get install -y age && \
    rm -rf /var/lib/apt/lists/*
 # Install Docker CLI (for interacting with Docker daemon)
 RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg && \
    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
    apt-get update && apt-get install -y docker-ce-cli && \
    rm -rf /var/lib/apt/lists/*
 # Create a non-root user 'vscode' for development
 RUN useradd -m -s /bin/bash -G docker vscode && \
    echo "vscode ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/vscode
 # Install oh-my-zsh for better shell experience
 RUN su - vscode -c "sh -c '$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)' '' --unattended"
 USER vscode
 WORKDIR /workspace
@@ -0,0 +1,203 @@
 # 🐳 DevContainer für ESS Community GitOps
 Dieses DevContainer-Setup ermöglicht dir, auf **macOS, Windows und Linux** einheitlich zu entwickeln.
 ## 🚀 Schnelstart
 ### VSCode mit Remote Containers Extension
 1. **VSCode Extension installieren:**
   - Öffne VSCode → Extensions → Suche nach `Dev Containers` (Microsoft)
   - Installiere sie
 2. **GitOps Verzeichnis öffnen:**
   ```bash
   cd "april mit Ansible/prod/gitops"
   code .
   ```
 3. **DevContainer starten:**
   - Klick auf `><` Symbol unten links in VSCode
   - Wähle `Reopen in Container`
   - Warte, bis das Image gebaut wurde (~3-5 Min beim ersten Mal)
 ### Alternative: Docker + CLI
 ```bash
 docker build -t ess-gitops .devcontainer
 docker run -it --rm \
  -v ~/.kube:/home/vscode/.kube \
  -v ~/.ssh:/home/vscode/.ssh \
  -v ~/.age:/home/vscode/.age \
  -v /var/run/docker.sock:/var/run/docker.sock \
  ess-gitops
 ```
 ## 📦 Enthaltene Tools
 - **kubectl** - Kubernetes CLI
 - **flux** - FluxCD GitOps Controller CLI
 - **helm** - Kubernetes Package Manager
 - **sops** - Secret Operations (Verschlüsselung)
 - **age** - Modern File Encryption
 - **docker** - Container CLI (über Host-Socket)
 - **git** - Versionskontrolle
 - **jq/yq** - JSON/YAML Processing
 - **zsh + oh-my-zsh** - Shell mit Plugins
 ## 🔐 Wichtige Verzeichnis-Binds
 Der Container mountet automatisch:
 | Host | Container | Zweck |
 |------|-----------|-------|
 | `~/.kube` | `/home/vscode/.kube` | Kubernetes Config |
 | `~/.ssh` | `/home/vscode/.ssh` | SSH Keys |
 | `~/.age` | `/home/vscode/.age` | Age Encryption Keys |
 | `/var/run/docker.sock` | `/var/run/docker.sock` | Docker Daemon (für `docker` Befehle) |
 ## ⚙️ Kubeconfig Einrichten
 1. **Host-Machine (z.B. macOS):**
   ```bash
   # Stelle sicher, dass ~/.kube/config existiert und den richtigen Cluster enthält
   kubectl get nodes
   ```
 2. **Im Container:**
   ```bash
   kubectl get nodes  # Sollte jetzt auch dein Cluster zeigen
   kubectl config current-context
   ```
 ## 🔐 SOPS + Age Setup
 Damit du Secrets bearbeiten kannst, brauchst du den privaten `age`-Key. Dieser ist in `.sops.yaml` konfiguriert.
 ### Schritt 1: Age-Key bereitstellen
 ```bash
 # Host-Machine: Key-Datei erstellen
 mkdir -p ~/.age
 # Füge deinen privaten Key ein (Format: "age-secret-key-...")
 echo "age-secret-key-xxx..." > ~/.age/keys.txt
 chmod 600 ~/.age/keys.txt
 ```
 ### Schritt 2: Im Container konfigurieren
 Der Container mounted `~/.age` automatisch. Setze die Umgebungsvariable:
 ```bash
 # Im Container-Terminal (SOPS_AGE_KEY_FILE ist bereits automatisch gesetzt!)
 # Jetzt kannst du Secrets bearbeiten (wird transparent ver-/entschlüsselt):
 sops apps/production/custom-configs/mas-secrets.sops.yaml
 ```
 ### Schritt 3: VSCode Integration (optional)
 Um die Umgebungsvariable beim Start zu setzen, nutze die `.devcontainer/devcontainer.json`:
 ```json
 "remoteEnv": {
  "KUBECONFIG": "/home/vscode/.kube/config",
  "SOPS_AGE_KEY_FILE": "/home/vscode/.age/keys.txt"
 }
 ```
 ### Wie es funktioniert
 - `.sops.yaml` definiert, dass Secrets mit `age` verschlüsselt werden
 - Beim Öffnen mit `sops <datei>` wird die Datei entschlüsselt → du editierst den plaintext in deinem Editor
 - Beim Speichern wird alles wieder automatisch verschlüsselt
 - **Wichtig:** Niemals den plaintext-Buffer commiten!
 ## 📝 Nach Container-Start: Git Hooks Installieren
 Wichtig für die ConfigMap Auto-Sync (verhindert Merge-Konflikte):
 ```bash
 ./scripts/install-hooks.sh
 ```
 Mehr Details: `docs/ops-configmap-sync.md`
 ## 📝 Nützliche Befehle
 ```bash
 # Status des Deployments
 kubectl get pods -n matrix
 flux get helmreleases -A
 # Secrets bearbeiten (mit verschlüsselung)
 sops apps/production/custom-configs/mas-secrets.sops.yaml
 # FluxCD Sync erzwingen
 flux reconcile kustomization production-apps --with-source
 # Zertifikate debuggen
 kubectl get certificate -n matrix
 kubectl describe certificate matrix-ingress -n matrix
 # HelmRelease Status prüfen
 flux describe helmrelease matrix-stack -n matrix
 ```
 ## 🛠️ Anpassungen für Windows/WSL2
 Falls du Windows nutzt:
 1. **Docker Desktop installieren** (mit WSL2 Backend)
 2. **VSCode mit WSL Extension öffnen**
 3. **Im WSL Terminal:**
   ```bash
   cd /mnt/c/path/to/projekt
   code .
   ```
 4. Dann `Dev Containers: Reopen in Container`
 Das funktioniert seamless, weil Docker Desktop unter WSL2 läuft.
 ## 🔧 Troubleshooting
 ### Problem: `SOPS_AGE_KEY_FILE not found`
 **Lösung:** Key muss in `~/.age/keys.txt` auf der Host-Machine sein:
 ```bash
 # Host
 mkdir -p ~/.age
 echo "your-age-private-key" > ~/.age/keys.txt
 ```
 Der Container mountet `~/.age` automatisch → sollte dann funktionieren.
 ### Problem: `kubectl: connection refused`
 **Lösung:** `~/.kube/config` muss auf Host vorhanden sein:
 ```bash
 # Host
 kubectl get nodes  # Test, ob Zugriff existiert
 # Dann Container neustarten
 ```
 ### Problem: `HelmChart is not ready: stat ... no such file or directory`
 Siehe `README.md` → **Issue 1**. Kontrolliere:
 - `HelmRepository` nutzt `type: oci`
 - URL ist `oci://ghcr.io/element-hq/ess-helm`
 ### Problem: `values don't meet the specifications of the schema`
 Siehe `README.md` → **Issue 2**. Häufige Fehler:
 - `tls:` darf nicht im `ingress:` Block sein
 - `serverName` muss auf Root-Ebene der `values` stehen
 - Komponenten-Namen: `camelCase` (z.B. `elementWeb`, `matrixAuthenticationService`)
 ### Problem: Let's Encrypt `403 Order's status is processing`
 Siehe `README.md` → **Issue 3**. Kurz: 
 - `wellKnownDelegation: enabled: false` setzen
 - Oder `.well-known/matrix/server` manuell auf `elementWeb` weiterleiten
 ## 📚 Weitere Ressourcen
 - [Dev Containers Docs](https://containers.dev)
 - [FluxCD Dokumentation](https://fluxcd.io)
 - [SOPS Anleitung](https://github.com/getsops/sops)
 - **Projekt-README:** `README.md` (Architektur, Issues, Best Practices)
 - **Setup-Docs:** `docs/setup/`
 - **Install-Guide:** `docs/install.md`
@@ -0,0 +1,65 @@
 {
  "name": "ESS Community GitOps",
  "build": {
    "dockerfile": "Dockerfile",
    "context": "."
  },
  "mounts": [
    "source=${localEnv:HOME}/.kube,target=/home/vscode/.kube,type=bind,consistency=cached",
    "source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached",
    "source=${localEnv:HOME}/.age,target=/home/vscode/.age,type=bind,consistency=cached",
    "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind"
  ],
  "remoteUser": "vscode",
  "features": {
    "ghcr.io/devcontainers/features/git:1": {},
    "ghcr.io/devcontainers/features/github-cli:1": {}
  },
  "remoteEnv": {
    "KUBECONFIG": "/home/vscode/.kube/config",
    "SOPS_AGE_KEY_FILE": "/home/vscode/.age/keys.txt"
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "ms-kubernetes-tools.vscode-kubernetes-tools",
        "redhat.vscode-yaml",
        "redhat.vscode-commons",
        "monokai.theme-monokai-pro-vscode",
        "eamodio.gitlens",
        "gruntfuggly.todo-tree",
        "ms-vscode.makefile-tools",
        "GitHub.copilot"
      ],
      "settings": {
        "[yaml]": {
          "editor.defaultFormatter": "redhat.vscode-yaml",
          "editor.formatOnSave": true,
          "editor.tabSize": 2
        },
        "yaml.schemas": {
          "https://json.schemastore.org/kustomization.json": "**/kustomization.yaml",
          "https://json.schemastore.org/helmrelease.json": "**/*helmrelease*.yaml"
        },
        "editor.theme": "Monokai Pro",
        "todo-tree.general.showActivityBarBadge": true,
        "todo-tree.general.tags": [
          "TODO",
          "FIXME",
          "BUG",
          "HACK",
          "NOTE",
          "XXX",
          "DONE"
        ],
        "todo-tree.tree.showScanModeButton": true,
        "todo-tree.filtering.includeGlobs": [
          "**/docs/TASKS.md",
          "**/docs/deployment-guides/*.md"
        ]
      }
    }
  },
  "postCreateCommand": "bash .devcontainer/postCreateCommand.sh",
  "forwardPorts": []
 }
@@ -0,0 +1,35 @@
 #!/bin/bash
 set -e
 echo "🚀 Setting up ESS Community GitOps devcontainer..."
 # Verify all required tools are installed
 echo "✅ Verifying installed tools..."
 commands=("kubectl" "flux" "helm" "sops" "age" "git" "docker")
 for cmd in "${commands[@]}"; do
  if command -v $cmd &> /dev/null; then
    version=$($cmd version 2>/dev/null | head -1 || echo "installed")
    echo "  ✓ $cmd: $version"
  else
    echo "  ✗ $cmd: NOT FOUND"
    exit 1
  fi
 done
 # Create necessary directories
 echo "📁 Creating home directories..."
 mkdir -p ~/.kube ~/.ssh ~/.age
 # Print useful information
 echo ""
 echo "📚 Useful commands:"
 echo "  - kubectl get pods -n matrix          (check pod status)"
 echo "  - flux get helmreleases -A            (check helm releases)"
 echo "  - sops apps/production/custom-configs/mas-secrets.sops.yaml  (edit secrets)"
 echo ""
 echo "🔗 For kubeconfig setup:"
 echo "  - Copy your ~/.kube/config to access the cluster"
 echo "  - Run: kubectl get nodes"
 echo ""
 echo "✨ Devcontainer setup complete!"
@@ -0,0 +1,50 @@
 name: Auto-Deploy on Push
 on:
  push:
    branches:
      - main
    paths:
      - 'apps/**'
      - 'clusters/**'
      - '.gitea/workflows/**'
 jobs:
  verify-and-notify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Check YAML Syntax
        run: |
          echo "🔍 Validating YAML files..."
          find apps clusters -name "*.yaml" -type f | while read file; do
            if ! grep -q "^apiVersion:" "$file"; then
              echo "⚠️ Warning: $file may not be a valid K8s manifest"
            fi
          done
          echo "✅ YAML validation passed"
      - name: Check for SOPS Encryption
        run: |
          echo "🔐 Checking SOPS status..."
          for file in $(git diff --name-only origin/main...HEAD -- '**/secret*.yaml' '**/credentials*.yaml'); do
            if grep -q "ENC\[" "$file"; then
              echo "✅ $file is encrypted"
            else
              echo "⚠️ WARNING: $file may not be encrypted!"
            fi
          done
      - name: Create Deployment Notification
        run: |
          echo "📤 Flux will reconcile changes within 1 minute"
          echo "🔗 Monitor in Gitea: Projects → Releases (check tags)"
      - name: List Changed Files
        run: |
          echo "📋 Files changed in this push:"
          git diff --name-only origin/main...HEAD
@@ -0,0 +1,32 @@
 name: Create Release on Milestone Tag
 on:
  push:
    tags:
      - 'm*-*-complete'
 jobs:
  create-release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Extract Milestone Info
        id: milestone
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          TITLE=$(git tag -l "$TAG" -n1 | awk '{print substr($0, index($0, $2))}')
          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "title=$TITLE" >> $GITHUB_OUTPUT
          echo "🏷️ Milestone: $TAG"
          echo "📝 Title: $TITLE"
      - name: Create Release
        run: |
          echo "📦 Creating release for milestone: ${{ steps.milestone.outputs.tag }}"
          echo "${{ steps.milestone.outputs.title }}" > /tmp/release-notes.txt
          echo "Created: $(date)" >> /tmp/release-notes.txt
          cat /tmp/release-notes.txt
@@ -53,6 +53,12 @@ winget install Kubernetes.kubectl FluxCD.Flux Mozilla.sops age-encryption.age He
 1.  **Kubeconfig:** Stelle sicher, dass die Datei `~/.kube/config` mit den Zugangsdaten zu deinem K3s-Cluster gefüllt ist. Test: `kubectl get nodes`.
 2.  **SOPS Key:** Du benötigst den privaten `age`-Key (oder GPG-Key), der in der `.sops.yaml` des Repositories hinterlegt ist, um Secrets bearbeiten zu können.
 3.  **Git Hooks installieren:** Nach dem Klonen dieses Repositories müssen Git Hooks installiert werden, um ConfigMap-Änderungen automatisch zu tracken:
    ```bash
    cd prod/gitops
    ./scripts/install-hooks.sh
    ```
    Siehe [📖 GitOps ConfigMap Auto-Sync](docs/ops-configmap-sync.md) für Details.
