Gitiles
Code Review Sign In
gerrit.hackerspace.pl / hscloud / 690ed45f66f3a79a73ee48dbd176e1f51b77b315 / . / app / matrix / lib / synapse.libsonnet
blob: 0b05795d8a115221703d690ad015af2b4ca84d79 [file] [log] [blame]
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]1local kube = import "../../../kube/kube.libsonnet";
2
3{
4 local app = self,
5 local cfg = app.cfg,
6 cfg:: {
7 image: error "cfg.image needs to be set",
8 storageClassName: error "cfg.storrageClassName needs to be set",
9
10 # webDomain is the domain name at which synapse instance will run
11 webDomain: error "cfg.webDomain must be set",
12 # serverName is the server part of the MXID this homeserver will cover
13 serverName: error "cfg.serverName must be set",
14
15 cas: { enable: false },
16 oidc: { enable: false },
17
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]18 appserviceWorker: false,
19 federationWorker: false,
20
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]21 macaroonSecretKey: error "cfg.macaroonSecretKey needs to be set",
22 registrationSharedSecret: error "cfg.registationSharedSecret needs to be set",
23 workerReplicationSecret: error "cfg.workerReplicationSecret needs to be set",
24 },
25
26 ns:: error "ns needs to be provided",
27 postgres:: error "postgres needs to be provided",
28 redis:: error "redis needs to be provided",
29
30 // See matrix-ng.libsonnet for description
31 appservices:: error "appservices need to be provided",
32
33 dataVolume: app.ns.Contain(kube.PersistentVolumeClaim("synapse-data-waw3")) {
34 spec+: {
35 storageClassName: cfg.storageClassName,
36 accessModes: [ "ReadWriteOnce" ],
37 resources: {
38 requests: {
39 storage: "50Gi",
40 },
41 },
42 },
43 },
44
45 // homeserver.yaml that will be used to run synapse (in configMap).
46 // This is based off of //app/matrix/lib/synapse/homeserver.yaml with some fields overriden per
47 // deployment.
48 config:: (std.native("parseYaml"))(importstr "synapse/homeserver-ng.yaml")[0] {
49 server_name: cfg.serverName,
50 public_baseurl: "https://%s" % [cfg.webDomain],
51 signing_key_path: "/secrets/homeserver_signing_key",
52 app_service_config_files: [
53 "/appservices/%s/registration.yaml" % [k]
54 for k in std.objectFields(app.appservices)
55 ],
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]56
57 notify_appservices: cfg.appserviceWorker == false,
58
59 # FIXME(informatic) Rolling out with federationWorkers = true breaks
60 # *some* federation, needs investigation...
61 #send_federation: cfg.federationWorker == false,
62 #federation_sender_instances: if cfg.federationWorker then [
63 # "%s-%s" % [app.federationSenderWorker.deployment.metadata.name, idx]
64 # for idx in std.range(0, app.federationSenderWorker.deployment.spec.replicas)
65 #] else [],
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]66 } + (if cfg.cas.enable then {
67 cas_config: {
68 enabled: true,
69 server_url: "https://%s/_cas" % [cfg.webDomain],
70 service_url: "https://%s" % [cfg.webDomain],
71 },
Piotr Dobrowolski690ed452022-05-07 11:27:24 +0200[diff] [blame^]72 } else {}) + (if cfg.coturn.enable then {
73 turn_uris: [ "turn:%s?transport=udp" % cfg.coturn.config.domain, "turn:%s?transport=tcp" % cfg.coturn.config.domain ],
74
75 # Lifetime of single TURN user credentials - 1 day, recommended by TURN REST
76 # spec, see https://datatracker.ietf.org/doc/html/draft-uberti-behave-turn-rest-00#section-2.2
77 turn_user_lifetime: 24 * 60 * 60 * 1000,
78 turn_allow_guests: true,
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]79 } else {}),
80
81 configMap: app.ns.Contain(kube.ConfigMap("synapse")) {
82 data: {
83 "homeserver.yaml": std.manifestYamlDoc(app.config),
84 "log.config": importstr "synapse/log.config",
85 },
86 },
87
88 // homeserver-secrets.yaml contains all the templated secret variables from
89 // base homeserver.yaml passed as yaml-encoded environment variable.
90 // $(ENVVAR)-encoded variables are resolved by Kubernetes on pod startup
91 secretsConfig:: (std.native("parseYaml"))(importstr "synapse/homeserver-secrets.yaml")[0] {
92 } + (if cfg.oidc.enable then {
93 oidc_config: cfg.oidc.config {
94 enabled: true,
95 client_secret: "$(OIDC_CLIENT_SECRET)",
96 },
Piotr Dobrowolski690ed452022-05-07 11:27:24 +0200[diff] [blame^]97 } else {}) + (if cfg.coturn.enable then {
98 turn_shared_secret: "$(TURN_SHARED_SECRET)",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]99 } else {}),
100
101 # Synapse process Deployment/StatefulSet base resource.
102 SynapseWorker(name, workerType, builder):: app.ns.Contain(builder(name)) {
103 local worker = self,
104 cfg:: {
105 # Configuration customization. Can contain environment substitution
106 # syntax, as used in worker_name value.
