Configure Dendrite on kubernetes

Configure a matrix database
Configure Dendrite into Kubernetes
Update vps configuration to new settings

home/modules/baseline/xonsh_footer.xsh

@@ -7,14 +7,10 @@ def bw_unlock():
     current environment variables. Also returns the code for them."""
     if "BW_SESSION" in ${...}:
         return $BW_SESSION
-    result = $(bw unlock)
+    result = !(bw unlock --raw)
-    while "BW_SESSION" not in result:
+    while result.returncode != 0:
-        result = $(bw unlock)
+        result = !(bw unlock --raw)
-    lines = result.split("\n")
+    $BW_SESSION = result.output.strip()
-    l = [k for k in lines if 'BW_SESSION="' in k][0]
-    left, right = l.split("=", 1)
-    token = right[1:-1]
-    $BW_SESSION = token
     return token
 
 def vpn(con, bwname):

hosts/genesis/net/hosts

@@ -9,7 +9,7 @@
 10.42.1.3 printer.thehellings.lan
 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan
-10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan pgadmin.thehellings.lan
+10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan
 10.42.1.7 hosea hosea.thehellings.lan
 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
 10.42.1.9 ivr ivr.thehellings.lan
@@ -32,8 +32,8 @@
 100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
 100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net
-100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net
+100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes
-100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net
+100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
 100.90.74.19 jude.home
 100.115.57.8 linode.home
 100.65.5.38 matrix.home matrix.shire-zebra.ts.net

hosts/linode/matrix.nix

@@ -14,7 +14,6 @@ in
       "${domain}" = {
         enableACME = true;
         forceSSL = true;
-
         # This is needed so that servers contacting hellings.com can find
         # the actual application server at matrix.thehellings.com
         locations."= /.well-known/matrix/server".extraConfig =
@@ -51,11 +50,20 @@ in
         enableACME = true;
         forceSSL = true;
 
+        extraConfig = ''
+          error_log /var/log/nginx/debug.log debug;
+        '';
+
         # Not the appropriate place for the chat client
         locations =
           (builtins.listToAttrs (
             builtins.map
-              (val: lib.nameValuePair "/_${val}" { proxyPass = "http://matrix.shire-zebra.ts.net:8448"; })
+              (
+                val:
+                lib.nameValuePair "/_${val}" {
+                  proxyPass = "http://matrix.kubernetes";
+                }
+              )
               [
                 "matrix"
                 "synapse"

manifests/databases/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - postgres-cluster.yaml
   - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
+  - postgres-matrix.yaml

manifests/databases/postgres-cluster.yaml

@@ -24,3 +24,10 @@ spec:
         superuser: true
         passwordSecret:
           name: postgres-user-pgadmin
+      - name: matrix
+        ensure: present
+        comment: Matrix DB user
+        login: true
+        superuser: false
+        passwordSecret:
+          name: postgres-user-matrix

manifests/databases/postgres-matrix.yaml

@@ -0,0 +1,9 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-matrix
+spec:
+  name: matrix
+  owner: matrix
+  cluster:
+    name: postgres

manifests/databases/postgres-pgadmin.yaml

@@ -95,7 +95,7 @@ metadata:
     ingressClassName: traefik
 spec:
   rules:
-    - host: pgadmin.thehellings.lan
+    - host: pgadmin.kubernetes
       http:
         paths:
           - path: /

manifests/kustomization.yaml

@@ -3,3 +3,4 @@ resources:
   - bitwarden
   - secrets
   - databases
+  - matrix