 -----
@@ -0,0 +1,24 @@
 apiVersion: v1
 kind: Secret
 metadata:
    name: authentik-credentials
    namespace: authentik
 stringData:
    secret_key: ENC[AES256_GCM,data:yIyQapbFtFM11LynFtkV3ffExhaDfN9QHeFbI1T0xkIhgsV+9sjg3qwMVmeBlAe7xZl8gsAM4kDj2Q6O91OdDg==,iv:+Cl8vOcxG9/mgRheaCO0bLWyCJXN+f1F2DD3oeHbPFY=,tag:711ytyKf6/tmXomBLoffGA==,type:str]
    pg-password: ENC[AES256_GCM,data:3w8R9mRjMXMJDLjrC8QYaXFHsCU3yYZs2PcaFQNp3Z4=,iv:G/aXgoGz3vBOzZ5K3Y+DDJsqer4F5gvcMmtkzRx93CU=,tag:dXPs1pY/APvnMlxdvB1EkA==,type:str]
    smtp-password: ENC[AES256_GCM,data:JpMgaQFPkBzOg5WjvpmhM0kPwvZkH+4tQjT17RJHjG14WjmWtfG9Bg==,iv:zjQRLIlrxKv5hbd4JZowNUEiibiCUMf79acZY0+dYAc=,tag:ORPafTPyOQJvVvHWQGmqhA==,type:str]
 sops:
    age:
        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRekJuZythYzliTFJ3RlhS
            R2p6TG9NeFdabFlPRWtpNHJMYVVxTWZEcmlRClk0WUorSzdxNlcyWHYwWFBTMnlq
            TlM4dENSSit2S3VGSzJCeTRTYU52dmcKLS0tIEF0WkV0M25OSEo1N0FEYXI5Q0Z6
            QXVrY1NTeHZkeTlPRWNlVThzWno3T0kKC0KBoLT64GNqb8Ri9u69G7nqb1KftwwP
            /24aVHrPxKi9d4ij9n3bvCYDF4rhtfexhrE4n7CfuKn2DcSiuTniuw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-04-29T21:43:59Z"
    mac: ENC[AES256_GCM,data:Y+dJppkaVZ5NOhlvwbbsF5+vDFqGUI1Ps8IcE4J7FIW4HIdMVf6RKM0EInvPUW1LaBlmelCitcE30w0As7ysNRhLY8yUDaKUvuU6mRejlNUIF8wAHzhciL2jTvAQsArHjybJatEig28+wM9VcY8JEa/d/CmuiB9Nq4WbIV+JXlA=,iv:UQj2rIVLNPjtYp3d/jRyNfJyyyUsZ3+NDCgpI4aztzc=,tag:cwiCzG/A+rfRFfLjXVt82w==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.12.2
@@ -0,0 +1,87 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: authentik
  namespace: authentik
 spec:
  interval: 1h
  chart:
    spec:
      chart: authentik
      version: "2026.2.2"
      sourceRef:
        kind: HelmRepository
        name: goauthentik
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  valuesFrom:
    - kind: Secret
      name: authentik-credentials
      valuesKey: secret_key
      targetPath: authentik.secret_key
    - kind: Secret
      name: authentik-credentials
      valuesKey: pg-password
      targetPath: authentik.postgresql.password
    - kind: Secret
      name: authentik-credentials
      valuesKey: pg-password
      targetPath: postgresql.auth.password
    - kind: Secret
      name: authentik-credentials
      valuesKey: smtp-password
      targetPath: authentik.email.password
  values:
    global:
      security:
        allowInsecureImages: true
    authentik:
      log_level: info
      error_reporting:
        enabled: false
      email:
        host: smtp.ionos.de
        port: 587
        username: gamemaster@axion1337.chat
        use_tls: true
        from: "Authentik <gamemaster@axion1337.chat>"
    server:
      ingress:
        enabled: false
      resources:
        requests:
          cpu: 100m
          memory: 512Mi
        limits:
          memory: 1Gi
    worker:
      resources:
        requests:
          cpu: 50m
          memory: 512Mi
        limits:
          memory: 1Gi
    postgresql:
      enabled: true
      auth:
        username: authentik
        database: authentik
      primary:
        persistence:
          enabled: true
          size: 8Gi
        resources:
          requests:
            cpu: 50m
            memory: 256Mi
          limits:
            memory: 512Mi
@@ -0,0 +1,12 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: auth-axion1337-chat-cert
  namespace: authentik
 spec:
  secretName: auth-axion1337-chat-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - auth.axion1337.chat
@@ -0,0 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: goauthentik
  namespace: flux-system
 spec:
  interval: 1h
  url: https://charts.goauthentik.io
@@ -0,0 +1,16 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: authentik
  namespace: authentik
 spec:
  entryPoints:
    - websecure
  tls:
    secretName: auth-axion1337-chat-tls
  routes:
    - match: Host(`auth.axion1337.chat`)
      kind: Rule
      services:
        - name: authentik-server
          port: 80
@@ -0,0 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - helm-repo.yaml
  - authentik-secret.yaml
  - certificate.yaml
  - authentik.yaml
  - ingress.yaml
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: authentik
@@ -0,0 +1,135 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: alloy-config
  namespace: monitoring
 data:
  config.alloy: |
    // Kubernetes pod discovery
    discovery.kubernetes "k8s_pods" {
      role = "pod"
    }
    // Relabel for Prometheus scrape
    discovery.relabel "prometheus_pods" {
      targets = discovery.kubernetes.k8s_pods.targets
      rule {
        source_labels = ["__meta_kubernetes_pod_annotation_prometheus_io_scrape"]
        action = "keep"
        regex = "true"
      }
      rule {
        source_labels = ["__meta_kubernetes_pod_annotation_prometheus_io_path"]
        action = "replace"
        target_label = "__metrics_path__"
        regex = "(.+)"
      }
      rule {
        source_labels = ["__address__", "__meta_kubernetes_pod_annotation_prometheus_io_port"]
        action = "replace"
        regex = "([^:]+)(?::\\d+)?;(\\d+)"
        replacement = "$1:$2"
        target_label = "__address__"
      }
      rule {
        source_labels = ["__meta_kubernetes_namespace"]
        action = "replace"
        target_label = "namespace"
      }
      rule {
        source_labels = ["__meta_kubernetes_pod_name"]
        action = "replace"
        target_label = "pod"
      }
    }
    // Scrape Flux controllers (flux-system namespace, port 8080)
    discovery.kubernetes "flux_pods" {
      role = "pod"
      namespaces {
        names = ["flux-system"]
      }
    }
    discovery.relabel "flux_scrape" {
      targets = discovery.kubernetes.flux_pods.targets
      rule {
        source_labels = ["__meta_kubernetes_pod_container_port_number"]
        action = "keep"
        regex = "8080"
      }
      rule {
        source_labels = ["__meta_kubernetes_namespace"]
        action = "replace"
        target_label = "namespace"
      }
      rule {
        source_labels = ["__meta_kubernetes_pod_name"]
        action = "replace"
        target_label = "pod"
      }
    }
    // Scrape kube-state-metrics
    prometheus.scrape "kube_state_metrics" {
      targets = [{
        __address__ = "kube-state-metrics.monitoring.svc.cluster.local:8080",
      }]
      forward_to = [prometheus.remote_write.selendis.receiver]
      scrape_interval = "30s"
      scrape_timeout = "10s"
    }
    // Scrape Flux controllers
    prometheus.scrape "flux" {
      targets = discovery.relabel.flux_scrape.output
      forward_to = [prometheus.remote_write.selendis.receiver]
      scrape_interval = "30s"
      scrape_timeout = "10s"
      job_name = "flux"
    }
    // Scrape node-exporter DaemonSet
    prometheus.scrape "node_exporter" {
      targets = [{
        __address__ = "prometheus-node-exporter.monitoring.svc.cluster.local:9100",
      }]
      forward_to = [prometheus.remote_write.selendis.receiver]
      scrape_interval = "30s"
      scrape_timeout = "10s"
    }
    // Scrape Synapse metrics
    prometheus.scrape "synapse" {
      targets = [{
        __address__ = "matrix-stack-synapse-main.matrix.svc.cluster.local:9000",
      }]
      forward_to = [prometheus.remote_write.selendis.receiver]
      scrape_interval = "30s"
      scrape_timeout = "10s"
    }
    // Kubernetes pod logs to Loki
    loki.source.kubernetes "k8s_logs" {
      targets = discovery.kubernetes.k8s_pods.targets
      forward_to = [loki.write.selendis.receiver]
    }
    // Remote write to Selendis Prometheus
    prometheus.remote_write "selendis" {
      endpoint {
        url = "http://10.0.0.3:9090/api/v1/write"
        write_relabel_config {
          source_labels = ["__name__"]
          regex = "go_.*|process_.*"
          action = "drop"
        }
      }
    }
    // Remote write logs to Selendis Loki
    loki.write "selendis" {
      endpoint {
        url = "http://10.0.0.3:3100/loki/api/v1/push"
      }
    }
@@ -0,0 +1,33 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: alloy
  namespace: monitoring
 spec:
  interval: 1h
  chart:
    spec:
      chart: alloy
      version: "0.x"
      sourceRef:
        kind: HelmRepository
        name: grafana
        namespace: flux-system
  values:
    alloy:
      configMap:
        name: alloy-config
    replicaCount: 1
    serviceAccount:
      create: true
      name: alloy
    rbac:
      create: true
    podAnnotations:
      prometheus.io/scrape: "false"
    resources:
      limits:
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 256Mi
@@ -0,0 +1,18 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: prometheus-community
  namespace: flux-system
 spec:
  interval: 1h
  url: https://prometheus-community.github.io/helm-charts
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: grafana
  namespace: flux-system
 spec:
  interval: 1h
  url: https://grafana.github.io/helm-charts
@@ -0,0 +1,22 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: kube-state-metrics
  namespace: monitoring
 spec:
  interval: 1h
  chart:
    spec:
      chart: kube-state-metrics
      version: "5.x"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
        namespace: flux-system
  values:
    replicas: 1
    service:
      port: 8080
    prometheus:
      monitor:
        enabled: false
@@ -0,0 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - helm-repos.yaml
  - kube-state-metrics.yaml
  - node-exporter.yaml
  - alloy-config.yaml
  - alloy.yaml
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: monitoring
@@ -0,0 +1,29 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: prometheus-node-exporter
  namespace: monitoring
 spec:
  interval: 1h
  chart:
    spec:
      chart: prometheus-node-exporter
      version: "4.x"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
        namespace: flux-system
  values:
    hostNetwork: true
    hostPID: true
    hostRootFsMount:
      enabled: true
    service:
      port: 9100
      targetPort: 9100
    prometheus:
      monitor:
        enabled: false
    tolerations:
      - effect: NoSchedule
        operator: Exists
@@ -28,6 +28,13 @@ spec:
      services:
        - name: matrix-stack-well-known
          port: 8010
    # Element Desktop Setup Skripte
    - match: Host(`axion1337.chat`) && PathPrefix(`/docs/setup`)
      kind: Rule
      priority: 50
      services:
        - name: element-web-docs
          port: 80
    # Niedrigere Priorität: alles andere -> Element Web
    - match: Host(`axion1337.chat`)
      kind: Rule
@@ -0,0 +1,22 @@
 apiVersion: v1
 kind: Secret
 metadata:
    name: coturn-secret
    namespace: matrix
 stringData:
    TURN_SECRET: ENC[AES256_GCM,data:SILIqMB+fmAMFITAL7lG1hOgICec6BJf1mOcK0gdmnCHWYqRuJv7jgjfGylG25xzQKi+zE7Qual9PnkZG2KiOA==,iv:+GZqLGusE4Q0x2jEEtFxj06rryyQmQhXdkTy4eE8ZHw=,tag:OpSZkinPTAi1ZKWyo8OX3A==,type:str]
 sops:
    age:
        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRk1mK3NWc1l4T0JCOFpF
            S0RuQ3ViZmo3QTNVL2JvZ0hzMy91R2l0TEhzCk01a1VGdk1sdVg4aWswTzRibXI4
            ZlJtNFF5MjBONEZOaWVpeU5taHl2bkEKLS0tIGxpUHY3NUFLWFBaWm1QSlZiVFkx
            MEJleHFnd3oyT3VPL2dsYkpMUlRkOWMKcKUIgsQ/ff49pGGXMnYwJmwqPVC7woAR
            IEzvhcNX97xx746SnrxZe5t2YadsYMkYIl0nvqBPJhSlvqMNafpQbQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-04-29T21:06:21Z"
    mac: ENC[AES256_GCM,data:UhyR5m1HYWrZHwNLW5sg2PxbpaydWbP5cekghGlzSpQg7CYEcvZw3tJ/qB8zA19xZSM7tdSHOXdD+QytRq6qW59M1unqMaumA43B6JxQg1C1NdXAW0mkSc2WiNchvgpVii9P/TVlzSSIRwC3YGCQUsfa3SSfNzI4Z6fMuBnhYLE=,iv:4HYxbrYSRJLe1KcQ6q8bpee8/Lx1m3pPmisb/L2Mu64=,tag:l7n3u+Pg6533OzwtNUZvNw==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.12.2
@@ -0,0 +1,162 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: coturn-config
  namespace: matrix
 data:
  turnserver.conf: |
    # TURN Server configuration
    realm=axion1337.chat
    # Listen ports
    listening-port=3478
    listening-ip=0.0.0.0
    alt-listening-port=5349
    alt-listening-ip=0.0.0.0
    # External IPs (for clients behind NAT)
    relay-ip=49.13.132.245
    external-ip=49.13.132.245
    # Relay port range
    min-bps=0
    bps-capacity=0
    # Authentication
    use-auth-secret
    static-auth-secret=$TURN_SECRET
    # HTTPS/TLS
    cert=/etc/coturn/tls/tls.crt
    pkey=/etc/coturn/tls/tls.key
    # Performance tuning
    max-bps=0
    bps-capacity=0
    log-file=stdout
    # Logging
    verbose
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: coturn
  namespace: matrix
 spec:
  type: ClusterIP
  ports:
    - name: stun-udp
      port: 3478
      protocol: UDP
    - name: stun-tcp
      port: 3478
      protocol: TCP
    - name: turns-tcp
      port: 5349
      protocol: TCP
  selector:
    app: coturn
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: coturn
  namespace: matrix
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: coturn
  template:
    metadata:
      labels:
        app: coturn
      annotations:
        prometheus.io/scrape: "false"
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      initContainers:
      - name: init-config
        image: busybox:1.28
        command:
        - sh
        - -c
        - |
          TURN_SECRET=$(cat /etc/coturn-secret/TURN_SECRET)
          sed "s|\$TURN_SECRET|$TURN_SECRET|g" /etc/coturn-template/turnserver.conf > /etc/coturn/turnserver.conf
          chmod 644 /etc/coturn/turnserver.conf
        resources:
          limits:
            cpu: 100m
            memory: 64Mi
          requests:
            cpu: 50m
            memory: 32Mi
        volumeMounts:
        - name: config-template
          mountPath: /etc/coturn-template
        - name: config
          mountPath: /etc/coturn
        - name: secret
          mountPath: /etc/coturn-secret
          readOnly: true
      containers:
      - name: coturn
        image: coturn/coturn:latest
        imagePullPolicy: IfNotPresent
        ports:
        - name: stun-udp
          containerPort: 3478
          protocol: UDP
        - name: stun-tcp
          containerPort: 3478
          protocol: TCP
        - name: turns-tcp
          containerPort: 5349
          protocol: TCP
        volumeMounts:
        - name: config
          mountPath: /etc/coturn
        - name: tls
          mountPath: /etc/coturn/tls
          readOnly: true
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 100m
            memory: 128Mi
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -c
            - "netstat -uln | grep 3478 || exit 1"
          initialDelaySeconds: 30
          periodSeconds: 10
      volumes:
      - name: config
        emptyDir: {}
      - name: config-template
        configMap:
          name: coturn-config
      - name: secret
        secret:
          secretName: coturn-secret
          defaultMode: 0400
      - name: tls
        secret:
          secretName: turn-axion1337-chat-tls
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - matrix
@@ -0,0 +1,186 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: ess-element-custom
  namespace: matrix
 data:
  values.yaml: |
    elementWeb:
      additional:
        config.json: |
          {
            "brand": "aXion1337.Chat",
            "default_theme": "aXion1337 Dark",
            "show_labs_settings": true,
            "features": {
              "feature_qr_code_login": true,
              "feature_new_room_list": true
            },
            "element_call": {
              "use_exclusively": true
            },
            "setting_defaults": {
              "custom_themes": [
                {
                  "name": "aXion1337 Dark true",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#ffaf0f",
                    "primary-color": "#ffaf0f",
                    "secondary-color": "#ffaf0f"
                  }
                },
                {
                  "name": "Deep Purple",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#6503b3",
                    "primary-color": "#368bd6",
                    "warning-color": "#b30356",
                    "sidebar-color": "#15171B",
                    "roomlist-background-color": "#22262E",
                    "roomlist-text-color": "#A1B2D1",
                    "roomlist-text-secondary-color": "#EDF3FF",
                    "roomlist-highlights-color": "#343A46",
                    "roomlist-separator-color": "#a1b2d1",
                    "timeline-background-color": "#181b21",
                    "timeline-text-color": "#EDF3FF",
                    "timeline-text-secondary-color": "#A1B2D1",
                    "timeline-highlights-color": "#22262E"
                  }
                },
                {
                  "name": "Discord Dark",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#747ff4",
                    "accent": "#747ff4",
                    "primary-color": "#00aff4",
                    "warning-color": "#faa81ad9",
                    "alert": "#faa81ad9",
                    "sidebar-color": "#202225",
                    "roomlist-background-color": "#2f3136",
                    "roomlist-text-color": "#dcddde",
                    "roomlist-text-secondary-color": "#8e9297",
                    "roomlist-highlights-color": "#4f545c52",
                    "roomlist-separator-color": "#40444b",
                    "timeline-background-color": "#36393f",
                    "timeline-text-color": "#dcddde",
                    "secondary-content": "#dcddde",
                    "tertiary-content": "#dcddde",
                    "timeline-text-secondary-color": "#b9bbbe",
                    "timeline-highlights-color": "#04040512",
                    "reaction-row-button-selected-bg-color": "#4752c4",
                    "menu-selected-color": "#4752c4",
                    "focus-bg-color": "#4752c4",
                    "room-highlight-color": "#4752c4",
                    "other-user-pill-bg-color": "#4752c4",
                    "togglesw-off-color": "#72767d"
                  },
                  "compound": {
                    "--cpd-color-theme-bg": "#0019ff",
                    "--cpd-color-bg-canvas-default": "#2f3136",
                    "--cpd-color-bg-subtle-secondary": "#2f3136",
                    "--cpd-color-bg-subtle-primary": "#4f545c52",
                    "--cpd-color-bg-action-primary-rest": "#dcddde",
                    "--cpd-color-bg-action-secondary-rest": "#2f3136",
                    "--cpd-color-bg-critical-primary": "#fd3f3c",
                    "--cpd-color-bg-critical-subtle": "#745862",
                    "--cpd-color-bg-critical-hovered": "#fd3f3c",
                    "--cpd-color-bg-accent-rest": "#4cb387",
                    "--cpd-color-text-primary": "#dcddde",
                    "--cpd-color-text-secondary": "#b9bbbe",
                    "--cpd-color-text-action-accent": "#b9bbbe",
                    "--cpd-color-text-critical-primary": "#fd3f3c",
                    "--cpd-color-text-success-primary": "#4cb387",
                    "--cpd-color-icon-primary": "#dcddde",
                    "--cpd-color-icon-secondary": "#dcddde",
                    "--cpd-color-icon-tertiary": "#a7a0a7",
                    "--cpd-color-icon-accent-tertiary": "#4cb387",
