synapse.yaml

---
kind: Service
apiVersion: v1
metadata:
  name: matrix-synapse-replication
  namespace: matrix
spec:
  ports:
    # Needs listeners added to the Synapse config as well, according to the
    # workers documentation, if workers are to be used
    - name: replication
      protocol: TCP
      port: 9092
      targetPort: 9092
    - name: http_replication
      protocol: TCP
      port: 9093
      targetPort: 9093
  selector:
    app: matrix-synapse
  type: ClusterIP
---
kind: Service
apiVersion: v1
metadata:
  name: matrix-synapse
  namespace: matrix
spec:
  ports:
    - name: http
      protocol: TCP
      port: 8008
      targetPort: 8008
    - name: https
      protocol: TCP
      port: 8448
      targetPort: 8448
  selector:
    app: matrix-synapse
  type: ClusterIP
---
# This secret might be better left to cert-manager or the like to create and fill
kind: Secret
apiVersion: v1
metadata:
  name: matrix-synapse-tls
  namespace: matrix
data:
  tls.crt:
  tls.key:
type: kubernetes.io/tls
---
# This secret must contain a valid Matrix Synapse signing key, one can be generated
# with the generate_signing_key.py script that's provided with the software
kind: Secret
apiVersion: v1
metadata:
  name: matrix-synapse-keys
  namespace: matrix
data:
  signing.key:
type: Opaque
---
apiVersion: v1
data:
  homeserver.yaml: |
    ## Generate a homeserver.yaml file and configure + insert it here
    #
    # ...
    #
kind: ConfigMap
metadata:
  name: matrix-synapse
  namespace: matrix
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: matrix-synapse
  name: matrix-synapse
  namespace: matrix
spec:
  replicas: 1
  selector:
    matchLabels:
      app: matrix-synapse
  template:
    metadata:
      annotations:
        prometheus.io/path: /_synapse/metrics
        prometheus.io/port: "9090"
        prometheus.io/scrape: "true"
      labels:
        app: matrix-synapse
    spec:
      containers:
        - command: # As an example of how to add rest_auth to the container without requiring a separate image
            - sh
            - -c
            - |
              wget https://github.com/kamax-io/matrix-synapse-rest-auth/raw/master/rest_auth_provider.py -O /usr/local/lib/python2.7/site-packages/rest_auth_provider.py
              /matrix-synapse
          env:
            - name: SYNAPSE_CACHE_FACTOR
              value: "5.00"
          image: ananace/matrix-synapse:1.7.3
          imagePullPolicy: IfNotPresent
          livenessProbe:
            httpGet:
              path: /_matrix/client/versions
              port: 8008
              scheme: HTTP
            initialDelaySeconds: 120
          name: matrix-synapse
          readinessProbe:
            httpGet:
              path: /_matrix/client/versions
              port: 8008
              scheme: HTTP
            initialDelaySeconds: 10
          resources:
            # These are just some arbitrary values, will have to be tuned or removed per-deployment
            requests:
              memory: 250Mi
              cpu: 250m
            limits:
              memory: 1Gi
              cpu: 1
          volumeMounts:
            - mountPath: /synapse/data
              name: matrix-synapse-data
            - mountPath: /synapse/keys
              name: matrix-synapse-keys
            - mountPath: /synapse/config
              name: matrix-synapse-config
      restartPolicy: Always
      securityContext:
        fsGroup: 666
        runAsGroup: 666
        runAsUser: 666
      volumes:
        # Will need to be a persistant volume of some kind to support media uploads, unless using matrix-media-repo
        - name: matrix-synapse-data
          emptyDir: {}
        - name: matrix-synapse-keys
          secret:
            secretName: matrix-synapse-keys
        - configMap:
            name: matrix-synapse
          name: matrix-synapse-config