Thore CimbalandClaude Sonnet 5
51ea51352b
Issue #38 discussion surfaced a real bug: the TURN shared secret was duplicated - correctly SOPS-encrypted in coturn-secret.yaml, but also hardcoded in plaintext in synapse-values.yaml (a plain, non-SOPS ConfigMap), visible in git history. Also found turn_user_lifetime is 86400000ms (24h), not "short-lived" as previously assumed - raising the stakes of the leak somewhat. Extracted the turn config block into its own dedicated SOPS-encrypted Secret (synapse-turn-secret.yaml), wired via a second HelmRelease valuesFrom entry (same pattern already used for ess-mas-values-secret). Rotated the value while doing this, so the leaked plaintext secret is no longer live anywhere. Added checksum/rotated-at annotations (matrix-stack HelmRelease's existing element-config-checksum patch gets a sibling turn-secret-checksum; coturn's Deployment pod template gets a rotated-at annotation) so future rotations actually restart both consumers - Kubernetes doesn't restart running pods when a referenced Secret's content changes on its own. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
1.7 KiB
YAML
63 lines
1.7 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: ess-synapse-custom
|
|
namespace: matrix
|
|
data:
|
|
values.yaml: |
|
|
synapse:
|
|
logging:
|
|
rootLevel: INFO
|
|
levelOverrides:
|
|
synapse.media.url_previewer: DEBUG
|
|
additional:
|
|
url-previews:
|
|
config: |
|
|
url_preview_enabled: true
|
|
url_preview_ip_range_blacklist:
|
|
- '127.0.0.0/8'
|
|
- '10.0.0.0/8'
|
|
- '172.16.0.0/12'
|
|
- '192.168.0.0/16'
|
|
- '::1/128'
|
|
- 'fe80::/10'
|
|
- 'fc00::/7'
|
|
max_spider_size: 10M
|
|
retention:
|
|
config: |
|
|
retention:
|
|
enabled: true
|
|
default_policy:
|
|
min_lifetime: 1d
|
|
max_lifetime: 1y
|
|
allowed_lifetime_min: 1d
|
|
allowed_lifetime_max: 2y
|
|
purge_jobs:
|
|
- longest_max_lifetime: 3d
|
|
interval: 12h
|
|
- shortest_max_lifetime: 3d
|
|
longest_max_lifetime: 1w
|
|
interval: 1d
|
|
- shortest_max_lifetime: 1w
|
|
interval: 2d
|
|
|
|
media_retention:
|
|
local_media_lifetime: 365d
|
|
remote_media_lifetime: 90d
|
|
|
|
redaction_retention_period: 7d
|
|
forgotten_room_retention_period: 28d
|
|
user_ips_max_age: 90d
|
|
auto_join:
|
|
config: |
|
|
auto_join_rooms:
|
|
- "#onboarding:axion1337.chat"
|
|
auto_join_rooms_for_guests: false
|
|
room_publish:
|
|
config: |
|
|
room_list_publication_rules:
|
|
- user_id: "*"
|
|
action: allow
|
|
oembed:
|
|
config: |
|
|
oembed_enabled: true |