                    "--cpd-color-border-interactive-primary": "#5d6064",
                    "--cpd-color-border-interactive-secondary": "#5d6064",
                    "--cpd-color-border-critical-primary": "#fd3f3c",
                    "--cpd-color-border-success-subtle": "#4cb387"
                  }
                },
                {
                  "name": "Electric Blue",
                  "is_dark": false,
                  "colors": {
                    "accent-color": "#3596fc",
                    "primary-color": "#368bd6",
                    "warning-color": "#ff4b55",
                    "sidebar-color": "#27303a",
                    "roomlist-background-color": "#f3f8fd",
                    "roomlist-text-color": "#2e2f32",
                    "roomlist-text-secondary-color": "#61708b",
                    "roomlist-highlights-color": "#ffffff",
                    "roomlist-separator-color": "#e3e8f0",
                    "timeline-background-color": "#ffffff",
                    "timeline-text-color": "#2e2f32",
                    "timeline-text-secondary-color": "#61708b",
                    "timeline-highlights-color": "#f3f8fd",
                    "username-colors": ["#ff0000", "#ff7f00", "#ffff00", "#00ff00", "#0000ff", "#4b0082", "#9400d3", "#ff1493"],
                    "avatar-background-colors": ["#cc0000", "#cc6600", "#cccc00", "#00cc00", "#0000cc", "#3b0066", "#7a00b3", "#cc1077"]
                  },
                  "compound": {
                    "--cpd-color-icon-accent-tertiary": "var(--cpd-color-blue-800)",
                    "--cpd-color-text-action-accent": "var(--cpd-color-blue-900)"
                  }
                },
                {
                  "name": "Everforest dark hard",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#a7c080",
                    "primary-color": "#a7c080",
                    "warning-color": "#e67e80",
                    "sidebar-color": "#323d43",
                    "roomlist-background-color": "#2f383e",
                    "roomlist-text-color": "#d3c6aa",
                    "roomlist-text-secondary-color": "#d3c6aa",
                    "roomlist-highlights-color": "#4b565c",
                    "roomlist-separator-color": "#4b565c",
                    "timeline-background-color": "#2b3339",
                    "timeline-text-color": "#d3c6aa",
                    "secondary-content": "#d3c6aa",
                    "tertiary-content": "#d3c6aa",
                    "timeline-text-secondary-color": "#a7c080",
                    "timeline-highlights-color": "#4b565c",
                    "reaction-row-button-selected-bg-color": "#4b565c"
                  }
                },
                {
                  "name": "aXion1337 Dark", #Gruvbox Dark
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#bd93f9",
                    "primary-color": "#fe8019",
                    "warning-color": "#fb4934",
                    "sidebar-color": "#282828",
                    "roomlist-background-color": "#1d2021",
                    "roomlist-text-color": "#a89984",
                    "roomlist-text-secondary-color": "#00ff00",
                    "roomlist-highlights-color": "#00000030",
                    "roomlist-separator-color": "#4d4d4d90",
                    "timeline-background-color": "#282828",
                    "timeline-text-color": "#ebdbb2",
                    "secondary-content": "#928374",
                    "tertiary-content": "#928374",
                    "quinary-content": "#504945",
                    "timeline-text-secondary-color": "#a89984",
                    "timeline-highlights-color": "#00000030",
                    "reaction-row-button-selected-bg-color": "#689d6a",
                    "menu-selected-color": "#504945",
                    "icon-button-color": "#928374",
                    "accent": "#689d6a",
                    "alert": "#cc241d",
                    "username-colors": [
                      "#cc241d",
                      "#98971a",
                      "#d79921",
                      "#458588",
                      "#b16286",
                      "#689d6a",
                      "#a89984",
                      "#d65d0e"
@@ -13,19 +13,180 @@ data:
            "default_theme": "aXion1337 Dark",
            "show_labs_settings": true,
            "features": {
-              "feature_qr_code_login": true
+              "feature_qr_code_login": true,
              "feature_new_room_list": true
            },
            "element_call": {
              "use_exclusively": true
            },
            "setting_defaults": {
              "custom_themes": [
                {
-                  "name": "aXion1337 Dark",
+                  "name": "aXion1337 Dark true",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#ffaf0f",
                    "primary-color": "#ffaf0f",
                    "secondary-color": "#ffaf0f"
                  }
                },
                {
                  "name": "Deep Purple",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#6503b3",
                    "primary-color": "#368bd6",
                    "warning-color": "#b30356",
                    "sidebar-color": "#15171B",
                    "roomlist-background-color": "#22262E",
                    "roomlist-text-color": "#A1B2D1",
                    "roomlist-text-secondary-color": "#EDF3FF",
                    "roomlist-highlights-color": "#343A46",
                    "roomlist-separator-color": "#a1b2d1",
                    "timeline-background-color": "#181b21",
                    "timeline-text-color": "#EDF3FF",
                    "timeline-text-secondary-color": "#A1B2D1",
                    "timeline-highlights-color": "#22262E"
                  }
                },
                {
                  "name": "Discord Dark",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#747ff4",
                    "accent": "#747ff4",
                    "primary-color": "#00aff4",
                    "warning-color": "#faa81ad9",
                    "alert": "#faa81ad9",
                    "sidebar-color": "#202225",
                    "roomlist-background-color": "#2f3136",
                    "roomlist-text-color": "#dcddde",
                    "roomlist-text-secondary-color": "#8e9297",
                    "roomlist-highlights-color": "#4f545c52",
                    "roomlist-separator-color": "#40444b",
                    "timeline-background-color": "#36393f",
                    "timeline-text-color": "#dcddde",
                    "secondary-content": "#dcddde",
                    "tertiary-content": "#dcddde",
                    "timeline-text-secondary-color": "#b9bbbe",
                    "timeline-highlights-color": "#04040512",
                    "reaction-row-button-selected-bg-color": "#4752c4",
                    "menu-selected-color": "#4752c4",
                    "focus-bg-color": "#4752c4",
                    "room-highlight-color": "#4752c4",
                    "other-user-pill-bg-color": "#4752c4",
                    "togglesw-off-color": "#72767d"
                  },
                  "compound": {
                    "--cpd-color-theme-bg": "#0019ff",
                    "--cpd-color-bg-canvas-default": "#2f3136",
                    "--cpd-color-bg-subtle-secondary": "#2f3136",
                    "--cpd-color-bg-subtle-primary": "#4f545c52",
                    "--cpd-color-bg-action-primary-rest": "#dcddde",
                    "--cpd-color-bg-action-secondary-rest": "#2f3136",
                    "--cpd-color-bg-critical-primary": "#fd3f3c",
                    "--cpd-color-bg-critical-subtle": "#745862",
                    "--cpd-color-bg-critical-hovered": "#fd3f3c",
                    "--cpd-color-bg-accent-rest": "#4cb387",
                    "--cpd-color-text-primary": "#dcddde",
                    "--cpd-color-text-secondary": "#b9bbbe",
                    "--cpd-color-text-action-accent": "#b9bbbe",
                    "--cpd-color-text-critical-primary": "#fd3f3c",
                    "--cpd-color-text-success-primary": "#4cb387",
                    "--cpd-color-icon-primary": "#dcddde",
                    "--cpd-color-icon-secondary": "#dcddde",
                    "--cpd-color-icon-tertiary": "#a7a0a7",
                    "--cpd-color-icon-accent-tertiary": "#4cb387",
                    "--cpd-color-border-interactive-primary": "#5d6064",
                    "--cpd-color-border-interactive-secondary": "#5d6064",
                    "--cpd-color-border-critical-primary": "#fd3f3c",
                    "--cpd-color-border-success-subtle": "#4cb387"
                  }
                },
                {
                  "name": "Electric Blue",
                  "is_dark": false,
                  "colors": {
                    "accent-color": "#3596fc",
                    "primary-color": "#368bd6",
                    "warning-color": "#ff4b55",
                    "sidebar-color": "#27303a",
                    "roomlist-background-color": "#f3f8fd",
                    "roomlist-text-color": "#2e2f32",
                    "roomlist-text-secondary-color": "#61708b",
                    "roomlist-highlights-color": "#ffffff",
                    "roomlist-separator-color": "#e3e8f0",
                    "timeline-background-color": "#ffffff",
                    "timeline-text-color": "#2e2f32",
                    "timeline-text-secondary-color": "#61708b",
                    "timeline-highlights-color": "#f3f8fd",
                    "username-colors": ["#ff0000", "#ff7f00", "#ffff00", "#00ff00", "#0000ff", "#4b0082", "#9400d3", "#ff1493"],
                    "avatar-background-colors": ["#cc0000", "#cc6600", "#cccc00", "#00cc00", "#0000cc", "#3b0066", "#7a00b3", "#cc1077"]
                  },
                  "compound": {
                    "--cpd-color-icon-accent-tertiary": "var(--cpd-color-blue-800)",
                    "--cpd-color-text-action-accent": "var(--cpd-color-blue-900)"
                  }
                },
                {
                  "name": "Everforest dark hard",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#a7c080",
                    "primary-color": "#a7c080",
                    "warning-color": "#e67e80",
                    "sidebar-color": "#323d43",
                    "roomlist-background-color": "#2f383e",
                    "roomlist-text-color": "#d3c6aa",
                    "roomlist-text-secondary-color": "#d3c6aa",
                    "roomlist-highlights-color": "#4b565c",
                    "roomlist-separator-color": "#4b565c",
                    "timeline-background-color": "#2b3339",
                    "timeline-text-color": "#d3c6aa",
                    "secondary-content": "#d3c6aa",
                    "tertiary-content": "#d3c6aa",
                    "timeline-text-secondary-color": "#a7c080",
                    "timeline-highlights-color": "#4b565c",
                    "reaction-row-button-selected-bg-color": "#4b565c"
                  }
                },
                {
                  "name": "aXion1337 Dark",
                  "is_dark": true,
                  "colors": {
                    "accent-color": "#bd93f9",
                    "primary-color": "#fe8019",
                    "warning-color": "#fb4934",
                    "sidebar-color": "#282828",
                    "roomlist-background-color": "#1d2021",
                    "roomlist-text-color": "#a89984",
                    "roomlist-text-secondary-color": "#00ff00",
                    "roomlist-highlights-color": "#00000030",
                    "roomlist-separator-color": "#4d4d4d90",
                    "timeline-background-color": "#282828",
                    "timeline-text-color": "#ebdbb2",
                    "secondary-content": "#928374",
                    "tertiary-content": "#928374",
                    "quinary-content": "#504945",
                    "timeline-text-secondary-color": "#a89984",
                    "timeline-highlights-color": "#00000030",
                    "reaction-row-button-selected-bg-color": "#689d6a",
                    "menu-selected-color": "#504945",
                    "icon-button-color": "#928374",
                    "accent": "#689d6a",
                    "alert": "#cc241d",
                    "username-colors": [
                      "#cc241d",
                      "#98971a",
                      "#d79921",
                      "#458588",
                      "#b16286",
                      "#689d6a",
                      "#a89984",
                      "#d65d0e"
                    ]
                  }
                }
              ]
            }
-          }
+          }
@@ -4,19 +4,19 @@ metadata:
    name: ess-mas-values-secret
    namespace: matrix
 stringData:
-    values.yaml: ENC[AES256_GCM,data:K692tDSLoftfKmsd4nIc8BzJw9CwXkOc4qSGTw78qF7L7UolTlH456WYeuwXiajDHmsVJCLhxDjCAhGyYUgbEC1mwuX1ZpkJefJkXvkGtQqnVbpS5MLYWt2SMQo+Yuz5L3Qxkop8Y02/U8jFxu5w7LQT71aAJphI1Po6r0wWjCIP0pDLTSUXd5Tk4eLq7o1a8nCrkJxSDQc95sRPTlZ/cfVhBE4xDzDK/CD/Yajv6yUceqUr7j7aBHOlg82+y0HU8xY44B/NtAzphJJf706z0X80Q5Dboeks5Rj9Na0lld5hwcOQPocYO28Tb6RDYOkNOQUELZKoc64JcpYJNyUkxfJl0hjtC1TmtAy1ZljLytnbnc9abNnHWgKcBt9TCcLIJJbZAI2snSHON8uNYpf7+erXx0wHVGxL/WZWEiFlAhnTfNx/Dqr2l0tKTjzRgibSpeA9rBmEm1/2PnJjexRpyewbS2MASGy2C1lfqaAPfjxf,iv:tguaH5u/67ubPSzhrhk3QMkpsE3flvrEZf50U3bcXvc=,tag:KY3T9RcV9KVBKb1SKXCjmw==,type:str]
+    values.yaml: ENC[AES256_GCM,data:tPLcPvoTa2Qs49JSDW6CqiYMIrjsoKrExCl+hOm5R3/o+O9Lf4UqyMC4QY6T303m7GMU3tIDGX4js8NS7Fdcs9YOKoInUKlYqCYzNio+BRsl1DGtzEtcUWhXZQC58RHbI8jiLhXsI1x2vSYsMj5MkymVe9Kmjw91vxEivzn8dC2zae4rFGk/LyLoI5BHzSCT6csUGtGZe01rN/DsGpHxkYNbzinBK3uFM43IgcjCrkBK8jzsxUYA4JWvzBJ1tB5TyyTgZBBe2Baxj7vHf9SysGwbRl4TBzY5at8cPKKnmh7qaHQO3FHCCqfHi1ymt1vNRtPPGRGAKWqC8AroXTPUUe4oSQ7wakhuQwPAhQJn0FHjIJNbp2J7M9K3nWnf0eugDPcp1pQ7Iv0tUQ/2hd5Q8Xmiv7qCCBuhOGnAokUwkRnZu124PEhPwDa/PSA6bB/5dCwj8rzZOyEXJsz12cRtSPK8Kqff+bp2MSFEA8iETm40k/BxybyC2odWEhkPDlRl+YDe8rJxkGGLwP5PEgiQp5RK4ZftQ6Cgc5loUHDAar10tMsqg++iQeyeb/o=,iv:PSo85CoDdWajU3j4vHsaNCHI6UbMbII01nskXNyotVU=,tag:OBVkKsBnCv9bloORukDgcQ==,type:str]
 sops:
    age:
        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYUEvbDF0azNsM0RSS3pZ
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWOVd0enFxNE85WnN1eTRD
-            eG1sNEZKOXAzUVRZWWVTbjlpazJqaVpBRWtBCkE4SW9qVVhxa1dKSXhXV2pSN0lK
+            MjdVSE90NUd6MWFBbCtzZFRTK0NQYllUTGdVCk9aWGNGLzNvLzU3S09la2RiY1hv
-            VVZET0E2bWZSclkvSzlqdlRxcjVNOEEKLS0tIEZtdm9xRU81WXpkTGQ1UW5HZUl2
+            bXdNZjFxaVM5aUF3MTA1bWx4WU1TR0EKLS0tIFp6RmdCVlE5Zk53RjF3MnZveHo4
-            UERlYmtRc21PSnFGNjFkZFVVcm9nUTgKuxWcqg1MRWq7Yhp61lHHKPZsdiNeHXSd
+            eUpzQTBCRjM0a2FmZzNkdmFKWUVPODQKqpA3drI6JV67Y3P/l8Ql5xwtohVi9D3P
-            72OCNMaUiz58kTKt+tpthUxXlGUlf3y0VA1/KigeA+L5Z2bk/bdMmw==
+            6iAcFoqrVZMSKkkiHDvAcdUexIO/BKddjC5N608MLUz7tcxyWfMqeg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-22T13:49:01Z"
+    lastmodified: "2026-04-23T13:17:31Z"
-    mac: ENC[AES256_GCM,data:wHDBVBTvNycXTKTVBK1MNrGg2C0XufPpNTx9ksp1V5rtfcPvZNbiw8aUcjHt6hNtT3tPPmUt82jwzAbAm3hnPsAVfnue+bB2BZ91AI11tcqr4o+l3djeJODntF5d6TfdIWchtwMisy7bBMtLPS4Vs++JPbP90p/CtCdOxPwh1CQ=,iv:CQ24u8xSpzG3QU4JzzpZIx5cBrMH5RxVPl/S6gLylxU=,tag:f8FdKvtyxz8ks0gV6ct9iQ==,type:str]
+    mac: ENC[AES256_GCM,data:V4l8oScpWwC95gg9UQpaV0oKn292Y6WoRZdWlqF3I8BWCGV4LVvLE7KxC9lqHdt/Mcgb6yuaDSv3ZMERl81QOMSMcPVfk/F0LoabP/dFiz1ogxOezHOfJJ2mTu+4yAOkK73RQY68ui5UGAV5FFu3tecE0AAouSt0YrOTBALtLpY=,iv:WBFy/v6gRBil30Oqdew3JW5XVz5wmaO0Uj7J+MfSrss=,tag:CvTEdnbs4dJ0qlnefvXIag==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.12.2
@@ -1,22 +0,0 @@
 apiVersion: v1
 kind: Secret
 metadata:
    name: ess-mas-custom-secrets
    namespace: matrix
 stringData:
    values.yaml: ENC[AES256_GCM,data:Vk5TvaBui8gK6ftcRvZA8aEmw+QmWhn6pp9/2T5ndw8YPiggAtpqZszms5yoOxPK2Jy+GAVZ3M1whWFrdqy2WPjCAVEKlg5i7qeC1wKfgjMV2txWRlQjYAu2n4IYxi1aOaFcqzxLGYclAlQh6J0PmSYKtbWZO0nsjjcbXt9AXRgmjjZnIcNEBcQg9DoSew4MiHr5BQ0dsN0hJx96UhtTAVwssDgE1eKlTz2K/VD/xz3Odd/WuFKjThpa4E3p66Azc+4WNuQpxFejUgEg5ZzMvup8GGEzH5L3jBtxdBNmNFn6GNwFfYwq/ohWTXafVTj1mEpwTYBcKEtsmks8fl/qzb6QBobOOPqKTD4chRhv72yeYE7rv9x6530TxNXGUd++jxtQm1G+ZOjje05k3x2i9SQv5CNBM2jSyoh2uktoVyaJLpgJMv35VdyLAWY+nNXD4yj0isI=,iv:7GmbMaMDWY+agQC3Xr9SpOzGPyb82RDCSEyPHaWwMhQ=,tag:FUpe4v9BybS0M+8L7yvB4A==,type:str]
 sops:
    age:
        - recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUWlDYkY4NVpWNFVHb1Bo
            b3FpR0w5NmttcW9IV1RXWENwTnE2NU9tR0hvCnJyNU9xWEpYZWRXVURtTis3aEp2
            MmtCZXZXemlKNnZrbW1OL0NlMXlQbzQKLS0tIG81ZXIyd2pGOVlXeEVtRy92RzFp
            VU9sa0tOdlBqcnZ2VTVaQWpaN3Y3L0UKUel3SRju6rFbMa9Di++EAci8+fsMjx4X
            X8fM/N4jTHerXOBCT/bnD/Tk/2jAcwg9PC3e906VDUdsIZw+xU+grw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-04-22T10:12:35Z"
    mac: ENC[AES256_GCM,data:zMIPahMwgSgF9vdEkp7DyECL3s6IuEHWs0JE1G9A+xYmm0mAFYbzMPwgg6oB57gNpX3EaPovHOOvKlTjZVWUbv892mU63GPi4W5kRxsZya5FyC3PxyZlsvMX9U/F8Hwvo9tymbGYpsGGkxv0doRZvTuKDzj1j1+VO0VVcY2i3Gc=,iv:dq6GtQ0vfQWiew6s6gWjPRZPtQ1rD3cO3aQXPDT0Sos=,tag:7UrcQ8Q420HK/vW01SsRkg==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.12.2
@@ -22,4 +22,51 @@ data:
            - '::1/128'
            - 'fe80::/10'
            - 'fc00::/7'
-            max_spider_size: 10M
+            max_spider_size: 10M
        retention:
          config: |
            retention:
              enabled: true
              default_policy:
                min_lifetime: 1d
                max_lifetime: 1y
              allowed_lifetime_min: 1d
              allowed_lifetime_max: 2y
              purge_jobs:
                - longest_max_lifetime: 3d
                  interval: 12h
                - shortest_max_lifetime: 3d
                  longest_max_lifetime: 1w
                  interval: 1d
                - shortest_max_lifetime: 1w
                  interval: 2d
            media_retention:
              local_media_lifetime: 365d
              remote_media_lifetime: 90d
            redaction_retention_period: 7d
            forgotten_room_retention_period: 28d
            user_ips_max_age: 90d
        auto_join:
          config: |
            auto_join_rooms:
              - "#onboarding:axion1337.chat"
            auto_join_rooms_for_guests: false
        room_publish:
          config: |
            room_list_publication_rules:
              - user_id: "*"
                action: allow
        turn:
          config: |
            turn_uris:
              - "turn:turn.axion1337.chat?transport=udp"
              - "turn:turn.axion1337.chat?transport=tcp"
              - "turns:turn.axion1337.chat?transport=tcp"
            turn_shared_secret: "cab3c8408363515d9b4cdc3384a1f76ca17a973242fdfdc72b67ac4d86158527"
            turn_user_lifetime: 86400000
            turn_allow_guests: false
        oembed:
          config: |
            oembed_enabled: true
@@ -4,7 +4,7 @@ metadata:
  name: matrix-stack
  namespace: matrix
 spec:
-  interval: 1h
+  interval: 5m
  chart:
    spec:
      chart: matrix-stack
@@ -43,6 +43,10 @@ spec:
      enabled: true
      ingress:
        host: matrix.axion1337.chat
      additional:
        oembed:
          config: |