manifests/matrix/dendrite-config.yaml

@@ -0,0 +1,189 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: dendrite-config
+spec:
+  data:
+    - &secret
+      secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef: &remoteRef
+        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        property: username
+    - <<: *secret
+      secretKey: password
+      remoteRef:
+        <<: *remoteRef
+        property: password
+    - secretKey: matrix_pem
+      sourceRef:
+        storeRef:
+          name: bitwarden-notes
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 6de3500c-7c6e-4419-b4f5-b2ea0018ff28
+  target:
+    name: dendrite-config
+    deletionPolicy: Delete
+    template:
+      engineVersion: v2
+      data:
+        matrix.pem: "{{ .matrix_pem }}"
+        dendrite.yaml: |
+          version: 2
+          global:
+            server_name: thehellings.com
+            key_id: ed25519:auto
+            private_key: /etc/dendrite/matrix.pem
+            database:
+              connection_string: "postgres://{{ .username | urlquery }}:{{ .password | urlquery }}@postgres-rw.db.svc.cluster.local/matrix?sslmode=disable"
+              max_open_conns: 90
+              max_idle_conns: 2
+              conn_max_lifetime: -1
+            well_known_server_name: "http://matrix.thehellings.com"
+            well_known_client_name: "http://matrix.thehellings.com"
+            well_known_sliding_sync_proxy: ""
+            disable_federation: false
+            presence:
+              enable_inbound: false
+              enable_outbound: false
+            trusted_third_party_id_servers:
+              - matrix.org
+              - vector.im
+            jetstream:
+              storage_path: /var/dendrite
+              addresses: []
+              topic_prefix: Dendrite
+              in_memory: false
+              disable_tls_validation: true
+              credentials_path: ""
+            metrics:
+              enabled: false
+              basic_auth:
+                username: metrics
+                password: metrics
+            sentry:
+              enabled: false
+              dsn: ""
+              environment: ""
+            dns_cache:
+              enabled: false
+              cache_size: 256
+              cache_lifetime: 5m0s
+            server_notices:
+              enabled: true
+              local_part: _server
+              display_name: Server Alert
+              avatar_url: ""
+              room_name: Server Alert
+            report_stats:
+              enabled: false
+              endpoint: https://panopticon.matrix.org/push
+            cache:
+              max_size_estimated: 1073741824
+              max_age: 1h0m0s
+          app_service_api:
+            disable_tls_validation: false
+            legacy_auth: false
+            legacy_paths: false
+            config_files: []
+          client_api:
+            registration_disabled: true
+            registration_requires_token: false
+            registration_shared_secret: ""
+            guests_disabled: false
+            enable_registration_captcha: false
+            recaptcha_api_js_url: ""
+            recaptcha_sitekey_class: ""
+            recaptcha_form_field: ""
+            recaptcha_public_key: ""
+            recaptcha_private_key: ""
+            recaptcha_bypass_secret: ""
+            recaptcha_siteverify_api: ""
+            turn:
+              turn_user_lifetime: ""
+              turn_uris: []
+              turn_shared_secret: ""
+              turn_username: ""
+              turn_password: ""
+            rate_limiting:
+              enabled: true
+              threshold: 5
+              cooloff_ms: 500
+              exempt_user_ids: []
+          federation_api:
+            send_max_retries: 16
+            enable_relays: false
+            p2p_retries_until_assumed_offline: 1
+            disable_tls_validation: false
+            disable_http_keepalives: false
+            key_perspectives:
+            - server_name: matrix.org
+              keys:
+              - key_id: ed25519:auto
+                public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
+              - key_id: ed25519:a_RXGa
+                public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
+            prefer_direct_fetch: false
+            deny_networks:
+              - 127.0.0.1/8
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - ::1/128
+              - fe80::/64
+              - fc00::/7
+            allow_networks:
+              - 0.0.0.0/0
+          key_server: {}
+          media_api:
+            base_path: /var/dendrite/media
+            max_file_size_bytes: 10485760
+            dynamic_thumbnails: false
+            max_thumbnail_generators: 10
+            thumbnail_sizes:
+              - width: 32
+                height: 32
+                method: crop
+              - width: 96
+                height: 96
+                method: crop
+              - width: 640
+                height: 480
+                method: scale
+          room_server:
+            default_room_version: "10"
+          sync_api:
+            real_ip_header: ""
+            search:
+              enabled: false
+              index_path: /var/dendrite/searchindex
+              in_memory: false
+              language: en
+          user_api:
+            bcrypt_cost: 10
+            openid_token_lifetime_ms: 3600000
+            push_gateway_disable_tls_validation: false
+            auto_join_rooms: []
+            worker_count: 8
+          relay_api: {}
+          mscs:
+            mscs: []
+          tracing:
+            enabled: false
+            jaeger:
+              serviceName: ""
+              disabled: false
+              rpc_metrics: false
+              traceid_128bit: false
+              tags: []
+              sampler: null
+              reporter: null
+              headers: null
+              baggage_restrictions: null
+              throttler: null

manifests/matrix/deployment.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dendrite
+  labels:
+    app: dendrite
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dendrite
+  template:
+    metadata:
+      labels:
+        app: dendrite
+    spec:
+      containers:
+        - name: dendrite
+          image: ghcr.io/element-hq/dendrite-monolith:latest
+          ports:
+            - containerPort: 8008
+              name: http
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/dendrite
+      volumes:
+        - name: config-volume
+          secret:
+            secretName: dendrite-config

manifests/matrix/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dendrite-ingress
+  annotations:
+    ingressClassName: traefik
+spec:
+  rules:
+    - &host
+      host: matrix.kubernetes
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dendrite
+                port:
+                  number: 8008
+    - <<: *host
+      host: matrix.thehellings.com

manifests/matrix/kustomization.yaml

@@ -0,0 +1,7 @@
+namespace: matrix
+
+resources:
+  - dendrite-config.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

manifests/matrix/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dendrite
+  labels:
+    app: dendrite
+spec:
+  selector:
+    app: dendrite
+  ports:
+    - port: 8008
+      targetPort: http
+      protocol: TCP
+  type: ClusterIP

manifests/namespaces/kustomization.yaml

@@ -2,3 +2,4 @@ resources:
   - external-secrets.yaml
   - bitwarden.yaml
   - db.yaml
+  - matrix.yaml

manifests/namespaces/matrix.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: matrix

manifests/secrets/kustomization.yaml

@@ -1,3 +1,4 @@
 resources:
   - postgres-user-gitlab.yaml
   - postgres-user-pgadmin.yaml
+  - postgres-user-matrix.yaml

manifests/secrets/postgres-user-matrix.yaml

@@ -0,0 +1,33 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-matrix
+  namespace: db
+spec:
+  target:
+    name: postgres-user-matrix
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        property: password

modules/nix-conf.nix

@@ -30,7 +30,6 @@
       ]; # For home and for work machines
       substituters =
         (lib.optionals cache [
-          "http://nas.thehellings.lan:9000/binary-cache/"
           "http://nas.home:9000/binary-cache/"
         ])
         ++ [
@@ -41,8 +40,7 @@
           "https://cache.nixos.org"
         ];
       trusted-public-keys = [
-        "nix.thehellings.lan:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
+        "nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
-        "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
         "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
         "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="
         "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="

modules/nixos/kubernetes.nix

@@ -21,8 +21,9 @@ in
 
   config = lib.mkIf cfg.enable {
     age.secrets = {
-      kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
       bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
+      dendrite_key.file = ../../secrets/dendrite_key.age;
+      kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
     };
 
     environment.systemPackages = [