Thore CimbalandClaude Sonnet 5
51ea51352b
Issue #38 discussion surfaced a real bug: the TURN shared secret was duplicated - correctly SOPS-encrypted in coturn-secret.yaml, but also hardcoded in plaintext in synapse-values.yaml (a plain, non-SOPS ConfigMap), visible in git history. Also found turn_user_lifetime is 86400000ms (24h), not "short-lived" as previously assumed - raising the stakes of the leak somewhat. Extracted the turn config block into its own dedicated SOPS-encrypted Secret (synapse-turn-secret.yaml), wired via a second HelmRelease valuesFrom entry (same pattern already used for ess-mas-values-secret). Rotated the value while doing this, so the leaked plaintext secret is no longer live anywhere. Added checksum/rotated-at annotations (matrix-stack HelmRelease's existing element-config-checksum patch gets a sibling turn-secret-checksum; coturn's Deployment pod template gets a rotated-at annotation) so future rotations actually restart both consumers - Kubernetes doesn't restart running pods when a referenced Secret's content changes on its own. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
95 lines
2.4 KiB
YAML
95 lines
2.4 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: matrix-stack
|
||
namespace: matrix
|
||
spec:
|
||
interval: 5m
|
||
chart:
|
||
spec:
|
||
chart: matrix-stack
|
||
version: "26.4.0"
|
||
sourceRef:
|
||
kind: HelmRepository
|
||
name: element-ess-oci
|
||
namespace: flux-system
|
||
|
||
# NEU: Hier zieht Flux deine Puzzleteile zusammen
|
||
valuesFrom:
|
||
- kind: ConfigMap
|
||
name: ess-synapse-custom
|
||
valuesKey: values.yaml
|
||
- kind: ConfigMap
|
||
name: ess-element-custom
|
||
valuesKey: values.yaml
|
||
- kind: Secret
|
||
name: ess-mas-values-secret
|
||
valuesKey: values.yaml
|
||
- kind: Secret
|
||
name: synapse-turn-secret
|
||
valuesKey: values.yaml
|
||
|
||
values:
|
||
# Top-Level: serverName – das ist dein Matrix-Homeserver-Name
|
||
serverName: axion1337.chat
|
||
|
||
# Cert-Manager für automatische Zertifikatsgenerierung
|
||
certManager:
|
||
clusterIssuer: letsencrypt-prod
|
||
|
||
# Interner Postgres an (default ist eh true, hier nur zur Klarheit)
|
||
postgres:
|
||
enabled: true
|
||
|
||
# Synapse – API auf matrix.axion1337.chat
|
||
synapse:
|
||
enabled: true
|
||
ingress:
|
||
host: matrix.axion1337.chat
|
||
additional:
|
||
oembed:
|
||
config: |
|
||
oembed_enabled: true
|
||
|
||
# Matrix Authentication Service – braucht eine Subdomain
|
||
matrixAuthenticationService:
|
||
enabled: true
|
||
ingress:
|
||
host: account.axion1337.chat
|
||
|
||
# Matrix RTC (Element Call) – braucht auch eine Subdomain
|
||
matrixRTC:
|
||
enabled: true
|
||
ingress:
|
||
host: mrtc.axion1337.chat
|
||
# Chart default (20Mi request+limit) OOM-killed the authorisation service after
|
||
# ~74 days of uptime (2026-07-28) - too tight for a long-running Go service.
|
||
resources:
|
||
requests:
|
||
memory: 64Mi
|
||
cpu: 50m
|
||
limits:
|
||
memory: 128Mi
|
||
|
||
# Element Web
|
||
elementWeb:
|
||
enabled: true
|
||
image:
|
||
registry: rohana.axion1337.de
|
||
repository: sorb/threadnet-web
|
||
tag: v0.2.3-elementcall-h264
|
||
ingress:
|
||
host: axion1337.chat
|
||
|
||
# Element Admin
|
||
elementAdmin:
|
||
enabled: true
|
||
ingress:
|
||
host: admin.axion1337.chat
|
||
|
||
# Well-Known auf der Apex-Domain (axion1337.chat/.well-known/matrix/*)
|
||
# Aktiviert – notwendig für MatrixRTC-Discovery
|
||
wellKnownDelegation:
|
||
enabled: true
|
||
ingress:
|
||
className: "none" # Deaktiviert den Chart-Ingress, wir erstellen einen eigenen |