            oembed_enabled: true
    # Matrix Authentication Service – braucht eine Subdomain
    matrixAuthenticationService:
@@ -59,6 +63,10 @@ spec:
    # Element Web
    elementWeb:
      enabled: true
      image:
        registry: rohana.axion1337.de
        repository: sorb/threadnet-web
        tag: v0.1.0
      ingress:
        host: axion1337.chat
@@ -0,0 +1,402 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: ess-element-web-docs
  namespace: matrix
 data:
  # HTML Index Page
  "index.html": |
    <!DOCTYPE html>
    <html lang="de">
    <head>
      <meta charset="UTF-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0">
      <title>Element Desktop Setup - aXion1337.Chat</title>
      <style>
        * { margin: 0; padding: 0; box-sizing: border-box; }
        body {
          font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif;
          background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
          min-height: 100vh;
          padding: 40px 20px;
        }
        .container {
          max-width: 800px;
          margin: 0 auto;
          background: white;
          border-radius: 12px;
          box-shadow: 0 20px 60px rgba(0,0,0,0.3);
          padding: 40px;
        }
        h1 {
          color: #333;
          margin-bottom: 10px;
          font-size: 2.5em;
        }
        .subtitle {
          color: #666;
          margin-bottom: 40px;
          font-size: 1.1em;
        }
        .section {
          margin-bottom: 40px;
        }
        .section h2 {
          color: #667eea;
          font-size: 1.5em;
          margin-bottom: 20px;
          border-bottom: 3px solid #667eea;
          padding-bottom: 10px;
        }
        .download-grid {
          display: grid;
          grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
          gap: 20px;
          margin-bottom: 30px;
        }
        .download-card {
          background: #f8f9fa;
          border: 2px solid #e9ecef;
          border-radius: 8px;
          padding: 20px;
          text-align: center;
          transition: all 0.3s ease;
          text-decoration: none;
          color: #333;
        }
        .download-card:hover {
          border-color: #667eea;
          background: #f0f3ff;
          transform: translateY(-5px);
          box-shadow: 0 10px 30px rgba(102, 126, 234, 0.2);
        }
        .download-card .icon {
          font-size: 2.5em;
          margin-bottom: 10px;
        }
        .download-card .name {
          font-weight: 600;
          font-size: 1.1em;
          margin-bottom: 5px;
        }
        .download-card .desc {
          font-size: 0.9em;
          color: #666;
        }
        .themes {
          background: #f8f9fa;
          border-left: 4px solid #667eea;
          padding: 20px;
          border-radius: 4px;
          margin-bottom: 20px;
        }
        .themes h3 {
          color: #333;
          margin-bottom: 15px;
        }
        .theme-list {
          display: grid;
          grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
          gap: 10px;
        }
        .theme-item {
          background: white;
          padding: 10px;
          border-radius: 4px;
          text-align: center;
          color: #667eea;
          font-weight: 500;
          border: 1px solid #667eea;
        }
        .instructions {
          background: #e7f3ff;
          border-left: 4px solid #0066cc;
          padding: 15px;
          border-radius: 4px;
          margin: 15px 0;
          line-height: 1.6;
        }
        .instructions code {
          background: #f0f0f0;
          padding: 2px 6px;
          border-radius: 3px;
          font-family: monospace;
        }
        .support {
          text-align: center;
          color: #666;
          margin-top: 40px;
          padding-top: 20px;
          border-top: 1px solid #e9ecef;
        }
        .support a {
          color: #667eea;
          text-decoration: none;
          font-weight: 500;
        }
        .support a:hover {
          text-decoration: underline;
        }
      </style>
    </head>
    <body>
      <div class="container">
        <h1>🎨 Element Desktop Setup</h1>
        <p class="subtitle">Automatische Konfiguration mit Custom Themes für aXion1337.Chat</p>
        <div class="section">
          <h2>📥 Download Setup-Script</h2>
          <div class="download-grid">
            <a href="element-setup-windows.cmd" class="download-card" download>
              <div class="icon">🪟</div>
              <div class="name">Windows</div>
              <div class="desc">.cmd Datei</div>
            </a>
            <a href="element-setup-macos.command" class="download-card" download>
              <div class="icon">🍎</div>
              <div class="name">macOS</div>
              <div class="desc">.command Datei</div>
            </a>
            <a href="element-setup-linux.sh" class="download-card" download>
              <div class="icon">🐧</div>
              <div class="name">Linux</div>
              <div class="desc">.sh Datei</div>
            </a>
          </div>
          <div class="instructions">
            <strong>Anleitung:</strong><br><br>
            <strong>🪟 Windows:</strong> Datei herunterladen → Doppelklick → Script läuft automatisch<br><br>
            <strong>🍎 macOS:</strong> Datei herunterladen → Doppelklick im Finder → Script läuft automatisch<br><br>
            <strong>🐧 Linux:</strong><br>
            <code>chmod +x element-setup-linux.sh</code><br>
            <code>./element-setup-linux.sh</code>
          </div>
        </div>
        <div class="section">
          <h2>🎨 Verfügbare Themes</h2>
          <div class="themes">
            <h3>Automatisch geladen in Element:</h3>
            <div class="theme-list">
              <div class="theme-item">aXion1337 Dark</div>
              <div class="theme-item">Deep Purple</div>
              <div class="theme-item">Discord Dark</div>
              <div class="theme-item">Electric Blue</div>
              <div class="theme-item">Everforest dark hard</div>
              <div class="theme-item">Gruvbox Dark</div>
              <div class="theme-item">Wal</div>
            </div>
          </div>
        </div>
        <div class="section">
          <h2>❓ Support</h2>
          <p>Für weitere Hilfe besuche: <a href="https://element.io/help" target="_blank">element.io/help</a></p>
        </div>
        <div class="support">
          <p>Element wird automatisch installiert und konfiguriert.<br>
          <small>Bei Fragen oder Problemen: <a href="https://element.io/help">Element Support</a></small></p>
        </div>
      </div>
    </body>
    </html>
  # README
  "README-Element-Setup.md": |
    # Element Desktop Setup Scripts
    Automatische Konfiguration und Installation von Element Desktop mit Custom Themes für aXion1337.Chat
    ## 🎨 Verfügbare Themes
    - aXion1337 Dark
    - Deep Purple
    - Discord Dark
    - Electric Blue
    - Everforest dark hard
    - Gruvbox Dark
    - Wal
    ## 🪟 Windows
    Herunterladen: `element-setup-windows.cmd` → Doppelklick
    ## 🍎 macOS
    Herunterladen: `element-setup-macos.command` → Doppelklick im Finder
    ## 🐧 Linux
    ```bash
    chmod +x element-setup-linux.sh
    ./element-setup-linux.sh
    ```
    Support: https://element.io/help
  # Windows Script
  "element-setup-windows.cmd": |
    @echo off
    REM Element Desktop Setup Script for Windows
    setlocal enabledelayedexpansion
    echo ========================================
    echo Element Desktop Konfiguration Setup
    echo ========================================
    echo.
    set APPDATA_PATH=%APPDATA%\Element
    set CONFIG_FILE=%APPDATA_PATH%\config.json
    if not exist "%APPDATA_PATH%" (
        echo Erstelle Element Verzeichnis...
        mkdir "%APPDATA_PATH%"
    )
    echo Erstelle config.json...
    (
        echo {
        echo   "configUrl": "https://axion1337.chat/config.json",
        echo   "brand": "aXion1337.Chat",
        echo   "default_theme": "aXion1337 Dark",
        echo   "show_labs_settings": true,
        echo   "features": {
        echo     "feature_qr_code_login": true
        echo   },
        echo   "setting_defaults": {
        echo     "custom_themes": []
        echo   }
        echo }
    ) > "%CONFIG_FILE%"
    echo Config erstellt: %CONFIG_FILE%
    echo.
    echo Ueberpruefen Sie ob Element Desktop installiert ist...
    where element >nul 2>nul
    if %ERRORLEVEL% == 0 (
        echo Starte Element Desktop...
        start element
        timeout /t 2 >nul
        echo Done!
        pause
        exit /b 0
    )
    winget list --name "Element" >nul 2>nul
    if %ERRORLEVEL% == 0 (
        echo WinGet gefunden. Installiere Element...
        winget install Element.Element --silent
        timeout /t 3 >nul
        start element
        pause
        exit /b 0
    )
    echo.
    echo Element Desktop konnte nicht automatisch installiert werden.
    echo Bitte installiere Element Desktop manuell:
    echo https://element.io/download
    echo.
    pause
  # macOS Script
  "element-setup-macos.command": |
    #!/bin/bash
    echo "========================================"
    echo "Element Desktop Konfiguration Setup"
    echo "========================================"
    echo ""
    CONFIG_DIR="$HOME/Library/Application Support/Element"
    CONFIG_FILE="$CONFIG_DIR/config.json"
    if [ ! -d "$CONFIG_DIR" ]; then
        echo "Erstelle Element Verzeichnis..."
        mkdir -p "$CONFIG_DIR"
    fi
    echo "Erstelle config.json..."
    cat > "$CONFIG_FILE" << 'EOF'
    {
      "configUrl": "https://axion1337.chat/config.json",
      "brand": "aXion1337.Chat",
      "default_theme": "aXion1337 Dark",
      "show_labs_settings": true,
      "features": {
        "feature_qr_code_login": true
      },
      "setting_defaults": {
        "custom_themes": []
      }
    }
    EOF
    echo "Config erstellt: $CONFIG_FILE"
    echo ""
    echo "Ueberpruefen Sie ob Element Desktop installiert ist..."
    if [ -d "/Applications/Element.app" ]; then
        echo "Element im Applications Folder gefunden. Starte Element..."
        open -a Element
        sleep 2
        exit 0
    fi
    if command -v brew &> /dev/null; then
        echo "Installiere Element uber Homebrew..."
        brew install element --cask
        sleep 2
        open -a Element
        exit 0
    else
        echo ""
        echo "Homebrew nicht gefunden. Bitte installiere zuerst:"
        echo "https://brew.sh"
        echo ""
        echo "Deine config.json wurde erstellt unter:"
        echo "$CONFIG_FILE"
        echo ""
    fi
    read -p "Druecke Enter zum Beenden..."
  # Linux Script
  "element-setup-linux.sh": |
    #!/bin/bash
    echo "========================================"
    echo "Element Desktop Konfiguration Setup"
    echo "========================================"
    echo ""
    CONFIG_DIR="$HOME/.config/Element"
    CONFIG_FILE="$CONFIG_DIR/config.json"
    if [ ! -d "$CONFIG_DIR" ]; then
        echo "Erstelle Element Verzeichnis..."
        mkdir -p "$CONFIG_DIR"
    fi
    echo "Erstelle config.json..."
    cat > "$CONFIG_FILE" << 'EOF'
    {
      "configUrl": "https://axion1337.chat/config.json",
      "brand": "aXion1337.Chat",
      "default_theme": "aXion1337 Dark",
      "show_labs_settings": true,
      "features": {
        "feature_qr_code_login": true
      },
      "setting_defaults": {
        "custom_themes": []
      }
    }
    EOF
    echo "Config erstellt: $CONFIG_FILE"
    echo ""
    if command -v apt &> /dev/null; then
        echo "Installiere Element uber apt..."
        sudo apt update && sudo apt install -y element-desktop
        element &
        exit 0
    fi
    if command -v dnf &> /dev/null; then
        echo "Installiere Element uber dnf..."
        sudo dnf install -y element-desktop
        element &
        exit 0
    fi
    if command -v pacman &> /dev/null; then
        echo "Installiere Element uber pacman..."
        sudo pacman -S --noconfirm element-web
        element &
        exit 0
    fi
    echo "Element Desktop konnte nicht automatisch installiert werden."
    echo "Bitte installiere Element Desktop manuell:"
    echo "Ubuntu/Debian: sudo apt install element-desktop"
    echo "Fedora/RHEL: sudo dnf install element-desktop"
    echo "Arch: sudo pacman -S element-web"
    echo ""
    echo "Deine config.json wurde erstellt unter:"
    echo "$CONFIG_FILE"
@@ -0,0 +1,92 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: element-web-docs
  namespace: matrix
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: element-web-docs
  template:
    metadata:
      labels:
        app: element-web-docs
    spec:
      initContainers:
      - name: copy-files
        image: busybox:1.36
        command: ["/bin/sh", "-c"]
        args:
        - |
          mkdir -p /html/docs/setup
          cp /config/index.html /html/docs/setup/
          cp /config/README-Element-Setup.md /html/docs/setup/
          cp /config/element-setup-windows.cmd /html/docs/setup/
          cp /config/element-setup-macos.command /html/docs/setup/
          cp /config/element-setup-linux.sh /html/docs/setup/
          chmod 644 /html/docs/setup/*
        volumeMounts:
        - name: config
          mountPath: /config
        - name: html
          mountPath: /html
      containers:
      - name: nginx
        image: nginx:1.26-alpine
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: nginx-conf
          mountPath: /etc/nginx/conf.d/default.conf
          subPath: nginx.conf
        - name: html
          mountPath: /usr/share/nginx/html
      volumes:
      - name: config
        configMap:
          name: ess-element-web-docs
      - name: nginx-conf
        configMap:
          name: element-web-docs-nginx
      - name: html
        emptyDir: {}
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: element-web-docs
  namespace: matrix
 spec:
  selector:
    app: element-web-docs
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: ClusterIP
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: element-web-docs-nginx
  namespace: matrix
 data:
  nginx.conf: |
    server {
        listen 8080;
        server_name _;
        root /usr/share/nginx/html;
        location /docs/setup/ {
            index index.html;
            try_files $uri $uri/ =404;
        }
        location / {
            return 404;
        }
    }
@@ -1,12 +1,31 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # Patch: Fügt einen Checksum der element-values.yaml zur HelmRelease hinzu
 # Damit wird Flux die HelmRelease neu-synced wenn sich die ConfigMap ändert
 patches:
  - target:
      kind: HelmRelease
      name: matrix-stack
      namespace: matrix
    patch: |-
      - op: add
        path: /metadata/annotations/element-config-checksum
        value: "401f8a87d0ef5d91d2e5032d4aede42c"
 resources:
  - matrix-postgres-auth.yaml
  - cert-issuer.yaml
  - matrix-certificates.yaml
  # Neue Dateien:
  - custom-configs/synapse-values.yaml
  - custom-configs/element-values.yaml
  - custom-configs/mas-secret.yaml
  - element-web-docs-configmap.yaml
  - element-web-docs-server.yaml
  # TURN Server für WebRTC
  - coturn-secret.yaml
  - coturn.yaml
  # HelmRelease (muss ganz unten stehen, damit die ConfigMaps vorher da sind!)
  - element-server-suite.yaml
  # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
@@ -62,3 +62,16 @@ spec:
    kind: ClusterIssuer
  dnsNames:
    - admin.axion1337.chat
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: turn-axion1337-chat-cert
  namespace: matrix
 spec:
  secretName: turn-axion1337-chat-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - turn.axion1337.chat
@@ -0,0 +1,18 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
  name: authentik-apps
  namespace: flux-system
 spec:
  interval: 1m
  path: ./apps/authentik
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  decryption:
    provider: sops
    secretRef:
      name: sops-age
  dependsOn:
    - name: infra-apps
@@ -4,4 +4,6 @@ resources:
  - gotk-components.yaml
  - gotk-sync.yaml
  - infra-sync.yaml
  - monitoring-sync.yaml
  - production-sync.yaml
  - authentik-sync.yaml
@@ -0,0 +1,14 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
  name: monitoring-apps
  namespace: flux-system
 spec:
  interval: 10m
  path: ./apps/monitoring
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  dependsOn:
    - name: infra-apps
@@ -0,0 +1,503 @@
 # aXion1337.Chat – Task List & Meilensteine
 **Last Updated**: 2026-05-14  
 **Statusübersicht**: [✅ 6 Abgeschlossen] [🔄 1 In Progress] [📋 15+ Pending] [🔒 10 Security]
 ---
 ## 📊 Status Summary (Quick View)
 | Kategorie | Count | Status | Details |
 |-----------|-------|--------|---------|
 | **Completed** | 6 | ✅ Done | K3S, Flux, ESS, Themes, Desktop, Monitoring, TURN |
 | **In Progress** | 1 | 🔄 Blocked | Authentik Stage 2 (awaiting manual config) |
 | **Backlog** | 15+ | 📋 Pending | Element Call Fork, DB Backups, NetworkPolicies, etc. |
 | **Security Tasks** | 10 | 🔒 Pending | Firewall, SSH, auditd, Kernel hardening, CrowdSec, Falco |
 ### Priority Distribution
 | Priority | Count | Timeline |
 |----------|-------|----------|
 | 🔴 **CRITICAL** | 3 | This week |
 | 🟠 **HIGH** | 4 | 1–2 weeks |
 | 🟡 **MEDIUM** | 8 | ~1 month |
 | 🟢 **LOW** | 4+ | Nice-to-have |
 ---
 ## 🎯 Next Steps (Priorisiert)
 ### 🔴 **THIS WEEK – CRITICAL**
 1. **Authentik Stage 2 abschließen**
   - Manual: OIDC Provider + Application in Authentik UI erstellen
   - Code: `upstream_oauth2_config` in `mas-secret.yaml` einfügen
   - Code: `passwords: enabled: false` aktivieren
   - Commit: `enable-authentik-oidc-integration-in-mas`
   - Est. Time: 1–2 hours
   - Blocker: Manual Authentik config (user action)
 2. **Hetzner Cloud Firewall – Default-Deny Setup**
   - Ingress: Allow 80/443 only
   - Allow SSH from your IP or via WireGuard/Tailscale
   - Est. Time: 30 min
   - Cost: Free
   - Impact: Blocks 99% of internet background noise
 3. **SSH Hardening**
   - Disable password auth (key-only)
   - Disable root login
   - MaxAuthTries 3
   - Est. Time: 1–2 hours
   - Priority: HIGH
 4. **Database Backup Strategy – Decision & First Backup**
   - Decision: CloudNativePG (on K3S) or Hetzner Postgres (managed)?
   - Setup: Daily automated backups
   - Setup: Off-site storage (S3 / Storage Box)
   - Setup: Monthly verified restores
   - Est. Time: 2–3 days
   - Priority: CRITICAL (disaster recovery)
 ### 🟠 **NEXT 1–2 WEEKS – HIGH**
 1. **Authentik End-to-End Test**
   - Test: Login flow Element → MAS → Authentik → Matrix User
   - Test: Password reset
   - Create: Test invite links
   - Est. Time: 2 hours
 2. **Element Call Fork**
   - Fork: element-hq/element-call
   - Feature: Video/audio constraints parameters
   - Integration: Synapse well-known config
   - Est. Time: 2–3 days
 3. **External PostgreSQL Migration**
   - Decision: CloudNativePG vs. Hetzner Postgres
   - Setup: HA + Replication
   - Migration: Move data from ESS embedded Postgres
   - Testing: Verify all services work
   - Est. Time: 1–2 days
 4. **NetworkPolicies Deployment**
   - Create: Default-Deny for `matrix` namespace
   - Create: Allow rules (Synapse↔Postgres, MAS↔Postgres, Ingress→Web, etc.)
