Thore Cimbal
30578abaaf
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Ingress-only default-deny plus per-component allow rules, using named container ports throughout (not Service ports) after the authentik port-mismatch incident. Traefik -> element-web/element-admin/haproxy (fronts both matrix.axion1337.chat and well-known)/MAS; synapse <- haproxy+MAS; postgres <- synapse+MAS; RTC signalling via Traefik, RTC media NodePorts left open to the internet by design; monitoring scrape allows for synapse/postgres/rtc-sfu metrics; ACME solver allow. coturn (hostNetwork) needs nothing - NetworkPolicy doesn't apply to it. Part of issue #10.
33 lines
1.1 KiB
YAML
Executable File
33 lines
1.1 KiB
YAML
Executable File
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# Patch: Fügt einen Checksum der element-values.yaml zur HelmRelease hinzu
|
|
# Damit wird Flux die HelmRelease neu-synced wenn sich die ConfigMap ändert
|
|
patches:
|
|
- target:
|
|
kind: HelmRelease
|
|
name: matrix-stack
|
|
namespace: matrix
|
|
patch: |-
|
|
- op: add
|
|
path: /metadata/annotations/element-config-checksum
|
|
value: "401f8a87d0ef5d91d2e5032d4aede42c"
|
|
|
|
resources:
|
|
- matrix-postgres-auth.yaml
|
|
- cert-issuer.yaml
|
|
- matrix-certificates.yaml
|
|
# Neue Dateien:
|
|
- custom-configs/synapse-values.yaml
|
|
- custom-configs/element-values.yaml
|
|
- custom-configs/mas-secret.yaml
|
|
- element-web-docs-configmap.yaml
|
|
- element-web-docs-server.yaml
|
|
# TURN Server für WebRTC
|
|
- coturn-secret.yaml
|
|
- coturn.yaml
|
|
# HelmRelease (muss ganz unten stehen, damit die ConfigMaps vorher da sind!)
|
|
- element-server-suite.yaml
|
|
# Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
|
|
- apex-ingress.yaml # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
|
|
- networkpolicy.yaml |