   - Test: Ensure no service breakage
   - Est. Time: 1 day
 ---
 ## ✅ Abgeschlossene Aufgaben (Chronologisch)
 ### Phase 1: Basis-Setup
 - [x] **K3S Cluster aufsetzen** – Single-Node auf Hetzner Cloud (49.13.132.245)
  - Commit: `initial-setup` (vor Projekt)
  - Status: ✅ Läuft
 - [x] **Flux CD Installation**
  - SOPS + age Encryption
  - GitOps Repository konfigurieren
  - Commit: `setup-flux` (vor Projekt)
  - Status: ✅ Läuft
 - [x] **Element Server Suite v26.4.0 Deployment**
  - Synapse Homeserver (`matrix.axion1337.chat`)
  - Matrix Authentication Service (`account.axion1337.chat`)
  - Element Web (`axion1337.chat`)
  - Element Admin (`admin.axion1337.chat`)
  - MatrixRTC/Element Call (`mrtc.axion1337.chat`)
  - Commit: `deploy-ess-matrix-stack`
  - Status: ✅ Running
 ### Phase 2: Core Features
 - [x] **7 Custom Element Web Themes**
  - aXion1337 Dark, Deep Purple, Discord Dark, Electric Blue, Everforest, Gruvbox, Wal
  - Alphabetisch sortiert
  - Commit: `add-custom-element-themes`
  - Status: ✅ Deployed
 - [x] **Element Desktop Setup Scripts** (Windows/macOS/Linux)
  - Auto-Download + Install + Config
  - Hosted auf `axion1337.chat/docs/setup/`
  - Commits: `add-element-desktop-setup-scripts`, `fix-element-setup-script-hosting`
  - Status: ✅ Deployed
 - [x] **Room Policies**
  - Message Retention (1d–1y lifecycle)
  - Room Publication Rules (allow all)
  - Auto-Join Rooms für Onboarding
  - Commit: `add-synapse-retention-publication-autojoin`
  - Status: ✅ Deployed
 ### Phase 3: WebRTC & Medienübertragung
 - [x] **TURN Server (coturn) für Video-Calls**
  - Domain: `turn.axion1337.chat`
  - HMAC-Auth mit Shared Secret
  - Ports: 3478/udp, 3478/tcp, 5349/tcp, 49152-65535/udp
  - Commit: `implement-turn-server-coturn-for-webrtc-video-calls`
  - Status: ✅ Deployed
  - Manual: DNS A-Record + Firewall-Ports öffnen (noch erforderlich)
 ### Phase 4: Monitoring & Observability
 - [x] **Monitoring Stack Integration**
  - Alloy (Grafana Agent) als Collector
  - Remote Write zu Selendis (10.0.0.3:9090 Prometheus, :3100 Loki)
  - kube-state-metrics, node-exporter DaemonSet
  - Commits: `integrate-monitoring-alloy-prometheus-loki`, `fix-prometheus-remote-write-docker`
  - Status: ✅ Deployed
 ### Phase 5: Identity Provider (Authentik)
 - [x] **Authentik Stage 1 Deployment**
  - HelmRelease v2026.x in `authentik` namespace
  - Embedded PostgreSQL + Alloy-compatible
  - Cert-Manager für TLS
  - Commit: `deploy-authentik-as-identity-provider-for-matrix-stage-1`
  - Status: ✅ Deployed
  - Manual: Admin-Passwort setzen + OIDC Provider erstellen (erforderlich)
 🔄 **[IN PROGRESS] Authentik Stage 2 – MAS Integration**
 - [ ] **MAS Upstream OIDC Konfiguration**
  - Client ID/Secret aus Authentik Admin UI kopieren
  - `upstream_oauth2_config` in `mas-secret.yaml` einfügen
  - `passwords: enabled: false`
  - Commit: (pending)
  - Status: ⏳ Wartet auf manuelle Authentik-Konfiguration
 ### Phase 6: Dokumentation
 - [x] **Deployment Guides erstellen**
  - 5 Markdown-Dateien in `docs/deployment-guides/`
  - Chronologisch geordnet
  - Troubleshooting + Best Practices
  - Commit: `add-comprehensive-deployment-configuration-documentation`
  - Status: ✅ Deployed
 ---
 ## 🔄 In Progress / Blocked
 ### Authentik Stage 2 – MAS Integration (⏳ Depends on Manual Config)
 **Beschreibung**: Authentik OIDC Provider muss manuell im Authentik Admin UI konfiguriert werden, bevor Stage 2 Deployment möglich ist.
 **Schritte**:
 1. ✅ Authentik Stage 1 Deployment (done)
 2. ⏳ Authentik Admin UI: OIDC Provider erstellen (MANUAL - user action)
 3. ⏳ Authentik Admin UI: Application mit Slug `matrix` erstellen (MANUAL - user action)
 4. ⏳ Authentik Admin UI: Enrollment Flow mit Invitation Stage (MANUAL - user action)
 5. ⏳ Authentik Admin UI: Client ID + Secret kopieren (MANUAL - user action)
 6. 📋 MAS `upstream_oauth2_config` mit Client Credentials aktualisieren
 7. 📋 `passwords: enabled: false` aktivieren
 8. 📋 Commit + Push
 **Blocker**: Manuelle Authentik-Konfiguration (wartet auf Benutzer)
 ---
 ## 📋 Backlog (Weitere Aufgaben)
 ### Authentik Completion
 - [ ] **Finish Authentik Stage 2 – MAS Integration**
  - Prerequisites: Authentik OIDC Provider vollständig konfiguriert
  - Task: Update `mas-secret.yaml`, enable password login disable
  - Commit: `enable-authentik-oidc-integration-in-mas`
  - Est. Effort: 30 min (manual + scripted)
 - [ ] **Test End-to-End Login Flow**
  - Element Web login → MAS → Authentik → Matrix User Creation
  - Create test users via Authentik
  - Verify password reset flow
  - Commit: (implicit in Stage 2)
  - Est. Effort: 20 min
 - [ ] **Create Invite Links für neue User**
  - Authentik Admin UI → Invitations → Create
  - Set expiry dates (7d) + use limits
  - Document procedure
  - Est. Effort: 15 min
 ### Element Call Enhancement
 - [ ] **Element Call Fork für Custom Constraints**
  - Repository: Fork `element-hq/element-call`
  - Feature: Video/Audio constraints parameter im config
  - Include: Bandwidth limiting, resolution limits, frame rate control
  - Integration mit Synapse well-known
  - Est. Effort: 2–3 days (fork + feature + test)
  - Priority: **HIGH** (user feature)
 ### Database Hardening
 - [ ] **External/Dedicated PostgreSQL Deployment**
  - Option 1: CloudNativePG Operator (open-source, auf K3S)
  - Option 2: Managed Hetzner Postgres
  - Separate aus ESS matrix-stack embedded Postgres
  - HA + Replication
  - Est. Effort: 1–2 days
  - Priority: **HIGH** (reliability)
 - [ ] **Database Backup Strategy**
  - Daily automated backups (PgBackRest oder velero)
  - Off-site backup storage (S3 / Hetzner Storage Box)
  - Monthly verified restores (test restore → verify data integrity)
  - Backup + restore documentation
  - Est. Effort: 2–3 days
  - Priority: **CRITICAL** (disaster recovery)
 - [ ] **Synapse Media PVC Backups**
  - Separate backup pipeline für `/data/media_store` PVC
  - Reason: Media oft >100GB, sollte nicht im DB-Backup sein
  - Velero + Restic für block-level backup
  - Est. Effort: 1 day
  - Priority: **HIGH** (data preservation)
 ### Network Security
 - [ ] **NetworkPolicies – K8s-Layer Segmentation**
  - Default-Deny Ingress für `matrix` namespace
  - Allow rules:
    - Ingress → MAS:443
    - Ingress → ElementWeb:443
    - MAS ↔ Synapse:8008
    - Synapse ↔ Postgres:5432
    - Authentik → Postgres:5432
    - Authentik → Loki:3100 (monitoring)
  - Egress: Matrix-specific (federation, etc.)
  - Est. Effort: 1 day
  - Priority: **MEDIUM** (compliance, least-privilege)
 - [ ] **Pod Security Admission (Restricted)**
  - Apply to `matrix` & `authentik` namespaces
  - Enforce: non-root, no privileged, read-only root fs
  - Test: Ensure no chart breakage
  - Est. Effort: 1 day
  - Priority: **MEDIUM** (hardening)
 ### Federation & Access Control
 - [ ] **Federation-Allowlist oder Closed Federation**
  - Decision: Which servers to federate with?
  - If allowlist: explicit `federation_domain_whitelist`
  - If closed: `allow_public_rooms_without_join_rules: false`
  - Synapse config in `synapse-values.yaml`
  - Est. Effort: 4 hours
  - Priority: **MEDIUM** (security policy)
 ### Moderation & Anti-Abuse
 - [ ] **Mjolnir/Draupnir Bot Deployment**
  - Open-source moderation bot für Matrix
  - Reason: Invitation-based, aber Federation kann Spam bringen
  - Auto-ban known bad servers/users
  - Spam-detection rules
  - HelmChart oder custom Deployment
  - Est. Effort: 1–2 days
  - Priority: **MEDIUM** (ops safety)
 - [ ] **Content Scanner for Media**
  - matrix-content-scanner + ClamAV antivirus
  - Scan uploaded media for malware
  - Block suspicious files
  - Est. Effort: 1–2 days
  - Priority: **LOW–MEDIUM** (optional but good practice)
 ### Secrets Management
 - [ ] **External-Secrets Operator oder SOPS für Flux**
  - Current: SOPS with age encryption
  - Consideration: External-Secrets for cloud-native (AWS Secrets Manager, Hetzner Vault, etc.)
  - OR: Improve SOPS rotation strategy
  - Decision needed: Keep SOPS or upgrade?
  - Est. Effort: 2–3 days (if switching)
  - Priority: **LOW** (current SOPS setup working)
 ### Image & Dependency Management
 - [ ] **Renovate / Dependabot Setup**
  - Auto-update Helm Chart versions
  - Auto-update Container Image Tags
  - Monitor for security patches
  - Est. Effort: 4 hours
  - Priority: **MEDIUM** (maintenance)
 - [ ] **Trivy Image Scanning**
  - Scan images in Flux HelmReleases for CVEs
  - Block deployment if critical CVE found
  - CI/CD hook in git workflow
  - Est. Effort: 8 hours
  - Priority: **LOW–MEDIUM** (security posture)
 - [ ] **Monitor ESS & Element Security Advisories**
  - Subscribe to `element-hq` security mailing list
  - Monitor `#matrix-community` security channels
  - Auto-alerts on new CVEs/patches
  - Est. Effort: Ongoing (low maintenance)
  - Priority: **MEDIUM** (security awareness)
 ### Container Security
 - [ ] **Disable automountServiceAccountToken Everywhere**
  - Audit all Deployments/StatefulSets
  - Disable for: Synapse, ElementWeb, MAS, Postgres, Authentik (where not needed)
  - Add `automountServiceAccountToken: false` to spec.template.spec
  - Test: Ensure no breakage
  - Est. Effort: 4 hours
  - Priority: **MEDIUM** (least-privilege)
 ---
 ## 🔒 Security Hardening (Host & Cluster Level)
 ### Host OS Layer (Ubuntu/Debian)
 - [ ] **Hetzner Cloud Firewall**
  - Default-Deny inbound
  - Allow: 80/443 (HTTP/HTTPS)
  - Allow: 22 (SSH) from your IP only (or via WireGuard/Tailscale)
  - Status: ✅ Can be done in Hetzner UI
  - Est. Effort: 30 min
  - Priority: **CRITICAL** (immediate, zero config cost)
 - [ ] **SSH Hardening**
  - Disable password auth (key-only)
  - Disable root login
  - PermitRootLogin: no
  - PasswordAuthentication: no
  - MaxAuthTries: 3
  - Optional: Change SSH port (cosmetic, reduces log noise)
  - Optional: SSH hinter WireGuard/Tailscale (eliminates fail2ban für SSH)
  - Est. Effort: 2 hours
  - Priority: **HIGH** (immediate)
 - [ ] **unattended-upgrades**
  - Enable automatic security updates
  - Configure: APT::Periodic::Update-Package-Lists "1";
  - Configure: APT::Periodic::Unattended-Upgrade "1";
  - Configure: APT::Periodic::AutocleanInterval "7";
  - Est. Effort: 30 min
  - Priority: **HIGH** (set & forget)
 - [ ] **K3S API Security**
  - Current: K3S API listening on :6443 on all interfaces (default)
  - Hardening:
    - Option 1: Firewall restrict :6443 to localhost only
    - Option 2: K3S --bind-address + --advertise-address to WireGuard IP
    - Option 3: kubectl access only via jumphost/bastion
  - Est. Effort: 2 hours
  - Priority: **HIGH** (API is high-value target)
 - [ ] **auditd for File Integrity & Syscall Audit**
  - Monitor: /etc, ~/.kube, /var/lib/rancher/k3s
  - Audit rules für sensitive file changes
  - Low overhead, good signal/noise ratio
  - Output to syslog / centralized logging
  - Est. Effort: 2 hours
  - Priority: **MEDIUM** (forensics + compliance)
 - [ ] **Kernel Hardening (sysctl)**
  - Apply hardening recommendations from Lynis
  - Key settings:
    - kernel.kptr_restrict=2 (hide kernel pointers)
    - kernel.dmesg_restrict=1 (restrict dmesg)
    - net.ipv4.tcp_syncookies=1 (SYN flood protection)
    - net.ipv4.conf.all.rp_filter=1 (reverse path filtering)
    - net.ipv4.conf.all.send_redirects=0
    - net.ipv6.conf.all.disable_ipv6=0 (or =1 if no IPv6 needed)
  - Persist via /etc/sysctl.d/99-hardening.conf
  - Est. Effort: 2 hours
  - Priority: **MEDIUM** (defense in depth)
 - [ ] **Lynis Security Baseline**
  - Run `lynis audit system`
  - Review recommendations
  - Implement high-priority findings
  - Aim for score >80
  - Re-run quarterly
  - Est. Effort: 4 hours (initial) + 1 hour quarterly
  - Priority: **MEDIUM** (baseline verification)
 ### Cluster Layer (K3S / Kubernetes)
 - [ ] **CrowdSec Integration**
  - Install CrowdSec agent on host
  - Connect to CrowdSec Hub (commercial platform, free tier available)
  - Feed auth.log, syslog → CrowdSec for attack detection
  - Auto-block IPs via local firewall or Hetzner Firewall API
  - Est. Effort: 4 hours
  - Priority: **MEDIUM** (proactive threat response)
 - [ ] **Falco Runtime Monitoring**
  - Install Falco DaemonSet in K3S
  - Monitor: Shell spawning in containers, suspicious syscalls, privilege escalation
  - Output to Loki / syslog
  - Alert on anomalies
  - Est. Effort: 1 day
  - Priority: **MEDIUM** (runtime detection)
 ---
 ## 🎯 Meilensteine (Milestones)
 | Meilenstein | Beschreibung | Status | ETA |
 |------------|-------------|--------|-----|
 | **M1: Basis-Setup** | K3S + Flux + ESS deployed | ✅ Done | - |
 | **M2: Core Matrix** | Themes, Scripts, Policies | ✅ Done | - |
 | **M3: WebRTC & Monitoring** | TURN + Alloy/Prometheus/Loki | ✅ Done | - |
 | **M4: Identity Provider** | Authentik Stage 1+2 (pending Stage 2) | 🔄 In Progress | ~1–2 days |
 | **M5: Production-Ready** | DB Backups, NetworkPolicies, Security Hardening | 📋 Backlog | ~2–3 weeks |
 | **M6: Advanced Features** | Element Call Fork, Content Scanner, Mjolnir | 📋 Backlog | ~4+ weeks |
 | **M7: Enterprise-Ready** | Full compliance (DSGVO), HA setup, Disaster Recovery | 🎯 Future | ~8+ weeks |
 ---
 ## 📊 Prioritäts-Kategorien
 ### 🔴 CRITICAL (do immediately)
 - Hetzner Cloud Firewall setup
 - Database backup strategy
 - SSH hardening
 ### 🟠 HIGH (do within 1–2 weeks)
 - Authentik Stage 2 completion
 - External PostgreSQL migration
 - NetworkPolicies
 - Element Call fork
 ### 🟡 MEDIUM (do within 1 month)
 - CrowdSec + Falco
 - Mjolnir bot
 - Renovate/Trivy
 - PSA restricted mode
 - Kernel hardening
 ### 🟢 LOW (nice-to-have, do if time allows)
 - Content scanner (ClamAV)
 - External-Secrets upgrade
 - SSH port relocation
 - Advanced federation rules
 ---
 ## 📝 Notes & Decision Points
 ### Authentik Stage 2 Blocker
 ⏳ **Waiting for**: User to manually configure Authentik OIDC Provider in Authentik Admin UI.
 - Once done, provide Client ID + Secret
 - Then: Commit Stage 2 MAS config
 ### Database: CloudNativePG vs. Hetzner Postgres
 - **CloudNativePG**: Open-source, runs on K3S, full control
 - **Hetzner Postgres**: Managed, backups included, less ops overhead
 - **Decision**: Recommend CloudNativePG for now (cost-effective), migrate to Hetzner later if operational overhead too high
 ### Federation: Allowlist vs. Closed?
 - **Allowlist**: Default federation with all public servers, can be attacked
 - **Closed**: Only federate with trusted servers (higher security, lower interop)
 - **Decision**: Depends on user intent. For now: allow all, add Mjolnir for abuse protection
 ### Security Framework
 - **Layers**: Perimeter (Firewall) → Host (SSH, auditd, hardening) → Cluster (NetworkPolicies, PSA, Falco) → App (Rate-limits, Mjolnir)
 - **Approach**: Implement incrementally, test after each layer
 ---
 ## 🔗 Related Documentation
 - `docs/deployment-guides/README.md` – Overview
 - `docs/deployment-guides/01-turn-server-setup.md` – TURN
 - `docs/deployment-guides/02-authentik-identity-provider.md` – Authentik (Stage 1 + Stage 2 plan)
 - `docs/deployment-guides/03-monitoring-integration.md` – Monitoring
 - `docs/deployment-guides/04-element-customization.md` – Themes, Desktop
 - `docs/deployment-guides/05-room-policies.md` – Policies
 ---
 **Last Updated**: 2026-05-14  
 **Next Review**: 2026-05-21
@@ -0,0 +1,54 @@
 # TURN Server (coturn) für WebRTC Video-Calls
 **Status**: ✅ Vollständig deployed  
 **Domain**: `turn.axion1337.chat`  
 **Public IP**: `49.13.132.245`
 ## Problem & Lösung
 Videocalls scheitern mit DTLS-Timeout bei Clients hinter NAT/Firewall. **Lösung**: coturn als TURN-Relay.
 ## Architektur
 Client A ──→ coturn (turn.axion1337.chat) ──→ Client B
 - **Ports**: 3478/udp, 3478/tcp, 5349/tcp, 49152-65535/udp
 - **Auth**: HMAC-basiert mit Shared Secret zwischen coturn + Synapse
 - **Deployment**: K3S Deployment mit `hostNetwork: true`
 ## Dateien (in `apps/production/`)
 | Datei | Inhalt |
 |-------|--------|
 | `coturn.yaml` | ConfigMap + Deployment + Service |
 | `coturn-secret.yaml` | SOPS-Secret: `TURN_SECRET` |
 | `custom-configs/synapse-values.yaml` | TURN URIs + shared secret |
 | `matrix-certificates.yaml` | cert-manager Cert für `turn.axion1337.chat` |
 ## DNS & Firewall (manuell)
 ```
 DNS A-Record: turn.axion1337.chat → 49.13.132.245
 Firewall (K3S Host):
 ufw allow 3478/udp
 ufw allow 3478/tcp
 ufw allow 5349/tcp
 ufw allow 49152:65535/udp
 ```
 ## Verifikation
 ```bash
 # Pod läuft?
 kubectl get pods -n matrix -l app=coturn
 # Certificate ready?
 kubectl get certificate -n matrix | grep turn
 # Extern testen
 docker run -it instrumentisto/coturn \
  turnutils_uclient -v -T -u test -w test turn.axion1337.chat
 ```
 **Weitere Details**: Siehe vollständige Dokumentation oben.
@@ -0,0 +1,45 @@
 # Authentik als Identity Provider für Matrix
 **Status**: ✅ Stage 1 Deployed (Authentik läuft)  
 **Pending**: Stage 2 (MAS Integration)  
 **Domain**: `auth.axion1337.chat`
 ## Überblick
 Authentik = OIDC Provider für MAS → Zentrales Login + Einladungs-basierte Registrierung.
 ## Stage 1: Authentik Deployment
 **Dateien** (in `apps/authentik/`):
 - `namespace.yaml`, `helm-repo.yaml`, `authentik-secret.yaml` (SOPS)
 - `authentik.yaml` (HelmRelease v2026.x + embedded Postgres)
 - `certificate.yaml`, `ingress.yaml`
 **Flux Kustomization**: `clusters/matrix/flux-system/authentik-sync.yaml`
 ## Deployment-Schritte
 1. **DNS A-Record**: `auth.axion1337.chat → 49.13.132.245`
 2. **Pods hochfahren**: `kubectl get pods -n authentik -w`
 3. **Authentik UI**: `https://auth.axion1337.chat/if/flow/initial-setup/` → Admin-Passwort setzen
 4. **OIDC Provider**: Admin UI → OIDC Provider erstellen
 5. **Application**: Slug `matrix` (wichtig für Issuer URL!)
 6. **Redirect URIs**:
   - `https://account.axion1337.chat/upstream/callback/01KQDJTR1ZVTG8JQ220F5BNBFZ`
   - Post-logout: `https://axion1337.chat`
 7. **Client ID + Secret kopieren**
 ## Stage 2: MAS Integration
 1. Decrypt: `sops --decrypt --in-place apps/production/custom-configs/mas-secret.yaml`
 2. `upstream_oauth2_config` + `passwords-config` Blöcke hinzufügen
 3. Encrypt: `sops --encrypt --in-place ...`
 4. Commit & Push
 5. **WICHTIG**: `passwords: enabled: false` erst nach OIDC-Test!
 ## Einladungs-Links
 Authentik Admin → Flows & Stages → Invitations → Create
 ---
 **Weitere Details**: Siehe Kapitel 2 in diesem Projekt.
@@ -0,0 +1,52 @@
 # Monitoring: Alloy → Prometheus/Loki auf Selendis
 **Status**: ✅ Vollständig deployed  
 **Remote Storage**: `10.0.0.3:9090` (Prometheus), `10.0.0.3:3100` (Loki)
 ## Überblick
 Alloy (Grafana Agent) sammelt Metriken & Logs vom K3S-Cluster und schickt sie zu Prometheus/Loki auf Selendis.
 ## Komponenten
 | Komponente | Rolle |
 |-----------|-------|
 | **Alloy** | Metrics & Logs Collector |
 | **kube-state-metrics** | Kubernetes Object Status |
 | **node-exporter** | Host Metrics (CPU, Memory, Disk) |
 | **Prometheus** (Selendis) | Metrics Ingestion |
 | **Loki** (Selendis) | Logs Ingestion |
 ## Dateien (in `apps/monitoring/`)
 - `namespace.yaml`
 - `helm-repos.yaml` (prometheus-community, grafana)
 - `kube-state-metrics.yaml`, `node-exporter.yaml`
 - `alloy-config.yaml` (River config with scrape targets + remote write)
 - `alloy.yaml` (HelmRelease)
 ## Scrape Targets
 Alloy scraped:
 - **Flux Controllers** (flux-system ns, port 8080)
 - **kube-state-metrics** (monitoring:8080)
 - **node-exporter** (monitoring:9100)
 - **Synapse** (matrix.axion1337.chat:9000)
 Alle Remote Write zu `10.0.0.3:9090` (Prometheus) + `10.0.0.3:3100` (Loki).
 ## Troubleshooting
 ```bash
 # Check Alloy Logs
 kubectl logs -n monitoring -l app.kubernetes.io/name=alloy
 # Check Prometheus remote write
 curl http://10.0.0.3:9090/api/v1/query?query=up
 # Loki test
 curl -s http://10.0.0.3:3100/loki/api/v1/query_range?query=%7B%7D | jq .
 ```
 ---
 **Weitere Details**: Siehe Kapitel 3.
@@ -0,0 +1,57 @@
 # Element Web Customization: Themes, Desktop-Apps, Admin
 **Status**: ✅ Vollständig deployed  
 **Domains**: `axion1337.chat` (Web), `/docs/setup` (Scripts)
 ## 1. Custom Themes (7 Stück)
 | Theme | Primärfarbe |
 |-------|-----------|
 | aXion1337 Dark | `#1a1a1a` |
 | Deep Purple | `#6a4c93` |
 | Discord Dark | `#2c2f33` |
 | Electric Blue | `#0066ff` |
 | Everforest Dark Hard | `#1e2326` |
 | Gruvbox Dark | `#282828` |
 | Wal | `#1e1e1e` |
 **Konfiguration**: `apps/production/custom-configs/element-values.yaml`
 **Anwendung (User)**: Settings → Appearance → Colour theme
 ## 2. Desktop-Setup-Scripts
 | System | Datei |
 |--------|-------|
 | Windows | `element-setup-windows.cmd` (Doppelklick) |
 | macOS | `element-setup-macos.command` (Doppelklick) |
 | Linux | `element-setup-linux.sh` (bash) |
 **Was die Scripts tun**:
 1. config.json erstellen mit `configUrl: "https://axion1337.chat/config.json"`
 2. Element installieren (WinGet / Homebrew / apt/dnf/pacman)
 3. Element starten (auto-config laden)
 **Download**: `https://axion1337.chat/docs/setup/`
 ## 3. Element Admin-Panel
 **URL**: `https://admin.axion1337.chat`
 - User verwalten
 - Room durchsuchen
 - Server-Statistiken
 **Konfiguration**: `apps/production/element-server-suite.yaml` (ESS Chart)
 ## Dateien
 | Datei | Ort |
 |-------|-----|
 | Custom Themes | `element-values.yaml` ConfigMap |
 | Setup-Scripts | `element-web-docs-configmap.yaml` |
 | Docs Server | `element-web-docs-server.yaml` (nginx) |
 | Ingress | `apex-ingress.yaml` (`/docs/setup/` route) |
 ---
 **Weitere Details**: Siehe Kapitel 4.
@@ -0,0 +1,82 @@
 # Room Policies: Retention, Publication, Auto-Join
 **Status**: ✅ Vollständig deployed  
 **Konfiguration**: `apps/production/custom-configs/synapse-values.yaml`
 ## 1. Message Retention
 Alte Nachrichten automatisch löschen (Speicher sparen, DSGVO).
 ```yaml
 retention:
  enabled: true
  default_policy:
    min_lifetime: 1d      # Messages bleiben ≥1d
    max_lifetime: 1y      # Messages gelöscht nach 1 Jahr
 media_retention:
  local_media_lifetime: 365d      # 1 Jahr
  remote_media_lifetime: 90d      # 90 Tage
 redaction_retention_period: 7d    # Gelöschte Messages noch 7d sichtbar
 ```
 ## 2. Room Publication Rules
 Kontrollieren welche Rooms im öffentlichen Directory sichtbar sind.
 ```yaml
 room_list_publication_rules:
  - user_id: "*"           # Alle User
    action: allow          # dürfen ihre Rooms publishen
 ```
 **Alternativ (restrictiv)**: Nur Admins publishen
 ```yaml
 room_list_publication_rules:
  - user_id: "@admin:axion1337.chat"
    action: allow
  - user_id: "*"
    action: deny
 ```
 ## 3. Auto-Join Rooms
 Neue User automatisch in bestimmte Rooms hinzufügen (Onboarding).
 ```yaml
 auto_join_rooms:
  - "!announcements:axion1337.chat"
  - "!rules:axion1337.chat"
 auto_join_rooms_for_guests: false    # Nur registered users
 ```
 **Room ID finden**: Element Settings → Advanced → Room ID
 ## Deployment
 ```bash
 # Edit ConfigMap
 kubectl apply -f apps/production/custom-configs/synapse-values.yaml
 # Synapse neustarten
 kubectl rollout restart deployment -n matrix matrix-stack-synapse
 # Verify
 kubectl logs -n matrix -l app.kubernetes.io/name=synapse | grep -i "retention\|publication"
 ```
 ## Best Practices
 **Privater Server**:
 - max_lifetime: 1y (großzügig)
 - action: allow (alle publishen)
 - auto_join_rooms: announcements + rules
 **Öffentlicher Server (DSGWR)**:
 - max_lifetime: 90d (kurz)
 - action: deny (nur Admins)
 - auto_join_rooms: [] (keine Zwangs-Rooms)
 ---
 **Weitere Details**: Siehe Kapitel 5.
@@ -0,0 +1,92 @@
 # aXion1337.Chat – Deployment & Konfiguration Dokumentation
 Diese Dokumentation beschreibt die Einrichtung und Konfiguration des Matrix-Homeservers für **axion1337.chat** mit Element Server Suite (ESS) v26.4.0 auf K3S mit Flux CD GitOps.
 ## 📋 Übersicht Deployment-Reihenfolge
 Die Implementierungen wurden in dieser Reihenfolge durchgeführt. Für neue Setups sollten Sie dieser Abfolge folgen:
 | # | Titel | Datei | Status | Zieldomäne |
 |---|-------|-------|--------|-----------|
 | 1 | TURN Server für WebRTC Video-Calls | `01-turn-server-setup.md` | ✅ Deployed | `turn.axion1337.chat` |
 | 2 | Authentik als Identity Provider | `02-authentik-identity-provider.md` | ✅ Stage 1 Deployed | `auth.axion1337.chat` |
 | 3 | Monitoring mit Alloy/Prometheus/Loki | `03-monitoring-integration.md` | ✅ Deployed | lokal (10.0.0.3) |
 | 4 | Element Web Anpassung & Desktop-Apps | `04-element-customization.md` | ✅ Deployed | `axion1337.chat` |
 | 5 | Room Policies (Retention, Publication, Auto-Join) | `05-room-policies.md` | ✅ Deployed | Matrix Synapse |
 ---
 ## 🚀 Quick Start für neue Deployment
 Siehe die einzelnen Dokumentationen für detaillierte Anleitung.
 ---
 ## 🏗️ Architektur-Übersicht
 ```
 ┌─────────────────────────────────────────────────────────────┐
 │                     Element Web (Apex)                       │
 │                   axion1337.chat (HTTP/TLS)                  │
 └──────────────────────┬──────────────────────────────────────┘
                       │
         ┌─────────────┼─────────────┐
         │             │             │
    ┌────▼────┐  ┌─────▼──────┐  ┌──▼────────┐
    │ MAS      │  │ Well-Known │  │Docs/Setup │
    │account.  │  │matrix/*    │  │/setup     │
    │axion1337 │  │            │  │           │
    └────┬────┘  └────────────┘  └───────────┘
         │
    ┌────▼────────────────┐
    │ Authentik OIDC       │
    │ auth.axion1337.chat  │
    │ (Identity Provider)  │
    └─────────────────────┘
         │
    ┌────▼────────────────┐
    │ Synapse Matrix       │
    │ matrix.axion1337.chat│
    │ (Homeserver)         │
    └──────────────────────┘
 ```
 ---
 ## 🔑 Kritische Werte & Konfigurationen
 ### Domains
 - **Apex**: `axion1337.chat` (Element Web)
 - **Matrix Synapse**: `matrix.axion1337.chat`
 - **MAS**: `account.axion1337.chat`
 - **Authentik**: `auth.axion1337.chat`
 - **TURN Server**: `turn.axion1337.chat`
 ### Externe Services
 - **K3S Host IP**: `49.13.132.245`
 - **Monitoring Host**: `10.0.0.3` (Selendis)
 ---
 ## 📚 Dokumente im Detail
 ### [01-turn-server-setup.md](01-turn-server-setup.md)
 STUN/TURN Server für WebRTC Media Relay (Video-Calls).
 ### [02-authentik-identity-provider.md](02-authentik-identity-provider.md)
 Authentik als OIDC Provider für Matrix. Registrierung via Einladungs-Links.
 ### [03-monitoring-integration.md](03-monitoring-integration.md)
 Alloy → Prometheus/Loki Monitoring Integration.
 ### [04-element-customization.md](04-element-customization.md)
 Custom Themes, Desktop-Setup-Scripts, Element Admin.
 ### [05-room-policies.md](05-room-policies.md)
 Message Retention, Room Publication, Auto-Join Policies.
 ---
 ## 🛠️ Wartung & Troubleshooting
 Alle Dokumentationen enthalten Troubleshooting-Sektionen für häufige Probleme.
@@ -0,0 +1,296 @@
 # 🔄 GitOps ConfigMap Auto-Sync via Checksums
 Dieses Dokument erklärt ein Kernproblem mit **Flux CD** und **externe Konfigurationen** – und wie wir es gelöst haben.
 ---
 ## 📋 Das Problem: Flux erkennt ConfigMap-Änderungen nicht
 ### Die Situation
 Unsere HelmRelease (`element-server-suite.yaml`) nutzt `valuesFrom`, um Konfigurationen aus externen **ConfigMaps** zu laden:
 ```yaml
 spec:
  valuesFrom:
    - kind: ConfigMap
      name: ess-element-custom     # ← Diese ConfigMap
      valuesKey: values.yaml
    - kind: ConfigMap
      name: ess-synapse-custom     # ← Diese ConfigMap
      valuesKey: values.yaml
 ```
 Diese ConfigMaps entstehen aus Dateien im Git-Repo (`apps/production/custom-configs/*.yaml`) und werden von Kustomize in den Cluster deployed.
 ### Das Kernproblem
 **Flux CD reagiert NICHT automatisch, wenn sich eine ConfigMap ändert.**
 Warum? Flux überwacht nur das Git-Repository auf Änderungen. Wenn du `element-values.yaml` änderst:
 1. ✅ Flux sieht die Änderung im Git-Repo
 2. ✅ Kustomize erzeugt eine neue ConfigMap mit den neuen Werten
 3. ❌ Aber Helm (der Helm-Controller in Flux) erkennt **nicht**, dass sich die externe ConfigMap geändert hat
 4. ❌ Helm deployt das Chart nicht neu → Die alten Themes/Configs bleiben aktiv
 Das ist kein Bug, sondern by-design: Helm achtet nur auf:
 - Chart-Version (z.B. `26.4.0`)
 - Änderungen in den direkten `values:` Blöcken
 - Nicht auf externe Quellen wie ConfigMaps
 ---
 ## 🔑 Die Lösung: Checksums als Trigger
 Wir nutzen **Annotations mit Checksums** als Workaround:
 ```yaml
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  annotations:
    element-config-checksum: "401f8a87d0ef5d91d2e5032d4aede42c"  # ← Hash der element-values.yaml
    synapse-config-checksum: "e98fe81141f52e7ea833596ca39853b9"  # ← Hash der synapse-values.yaml
 ```
 Wenn sich der Annotation-Wert ändert, sieht Flux, dass die **HelmRelease selbst** sich geändert hat – und deployt neu.
 ### Automatisierung via Git Pre-Commit Hook
 Das Problem: Wer aktualisiert die Checksums, wenn man `element-values.yaml` editiert?
 **Lösung:** Ein Git **pre-commit Hook** tut das automatisch:
 ```bash
 $ vi apps/production/custom-configs/element-values.yaml
 # (Farbe ändern, Theme hinzufügen, …)
 $ git add apps/production/custom-configs/element-values.yaml
 $ git commit -m "feat: new theme"
 # ← Der Hook läuft jetzt:
 #   1. Berechnet MD5-Hash der neuen element-values.yaml
 #   2. Aktualisiert die Annotation in kustomization.yaml
 #   3. Added kustomization.yaml zum Commit automatisch
 ```
 Der User muss **nichts Zusätzliches tun** – alles läuft automatisch.
 ---
 ## 🚀 Installation
 Nach dem Repository **klonen**, führe dieses Skript aus:
 ```bash
 cd prod/gitops
 ./scripts/install-hooks.sh
 ```
 Das Skript:
 - ✅ Erstellt einen Symlink `.git/hooks/pre-commit` → `scripts/hooks/pre-commit`
 - ✅ Macht die Hook-Datei ausführbar
 - ✅ Gibt dir eine Bestätigungsmeldung
 **Einmalig pro lokales Repository.** Neue Klone müssen den Hook auch installieren.
 ---
 ## 📝 Workflow: ConfigMaps ändern
 So sieht die Praxis aus:
 ### 1️⃣ Änderung machen
 ```bash
 vi apps/production/custom-configs/element-values.yaml
 # Edit: Themes, Farben, Logging-Level, etc.
 ```
 ### 2️⃣ Committen (Hook läuft automatisch)
 ```bash
 git add apps/production/custom-configs/element-values.yaml
 git commit -m "feat: add Dark Purple theme variant"
 # Pre-Commit Hook läuft automatisch:
 # → Berechnet neuen Hash
 # → Updated kustomization.yaml
 # → Added kustomization.yaml zum Commit
 ```
 ### 3️⃣ Überprüfung (optional)
 ```bash
 # Schaue, was committet wird:
 git show --stat
 # Output sollte zeigen:
 #   element-values.yaml (modified)
 #   kustomization.yaml (modified) ← vom Hook hinzugefügt
 ```
 ### 4️⃣ Pushen & Deployen
 ```bash
 git push
 # ← Flux sieht die Änderung an kustomization.yaml
 # ← HelmRelease wird neu-synced mit den neuen Checksums
 # ← Die neue Config ist in ~5 Minuten aktiv
 ```
 ---
 ## 🔧 Technische Details
 ### Welche Dateien sind "überwacht"?
 Der Hook beobachtet:
 | Datei | Annotation | Ziel |
 |-------|-----------|------|
 | `apps/production/custom-configs/element-values.yaml` | `element-config-checksum` | Element Web Themes, Branding |
 | `apps/production/custom-configs/synapse-values.yaml` | `synapse-config-checksum` | Synapse Logging, Federation |
 ### Hook-Implementation
 Der Hook (`scripts/hooks/pre-commit`) macht folgendes:
 1. Prüft, ob eine der überwachten Dateien geändert wurde (`git diff --cached`)
 2. Berechnet den MD5-Hash der Datei (kompatibel mit macOS/Linux)
 3. Ersetzt den Hash-Wert in `apps/production/kustomization.yaml` via `sed`
 4. Added `kustomization.yaml` automatisch zum Commit mit `git add`
 ```bash
 # Beispiel: element-values.yaml ändert sich von
 value: "401f8a87d0ef5d91d2e5032d4aede42c" # element-config
 # zu
 value: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" # element-config
 ```
 ---
 ## ⚠️ Häufige Fragen
 ### F: Was passiert, wenn der Hook fehlschlägt?
 A: Der Commit wird **abgebrochen**. Du siehst eine Fehlermeldung. Typische Gründe:
 - `md5` oder `md5sum` nicht installiert (sehr unwahrscheinlich)
 - `sed` Syntax-Fehler (sehr selten)
 Lass dich nicht entmutigen – rufe denen auf, die das Setup machen 🚀
 ### F: Kann ich den Hook deaktivieren?
 A: Ja, aber bitte nicht! Wenn du temporär ohne Hook arbeiten möchtest:
 ```bash
 git commit --no-verify
 ```
 Das umgeht den Hook einmalig. Danach musst du die Checksums manuell aktualisieren.
 ### F: Der Hook touched `kustomization.yaml`, obwohl ich sie nicht editiert habe?
 A: Das ist **Absicht**. Der Hook updated **nur** die Checksums, nicht den Rest der Datei. Das ist sauber und Git-freundlich.
 ### F: Was wenn ich mehrere ConfigMaps gleichzeitig ändere?
 A: Der Hook aktualisiert **alle** deren Checksums in einem Pass. Keine Probleme.
 ---
 ## 🧪 Verifikation: Hook funktioniert?
 Teste es selbst:
 ```bash
 # 1. Hook installieren
 ./scripts/install-hooks.sh
 # 2. Eine Teständerung machen
 echo "# Test" >> apps/production/custom-configs/element-values.yaml
 # 3. Committen
 git add apps/production/custom-configs/element-values.yaml
 git commit -m "test: verify hook"
 # 4. Überprüfung: Wurde kustomization.yaml auto-updated?
 git diff HEAD~1 apps/production/kustomization.yaml | grep -i checksum
 # Output sollte zeigen, dass ein Checksum sich geändert hat
 ```
 Wenn ja → Hook funktioniert! ✅  
 Wenn nein → Rufe uns an 📞
 ---
 ## 📚 Zusammenhang mit Flux CD
 ```
 ┌─────────────────────────────────────────────────────────────┐
 │ Git Repository (axion1337.chat-gitops)                      │
 ├─────────────────────────────────────────────────────────────┤
 │                                                              │
 │  apps/production/custom-configs/                            │
 │  ├── element-values.yaml (du änderst das)                   │
 │  ├── synapse-values.yaml                                    │
 │  └── mas-secret.yaml                                        │
 │                                                              │
 │  apps/production/                                           │
 │  └── kustomization.yaml (Hook updated die Checksums hier)   │
 │                                                              │
 │  apps/production/                                           │
 │  └── element-server-suite.yaml (HelmRelease mit Annotations)│
 │                                                              │
 └─────────────────────────────────────────────────────────────┘
                            ↓ git push
 ┌─────────────────────────────────────────────────────────────┐
 │ FluxCD im Kubernetes-Cluster                                │
 ├─────────────────────────────────────────────────────────────┤
 │                                                              │
 │ 1. GitRepository Source                                     │
 │    └─ Fetcht dein Repo alle 10 Minuten                      │
 │                                                              │
 │ 2. Kustomization production-apps                            │
 │    └─ Applyt die Kustomize-Overlays                         │
 │    └─ Erzeugt ConfigMaps mit neuen Werten                   │
 │                                                              │
 │ 3. HelmRelease matrix-stack                                 │
 │    └─ Sieht neue Annotations (Checksums)                    │
 │    └─ Deployt Helm-Chart mit neuen Werten                   │
 │                                                              │
 │ 4. Element Web Pods                                         │
 │    └─ Restarten automatisch                                 │
 │    └─ Laden neue Config aus der ConfigMap                   │
 │                                                              │
 └─────────────────────────────────────────────────────────────┘
 ```
 ---
 ## 🚨 Notfall: Manuelle Checksum-Aktualisierung
 Falls der Hook ausfällt (z.B. weil Git Hooks in CI deaktiviert sind), kannst du Checksums manuell aktualisieren:
 ```bash
 # 1. Neuen Hash berechnen
 md5sum apps/production/custom-configs/element-values.yaml
 # Output: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6  apps/production/custom-configs/element-values.yaml
 # 2. Annotation in kustomization.yaml updaten
 vi apps/production/kustomization.yaml
 # Ändere: value: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" # element-config
 # 3. Committen
 git add apps/production/kustomization.yaml
 git commit -m "fix: manual checksum update"
 git push
 ```
 ---
 **Version:** 1.0  
 **Letztes Update:** 2026-05-14  
 **Kompatibilität:** FluxCD 2.x, Kustomize 5.x+
@@ -0,0 +1,206 @@
 # Element Desktop Setup Scripts
 Automatische Konfiguration und Installation von Element Desktop mit Custom Themes für aXion1337.Chat
 ## 📋 Systemanforderungen
 - **Windows 10/11**
 - **macOS 10.13+**
 - **Linux** (Ubuntu, Debian, Fedora, Arch, openSUSE, etc.)
 ---
 ## 🪟 Windows
 ### Installation
 1. **Lade die Datei herunter**: `element-setup-windows.cmd`
 2. **Doppelklick** auf die Datei
 3. Das Skript wird automatisch:
   - ✅ Die config.json erstellen
   - ✅ Element Desktop installieren (falls nötig)
   - ✅ Element starten
 **Oder manuell:**
 ```cmd
 element-setup-windows.cmd
 ```
 ### Voraussetzungen
 Das Skript versucht automatisch, Element zu installieren über:
 - Windows Store (Microsoft Store)
 - WinGet (Windows Package Manager)
 - Chocolatey
 Falls nichts davon vorhanden ist, installiere Element manuell:
 https://element.io/download
 ---
 ## 🍎 macOS
 ### Installation
 1. **Lade die Datei herunter**: `element-setup-macos.command`
 2. **Doppelklick** im Finder
 3. Das Skript wird automatisch:
   - ✅ Die config.json erstellen
   - ✅ Element Desktop installieren (über Homebrew falls nötig)
   - ✅ Element starten
 **Oder im Terminal:**
 ```bash
 chmod +x element-setup-macos.command
 ./element-setup-macos.command
 ```
 ### Voraussetzungen
 Das Skript nutzt **Homebrew** (falls vorhanden):
 ```bash
 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
 ```
 Oder installiere Element manuell:
 https://element.io/download
 ---
 ## 🐧 Linux
 ### Installation
 1. **Lade die Datei herunter**: `element-setup-linux.sh`
 2. **Im Terminal:**
   ```bash
   chmod +x element-setup-linux.sh
   ./element-setup-linux.sh
   ```
 3. Das Skript wird automatisch:
   - ✅ Die config.json erstellen
   - ✅ Element Desktop installieren (über apt/dnf/pacman/zypper)
   - ✅ Element starten
 ### Unterstützte Distributionen
 - **Ubuntu/Debian**: `apt`
 - **Fedora/RHEL**: `dnf`
 - **Arch Linux**: `pacman`
 - **openSUSE**: `zypper`
 ---
 ## ✅ Was die Skripte machen
 Alle Skripte führen diese Schritte aus:
 1. **config.json erstellen** im richtigen Verzeichnis:
   - **Windows**: `%APPDATA%\Element\config.json`
   - **macOS**: `~/Library/Application Support/Element/config.json`
   - **Linux**: `~/.config/Element/config.json`
 2. **Automatische Konfiguration**:
   ```json
   {
     "configUrl": "https://axion1337.chat/config.json",
     "brand": "aXion1337.Chat",
     "default_theme": "aXion1337 Dark",
     "show_labs_settings": true,
     "features": {
       "feature_qr_code_login": true
     }
   }
   ```
 3. **Element Desktop installieren** (falls nicht vorhanden)
 4. **Element starten** und deine Custom Themes laden
 ---
 ## 🎨 Themes nach Setup
 Nach dem Setup hat dein Element Desktop:
 1. **Automatisch geladene Themes** von: `https://axion1337.chat/config.json`
 2. **Standard Theme**: aXion1337 Dark
 3. **Verfügbare Themes**:
   - aXion1337 Dark
   - Deep Purple
   - Discord Dark
   - Electric Blue
   - Everforest dark hard
   - Gruvbox Dark
   - Wal
 ---
 ## ⚙️ Manuelle Konfiguration (falls Skript nicht funktioniert)
 Falls die Skripte nicht funktionieren, erstelle manuell die config.json:
 ### Windows
 ```
 %APPDATA%\Element\config.json
 ```
 ### macOS
 ```
 ~/Library/Application Support/Element/config.json
 ```
 ### Linux
 ```
 ~/.config/Element/config.json
 ```
 **Inhalt** (copy-paste):
 ```json
 {
  "configUrl": "https://axion1337.chat/config.json",
  "brand": "aXion1337.Chat",
  "default_theme": "aXion1337 Dark",
  "show_labs_settings": true,
  "features": {
    "feature_qr_code_login": true
  },
  "setting_defaults": {
    "custom_themes": []
  }
 }
 ```
 ---
 ## 🆘 Troubleshooting
 ### Element startet nicht
 - Stelle sicher, dass Element Desktop installiert ist
 - Überprüfe den Installationspfad
 - Starten manuell: `element` (Terminal/CMD)
 ### config.json wird nicht geladen
 - Überprüfe, dass die Datei im richtigen Verzeichnis ist
 - Beende Element vollständig (auch in der Taskbar)
 - Starte Element neu
 ### Themes nicht sichtbar
 - Überprüfe Internetverbindung
 - `https://axion1337.chat/config.json` sollte erreichbar sein
 - Öffne Settings > Appearance > Theme und wähle manuell
 ---
 ## 📞 Support
 Bei Fragen oder Problemen:
 - https://element.io/help
 - https://axion1337.chat
 ---
 **Version**: 1.0  
 **Letztes Update**: 2026-04-23  
 **Kompatibilität**: Element Desktop 1.11+
@@ -0,0 +1,114 @@
 #!/bin/bash
 # Element Desktop Setup Script for Linux
 # Ausführung: chmod +x element-setup-linux.sh && ./element-setup-linux.sh
 echo "========================================"
 echo "Element Desktop Konfiguration Setup"
 echo "========================================"
 echo ""
 # Erkenne Linux Distribution
 if [ -f /etc/os-release ]; then
    . /etc/os-release
    OS=$ID
 else
    OS=$(uname -s)
 fi
 # Config-Verzeichnis
 CONFIG_DIR="$HOME/.config/Element"
 CONFIG_FILE="$CONFIG_DIR/config.json"
 # Erstelle Verzeichnis falls nicht vorhanden
 if [ ! -d "$CONFIG_DIR" ]; then
    echo "Erstelle Element Verzeichnis..."
    mkdir -p "$CONFIG_DIR"
 fi
 # Erstelle config.json
 echo "Erstelle config.json..."
 cat > "$CONFIG_FILE" << 'EOF'
 {
  "configUrl": "https://axion1337.chat/config.json",
  "brand": "aXion1337.Chat",
  "default_theme": "aXion1337 Dark",
  "show_labs_settings": true,
  "features": {
    "feature_qr_code_login": true
  },
  "setting_defaults": {
    "custom_themes": []
  }
 }
 EOF
 echo "✅ Config erstellt: $CONFIG_FILE"
 echo ""
 # Versuche Element zu starten/installieren
 echo "Überprüfe Element Desktop Installation..."
 # Methode 1: Element ist bereits installiert
 if command -v element &> /dev/null; then
    echo "Element gefunden. Starte Element..."
    element &
    sleep 2
    exit 0
 fi
 # Methode 2: Apt (Debian/Ubuntu)
 if command -v apt &> /dev/null; then
    echo ""
    echo "Installiere Element über apt..."
    sudo apt update
    sudo apt install -y element-desktop
    echo "Starte Element..."
    element &
    exit 0
 fi
 # Methode 3: Pacman (Arch Linux)
 if command -v pacman &> /dev/null; then
    echo ""
    echo "Installiere Element über pacman..."
    sudo pacman -S --noconfirm element-web
    echo "Starte Element..."
    element &
    exit 0
 fi
 # Methode 4: DNF (Fedora/RHEL)
 if command -v dnf &> /dev/null; then
    echo ""
    echo "Installiere Element über dnf..."
    sudo dnf install -y element-desktop
    echo "Starte Element..."
    element &
    exit 0
 fi
 # Methode 5: Zypper (openSUSE)
 if command -v zypper &> /dev/null; then
    echo ""
    echo "Installiere Element über zypper..."
    sudo zypper install -y element-desktop
    echo "Starte Element..."
    element &
    exit 0
 fi
 # Fallback
 echo ""
 echo "⚠️  Element Desktop konnte nicht automatisch installiert werden."
 echo ""
 echo "Bitte installiere Element Desktop manuell:"
 echo "  Ubuntu/Debian:  sudo apt install element-desktop"
 echo "  Fedora/RHEL:    sudo dnf install element-desktop"
 echo "  Arch:           sudo pacman -S element-web"
 echo "  openSUSE:       sudo zypper install element-desktop"
 echo ""
 echo "Oder: https://element.io/download"
 echo ""
 echo "✅ Deine config.json wurde erstellt unter:"
 echo "$CONFIG_FILE"
 echo ""
@@ -0,0 +1,84 @@
 #!/bin/bash
 # Element Desktop Setup Script for macOS
 # Doppelklick im Finder zum Ausführen
 echo "========================================"
 echo "Element Desktop Konfiguration Setup"
 echo "========================================"
 echo ""
 # Config-Verzeichnis
 CONFIG_DIR="$HOME/Library/Application Support/Element"
 CONFIG_FILE="$CONFIG_DIR/config.json"
 # Erstelle Verzeichnis falls nicht vorhanden
 if [ ! -d "$CONFIG_DIR" ]; then
    echo "Erstelle Element Verzeichnis..."
    mkdir -p "$CONFIG_DIR"
 fi
 # Erstelle config.json
 echo "Erstelle config.json..."
 cat > "$CONFIG_FILE" << 'EOF'
 {
  "configUrl": "https://axion1337.chat/config.json",
  "brand": "aXion1337.Chat",
  "default_theme": "aXion1337 Dark",
  "show_labs_settings": true,
  "features": {
    "feature_qr_code_login": true
  },
  "setting_defaults": {
    "custom_themes": []
  }
 }
 EOF
 echo "Config erstellt: $CONFIG_FILE"
 echo ""
 # Versuche Element zu installieren/starten
 echo "Überprüfe Element Desktop Installation..."
 # Methode 1: Über Homebrew (falls installiert)
 if command -v brew &> /dev/null; then
    if brew list element &> /dev/null; then
        echo "Element über Homebrew gefunden. Starte Element..."
        open -a Element
        sleep 2
        exit 0
    fi
 fi
 # Methode 2: Direkte App im Applications Folder
 if [ -d "/Applications/Element.app" ]; then
    echo "Element im Applications Folder gefunden. Starte Element..."
    open -a Element
    sleep 2
    exit 0
 fi
 # Methode 3: Homebrew Installation
 if command -v brew &> /dev/null; then
    echo ""
    echo "Installiere Element über Homebrew..."
    brew install element --cask
    echo "Starte Element..."
    sleep 2
    open -a Element
    exit 0
 else
    echo ""
    echo "⚠️  Homebrew nicht gefunden. Bitte installiere zuerst:"
    echo "https://brew.sh"
    echo ""
    echo "Oder installiere Element manuell:"
    echo "https://element.io/download"
    echo ""
    echo "✅ Deine config.json wurde erstellt unter:"
    echo "$CONFIG_FILE"
    echo ""
 fi
 # Warte auf Benutzer-Input vor dem Schließen
 read -p "Drücke Enter zum Beenden..."
@@ -0,0 +1,89 @@
@echo off
 REM Element Desktop Setup Script for Windows
 REM Doppelklick zum Ausführen
 setlocal enabledelayedexpansion
 echo ========================================
 echo Element Desktop Konfiguration Setup
 echo ========================================
 echo.
 REM Config-Verzeichnis
 set APPDATA_PATH=%APPDATA%\Element
 set CONFIG_FILE=%APPDATA_PATH%\config.json
 REM Erstelle Verzeichnis falls nicht vorhanden
 if not exist "%APPDATA_PATH%" (
    echo Erstelle Element Verzeichnis...
    mkdir "%APPDATA_PATH%"
 )
 REM Erstelle config.json
 echo Erstelle config.json...
 (
    echo {
    echo   "configUrl": "https://axion1337.chat/config.json",
    echo   "brand": "aXion1337.Chat",
    echo   "default_theme": "aXion1337 Dark",
    echo   "show_labs_settings": true,
    echo   "features": {
    echo     "feature_qr_code_login": true
    echo   },
    echo   "setting_defaults": {
    echo     "custom_themes": []
    echo   }
    echo }
 ) > "%CONFIG_FILE%"
 echo Config erstellt: %CONFIG_FILE%
 echo.
 REM Versuche Element zu installieren/starten
 echo Überprüfe Element Desktop Installation...
 REM Methode 1: Über Microsoft Store (wenn verfügbar)
 where element >nul 2>nul
 if %ERRORLEVEL% == 0 (
    echo Starte Element Desktop...
    start element
    timeout /t 2 >nul
    echo Done!
    pause
    exit /b 0
 )
 REM Methode 2: WinGet (Falls installiert)
 winget list --name "Element" >nul 2>nul
 if %ERRORLEVEL% == 0 (
    echo WinGet gefunden. Installiere Element...
    winget install Element.Element --silent
    echo Starte Element...
    timeout /t 3 >nul
    start element
    pause
    exit /b 0
 )
 REM Methode 3: Chocolatey (Falls installiert)
 choco list element >nul 2>nul
 if %ERRORLEVEL% == 0 (
    echo Chocolatey gefunden. Installiere Element...
    choco install element -y
    echo Starte Element...
    timeout /t 3 >nul
    start element
    pause
    exit /b 0
 )
 REM Fallback: Manueller Download
 echo.
 echo Element Desktop konnte nicht automatisch installiert werden.
 echo Bitte installiere Element Desktop manuell:
 echo https://element.io/download
 echo.
 echo Deine config.json wurde erstellt unter:
 echo %CONFIG_FILE%
 echo.
 pause
@@ -0,0 +1,41 @@
 #!/usr/bin/env bash
 # GitOps ConfigMap Checksum Hook
 # Automatically updates checksum annotations in kustomization.yaml when ConfigMaps change.
 # This ensures Flux CD re-deploys the HelmRelease when external ConfigMap sources are modified.
 #
 # See: docs/ops-configmap-sync.md
 set -euo pipefail
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 ELEMENT_VALUES="$REPO_ROOT/apps/production/custom-configs/element-values.yaml"
 SYNAPSE_VALUES="$REPO_ROOT/apps/production/custom-configs/synapse-values.yaml"
 KUSTOMIZATION="$REPO_ROOT/apps/production/kustomization.yaml"
 # Function to calculate MD5 hash (handles both GNU md5sum and BSD md5)
 get_md5() {
  local file="$1"
  if command -v md5sum &> /dev/null; then
    md5sum "$file" | awk '{print $1}'
  elif command -v md5 &> /dev/null; then
    md5 -q "$file"
  else
    echo "ERROR: Neither md5sum nor md5 found" >&2
    exit 1
  fi
 }
 # Update checksums for ConfigMaps that exist and are staged
 if git diff --cached --name-only | grep -q "element-values.yaml"; then
  ELEMENT_HASH=$(get_md5 "$ELEMENT_VALUES")
  sed -i.bak "s/value: \"[0-9a-f]\{32\}\" *# element-config/value: \"$ELEMENT_HASH\" # element-config/" "$KUSTOMIZATION"
  rm -f "$KUSTOMIZATION.bak"
  git add "$KUSTOMIZATION"
 fi
 if git diff --cached --name-only | grep -q "synapse-values.yaml"; then
  SYNAPSE_HASH=$(get_md5 "$SYNAPSE_VALUES")
  sed -i.bak "s/value: \"[0-9a-f]\{32\}\" *# synapse-config/value: \"$SYNAPSE_HASH\" # synapse-config/" "$KUSTOMIZATION"
  rm -f "$KUSTOMIZATION.bak"
  git add "$KUSTOMIZATION"
 fi
@@ -0,0 +1,27 @@
 #!/usr/bin/env bash
 # Install Git Hooks for GitOps automation
 # Must be run after cloning the repository
 REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || {
  echo "❌ Not in a git repository"
  exit 1
 }
 HOOKS_DIR="$REPO_ROOT/.git/hooks"
 HOOK_SOURCE="$REPO_ROOT/scripts/hooks/pre-commit"
 HOOK_DEST="$HOOKS_DIR/pre-commit"
 # Verify source exists
 if [ ! -f "$HOOK_SOURCE" ]; then
  echo "❌ Hook source not found: $HOOK_SOURCE"
  exit 1
 fi
 # Create symlink (force if exists)
 mkdir -p "$HOOKS_DIR"
 ln -sf "../../scripts/hooks/pre-commit" "$HOOK_DEST"
 chmod +x "$HOOK_SOURCE"
 echo "✅ Git hooks installed:"
 echo "   • pre-commit: ConfigMap checksum auto-update"
 echo "   See: docs/ops-configmap-sync.md"
Author	SHA1	Message	Date
Scrublord MacBadandClaude Haiku 4.5	6bcbe9cc9e	Add Gitea Actions workflows for CI/CD automation Auto-Deploy on Push / verify-and-notify (push) Has been cancelled - deploy-on-push.yml: Verify YAML, check SOPS encryption, notify on deployments - milestone-release.yml: Auto-create releases on milestone tags Triggers: - deploy-on-push: On any push to main (apps/clusters changes) - milestone-release: On git tag m--complete Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 23:29:50 +02:00
Scrublord MacBadandClaude Haiku 4.5	b8da70b14b	Add status summary and prioritized next steps to TASKS.md Add at top of TASKS.md: - Status Summary table (quick view of progress) - Priority distribution (CRITICAL/HIGH/MEDIUM/LOW) - Next Steps section (this week, 1-2 weeks) - Each task includes: description, effort estimate, blocking factors Makes task list immediately actionable and progress trackable. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 23:08:00 +02:00
Scrublord MacBadandClaude Haiku 4.5	4cf6702f85	Add comprehensive task list and VSCode todo-tree integration Add docs/TASKS.md: - Completed tasks (6): K3S, Flux, ESS, Themes, Desktop Scripts, Monitoring, TURN - In Progress: Authentik Stage 2 (pending manual config) - Backlog (15+): Element Call Fork, PostgreSQL migration, NetworkPolicies, etc. - Security hardening: Host/Cluster/App layer recommendations - Milestones: Track progress from M1 (Basic) to M7 (Enterprise) Enhance devcontainer.json: - Add gruntfuggly.todo-tree extension for task tree view - Add ms-vscode.makefile-tools for build automation - Add GitHub.copilot for development assistance - Configure todo-tree to highlight TASKS.md and deployment guides Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 23:05:33 +02:00
Scrublord MacBadandClaude Haiku 4.5	aee9a34369	Add 5 detailed deployment guides to docs/deployment-guides/ - 01-turn-server-setup.md: TURN Server architecture, deployment, verification - 02-authentik-identity-provider.md: Two-stage OIDC integration (Stage 1 & Stage 2) - 03-monitoring-integration.md: Alloy, Prometheus, Loki integration with Selendis - 04-element-customization.md: Custom themes (7), desktop setup scripts, admin panel - 05-room-policies.md: Message retention, room publication, auto-join policies All guides include troubleshooting, configuration examples, and best practices. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 22:47:38 +02:00
Scrublord MacBadandClaude Haiku 4.5	e6ef29c1e9	Add deployment documentation structure & overview Create docs/deployment-guides/ directory with comprehensive README covering: - Deployment order for all 5 major features - Architecture overview - Critical values & configuration - Links to detailed guides Full documentation files: - 01-turn-server-setup.md - 02-authentik-identity-provider.md - 03-monitoring-integration.md - 04-element-customization.md - 05-room-policies.md To be added in follow-up commits. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 22:46:00 +02:00
Scrublord MacBadandClaude Haiku 4.5	857c3965ef	Add devcontainer for cross-platform development - Dockerfile with all required tools (kubectl, flux, helm, sops, age, etc.) - devcontainer.json with VSCode config and extensions - postCreateCommand.sh for setup verification - Comprehensive README with setup instructions for macOS, Windows/WSL2, Linux - Automatic mounts for kubeconfig, SSH keys, age encryption keys - SOPS_AGE_KEY_FILE and KUBECONFIG pre-configured Enables development on Windows, macOS, and Linux with consistent environment. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 22:27:52 +02:00
Scrublord MacBad	d37a65f4fa	fix element web image version missing	2026-05-14 22:07:34 +02:00
Scrublord MacBad	e6abd0fb3f	feat: reinstate roomlist fork after config map fix	2026-05-14 21:59:34 +02:00
Scrublord MacBadandClaude Haiku 4.5	d3362180ea	fix: Complete JSON structure in element-values.yaml The config.json was truncated and had unclosed brackets. This prevented Helm from properly merging the ElementWeb configuration, so the custom themes were never loaded into the cluster. This fix: - Closes the unclosed JSON brackets - Validates the full JSON structure - Removes duplicate/extra closing brackets - Ensures all 6 custom themes are properly included Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 21:55:22 +02:00
Scrublord MacBadandClaude Haiku 4.5	5f50a60071	feat: Automate ConfigMap checksum updates via Git pre-commit hook - Add pre-commit hook (scripts/hooks/pre-commit) that automatically calculates MD5 checksums of ConfigMaps (element-values.yaml, synapse-values.yaml) - Update annotations in kustomization.yaml to trigger Flux CD HelmRelease syncs - Add install script (scripts/install-hooks.sh) for easy hook setup - Add comprehensive documentation (docs/ops-configmap-sync.md) explaining: * Why Flux doesn't auto-detect ConfigMap changes * How the checksum-based workaround works * How to install and use the hook * Troubleshooting and manual sync procedures - Update README.md with post-clone hook installation step This solves the issue where Flux CD doesn't automatically re-deploy when external ConfigMaps are modified. Users no longer need manual checksum updates. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 21:43:01 +02:00
Scrublord MacBad	174e9721ed	Revert "test: verify pre-commit hook updates checksums" This reverts commit `5f14376bdb`.	2026-05-14 21:42:25 +02:00
Scrublord MacBad	5f14376bdb	test: verify pre-commit hook updates checksums	2026-05-14 21:42:13 +02:00
Scrublord MacBadandClaude Haiku 4.5	81a30e21b9	Fix: HelmRelease reconciliation on ConfigMap changes - Reduce HelmRelease interval from 1h to 5m for faster sync - Add checksum annotation to trigger reconciliation when element-values.yaml changes - This ensures Flux CD re-deploys the chart when themes/config updates are made To update the checksum after editing element-values.yaml: md5sum apps/production/custom-configs/element-values.yaml # Update the value in apps/production/kustomization.yaml patches[0].patch Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-05-14 21:37:07 +02:00
sorb	f81fda12d4	Update apps/production/element-server-suite.yaml	2026-05-13 14:48:08 +00:00
sorb	fe0165a509	Update apps/production/element-server-suite.yaml new docker image for elementWeb	2026-05-13 14:43:50 +00:00
Scrublord MacBad	dc17158fe2	fix themes	2026-05-11 10:48:16 +02:00
Scrublord MacBad	0c81de057f	fix config url element web	2026-05-11 10:43:35 +02:00
sorb	aaa197fbb5	Feat: Lab roomslist v3 & new aXion Theme	2026-05-11 08:28:30 +00:00
Scrublord MacBad	e0ed10598f	Update Element Web to use custom fork image - Registry: rohana.axion1337.de - Repository: sorb/threadnet-web - Tag: v0.1.0	2026-05-10 23:44:35 +02:00
sorb	d39ce5a3a0	Feat: deactivate legacy calls	2026-05-10 19:43:54 +00:00
Scrublord MacBad	68bf4e213c	Revert to ESS 26.4.0 - URL preview issues in 26.5.0	2026-05-08 00:39:20 +02:00
Scrublord MacBad	644dff9c48	Upgrade to ESS 26.5.0 with oembed support	2026-05-08 00:29:39 +02:00
Scrublord MacBad	8e0f244257	Add oembed configuration directly to synapse values	2026-05-08 00:20:45 +02:00
Scrublord MacBad	b000c1b10b	Fix oembed configuration format	2026-05-08 00:10:08 +02:00
Scrublord MacBad	24d0cd1201	Add media_repository and oembed configuration for URL previews	2026-05-08 00:06:27 +02:00
Scrublord MacBad	08a38fdfbb	Revert to ESS 26.4.0 to test URL preview functionality	2026-05-07 23:58:15 +02:00
Scrublord MacBad	eda648eaa7	Add media_repository and thumbnail_generator workers for URL preview support	2026-05-07 23:45:37 +02:00
Scrublord MacBad	575ac0112f	fix auto join	2026-05-07 23:23:33 +02:00
Scrublord MacBad	878687f334	test deactivate auto join in synape prior ess upgrade due to invalid room id	2026-05-07 23:11:37 +02:00
Scrublord MacBad	7b4def0fe7	Upgrade ESS 26.5.0	2026-05-07 22:54:05 +02:00
Scrublord MacBad	7b7643cf6e	Feat: no new roomlist	2026-05-07 21:26:29 +02:00
Scrublord MacBad	a7959474c5	Feat: new room list #32677	2026-05-07 21:16:50 +02:00
Scrublord MacBadandClaude Haiku 4.5	3c2a03e9c3	Deploy Authentik as Identity Provider for Matrix (Stage 1) Add Authentik v2026.x with embedded PostgreSQL in new namespace. Includes HelmRelease with valuesFrom injection for encrypted credentials, cert-manager Certificate for auth.axion1337.chat, and Traefik IngressRoute. Authentik serves as OIDC provider for MAS; registration via invitation links only. DNS A-record setup and Authentik UI configuration (OIDC provider creation) are manual post-deployment steps. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-29 23:44:15 +02:00
Scrublord MacBadandClaude Haiku 4.5	8ff438bd24	Implement TURN server (coturn) for WebRTC video calls Add coturn Deployment with hostNetwork mode and init container for secret substitution. Include SOPS-encrypted shared secret, TLS certificate for turn.axion1337.chat, and Synapse TURN configuration with proper relay URIs and credentials. Resolves DTLS timeout issues in RTC video calls by providing media relay for clients behind NAT/Firewall. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-29 23:07:52 +02:00
Scrublord MacBadandClaude Haiku 4.5	01ad3f2d71	Fix HelmRepository API version - Change from v1beta2 to v1 (v1beta2 is deprecated) - Resolves dry-run failure in monitoring Kustomization Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 16:18:17 +02:00
Scrublord MacBadandClaude Haiku 4.5	34bffe40be	Add monitoring stack: kube-state-metrics, node-exporter, and Alloy - New monitoring namespace - HelmRepositories: prometheus-community, grafana - kube-state-metrics: Kubernetes state metrics - prometheus-node-exporter: Host metrics DaemonSet - Alloy: Multi-target scraper pushing to Selendis (10.0.0.3:9090 Prometheus, 10.0.0.3:3100 Loki) - Scrapes Flux controllers (flux-system:8080) - Scrapes kube-state-metrics (monitoring:8080) - Scrapes node-exporter DaemonSet (monitoring:9100) - Scrapes Synapse metrics (matrix:9000) - Pushes pod logs to Loki - Monitoring Kustomization added to flux-system Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 16:14:17 +02:00
Scrublord MacBadandClaude Haiku 4.5	1a1c8ee2c6	Simplify room_list_publication_rules structure - Remove unnecessary fields, use minimal rule set - Allow all users to publish rooms Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 15:31:30 +02:00
Scrublord MacBadandClaude Haiku 4.5	78454ba2ef	Add room_list_publication_rules to allow room publishing - Allow all users to publish public rooms in room list - Fixes 403 'Not allowed to publish room' error - Applies to rooms with join_rule: public Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 15:11:32 +02:00
Scrublord MacBadandClaude Haiku 4.5	c98997f75e	Fix auto_join_rooms configuration property name - Rename property from auto-join-rooms to auto_join (underscore instead of dash) - Keep YAML structure with embedded config Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 14:40:45 +02:00
Scrublord MacBadandClaude Haiku 4.5	a323c6bb65	Add auto-join rooms configuration for onboarding - New users automatically join !NkFTshKWJMgdTqTbTh:axion1337.chat (onboarding room) - Federated guests do not auto-join (auto_join_rooms_for_guests: false) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 14:15:45 +02:00
Scrublord MacBadandClaude Haiku 4.5	47625c05b6	Rename retention-config to retention in synapse additional config - Use simpler property name 'retention' instead of 'retention-config' - Helm Chart schema may not allow 'retention-config' naming convention Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 13:53:25 +02:00
Scrublord MacBadandClaude Haiku 4.5	42483f32b5	Fix synapse retention-config placement in values - Move retention-config from top-level synapse to additional section - Helm Chart schema requires custom configs under synapse.additional - Clean up comments (keep inline comments minimal) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-24 13:48:57 +02:00
sorb	ee6cdb7982	feat retention-config	2026-04-24 09:27:42 +00:00
Scrublord MacBadandClaude Haiku 4.5	4a95350c72	Add beautiful HTML landing page to element-web-docs setup - Create index.html with styled setup guide and download links - Update init-container to copy index.html to nginx - Configure nginx to serve index.html as default for /docs/setup/ - Remove directory listing (autoindex), show proper HTML instead Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-23 18:52:33 +02:00
Scrublord MacBadandClaude Haiku 4.5	c85dd39eba	Fix Element Web docs server routing and remove redundant nginx Ingress - Remove duplicate nginx Ingress from element-web-docs-server.yaml (using Traefik instead) - Traefik IngressRoute in apex-ingress.yaml now handles /docs/setup routing - Deployment and Service remain unchanged for file serving Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>	2026-04-23 18:42:57 +02:00
Scrublord MacBad	bdba4f3e34	fix: use init-container instead of postStart hook	2026-04-23 18:37:08 +02:00
Scrublord MacBad	80fa13b63f	feat: separate nginx deployment to serve Element Desktop setup scripts	2026-04-23 18:36:13 +02:00
Scrublord MacBad	cf8bc00613	fix: use init-container to copy docs from ConfigMap to nginx html	2026-04-23 18:34:45 +02:00
Scrublord MacBad	0c67a249fa	fix: add element-web-docs-configmap to kustomization resources	2026-04-23 18:25:18 +02:00
Scrublord MacBad	4bc0e10631	fix: correct ConfigMap keys and mount structure for /docs/setup/	2026-04-23 18:18:15 +02:00
Scrublord MacBad	3e07d6c613	fix: move element-web-docs ConfigMap to correct location	2026-04-23 18:17:04 +02:00
Scrublord MacBad	336f2aa1cb	feat: serve Element Desktop setup scripts via Element Web at /docs/setup/	2026-04-23 18:16:03 +02:00
Scrublord MacBad	659acdf601	docs: add Element Desktop setup scripts for Windows, macOS, and Linux	2026-04-23 16:42:16 +02:00
Scrublord MacBad	147ac079f7	feat: add configUrl for Element Desktop auto-loading	2026-04-23 16:33:06 +02:00
Scrublord MacBad	0efe91b1bd	custom themes	2026-04-23 15:39:33 +02:00
Scrublord MacBad	6aff1f86d6	fix final mas fix	2026-04-23 15:25:44 +02:00
Scrublord MacBad	bdca6d8840	fix mas	2026-04-23 14:01:48 +02:00
Scrublord MacBad	b6e2c6f00b	missing param	2026-04-23 13:53:24 +02:00
Scrublord MacBad	37149b195b	fix mas?	2026-04-23 13:50:35 +02:00
Scrublord MacBad	13e597769c	fix secret handling	2026-04-23 11:28:14 +02:00
Scrublord MacBad	c17e8f528f	fix mas?	2026-04-23 11:25:00 +02:00
Scrublord MacBad	9fdac55e25	fix custom themes syntax	2026-04-23 11:04:47 +02:00
Scrublord MacBad	eb21dc9494	feat custom themes	2026-04-23 10:49:58 +02:00