107 localConfig: {
108 worker_app: workerType,
109 worker_name: "$(POD_NAME)",
110
111 # The replication listener on the main synapse process.
112 worker_replication_host: "synapse-replication-master",
113 worker_replication_http_port: 9093,
114 },
115
116 # Mount app.dataVolume in /data
117 mountData: false,
118 },
119
120 spec+: {
121 replicas: 1,
122 template+: {
123 spec+: {
124 volumes_: {
125 config: kube.ConfigMapVolume(app.configMap),
126 secrets: { secret: { secretName: "synapse" } },
127 } + {
128 [k]: { secret: { secretName: "appservice-%s-registration" % [k] } }
129 for k in std.objectFields(app.appservices)
130 } + if worker.cfg.mountData then {
131 data: kube.PersistentVolumeClaimVolume(app.dataVolume),
132 } else {},
133 containers_: {
134 web: kube.Container("synapse") {
135 image: cfg.image,
136 command: [
137 "/bin/sh", "-c", |||
138 set -e
139 echo "${X_SECRETS_CONFIG}" > /tmp/secrets.yaml
140 echo "${X_LOCAL_CONFIG}" > /tmp/local.yaml
141 exec python -m ${SYNAPSE_WORKER} --config-path /conf/homeserver.yaml --config-path /tmp/secrets.yaml --config-path /tmp/local.yaml
142 |||
143 ],
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]144 resources: {
145 requests: { cpu: "300m", memory: "1Gi" },
146 limits: { cpu: "1500m", memory: "2Gi" },
147 },
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]148 ports_: {
149 http: { containerPort: 8008 },
150 metrics: { containerPort: 9092 },
151 replication: { containerPort: 9093 },
152 },
153 env_: {
154 SYNAPSE_WORKER: workerType,
155
156 SYNAPSE_MACAROON_SECRET_KEY: cfg.macaroonSecretKey,
157 SYNAPSE_REGISTRATION_SHARED_SECRET: cfg.registrationSharedSecret,
158 WORKER_REPLICATION_SECRET: cfg.workerReplicationSecret,
159 POSTGRES_PASSWORD: app.postgres.cfg.password,
160 REDIS_PASSWORD: app.redis.cfg.password,
161 POD_NAME: { fieldRef: { fieldPath: "metadata.name" } },
162 OIDC_CLIENT_SECRET: if cfg.oidc.enable then cfg.oidc.config.client_secret else "",
Piotr Dobrowolski690ed452022-05-07 11:27:24 +0200[diff] [blame^]163 TURN_SHARED_SECRET: if cfg.coturn.enable then cfg.coturn.config.authSecret else "",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]164
165 X_SECRETS_CONFIG: std.manifestYamlDoc(app.secretsConfig),
166 X_LOCAL_CONFIG: std.manifestYamlDoc(worker.cfg.localConfig),
167 },
168 volumeMounts_: {
169 config: { mountPath: "/conf", },
170 secrets: { mountPath: "/secrets" },
171 } + {
172 [k]: { mountPath: "/appservices/%s" % [k] }
173 for k in std.objectFields(app.appservices)
174 } + if worker.cfg.mountData then {
175 data: { mountPath: "/data" },
176 } else {},
Piotr Dobrowolski77af94d2021-09-16 22:17:58 +0200[diff] [blame]177 readinessProbe: {
178 httpGet: {
179 path: "/health",
180 port: "http",
181 },
182 initialDelaySeconds: 5,
183 periodSeconds: 10,
184 },
185 livenessProbe: {
186 httpGet: {
187 path: "/health",
188 port: "http",
189 },
190 initialDelaySeconds: 60,
191 periodSeconds: 30,
192 },
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]193 },
194 },
195 securityContext: {
196 runAsUser: 991,
197 runAsGroup: 991,
198 fsGroup: 991,
199 },
200 },
201 },
202 },
203 },
204
205 # Synapse main process
206 main: {
207 deployment: app.SynapseWorker("synapse", "synapse.app.homeserver", kube.Deployment) {
208 cfg+: {
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]209 localConfig: {
210 # Following configuration values need to cause master
211 # process restart.
212 notify_appservices: app.config.notify_appservices,
213 # send_federation: app.config.send_federation,
214 # federation_sender_instances: app.config.federation_sender_instances,
215 }
216 },
217 spec+: {
218 strategy+: {
219 rollingUpdate: {
220 maxSurge: 0,
221 maxUnavailable: 1,
222 },
223 },
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]224 },
225 },
226 svc: app.ns.Contain(kube.Service("synapse")) {
227 target_pod:: app.main.deployment.spec.template,
228 },
229 replicationSvc: app.ns.Contain(kube.Service("synapse-replication-master")) {
230 target_pod:: app.main.deployment.spec.template,
231 spec+: {
232 ports: [
233 { port: 9093, name: 'replication', targetPort: 9093 },
234 ],
235 },
236 },
237 },
238
239 genericWorker: {
240 # Synapse generic worker deployment
241 deployment: app.SynapseWorker("synapse-generic", "synapse.app.generic_worker", kube.StatefulSet) {
242 cfg+: {
243 localConfig+: {
244 worker_listeners: [{
245 type: "http",
246 port: 8008,
247 x_forwarded: true,
248 bind_addresses: ["::"],
249 resources: [{ names: ["client", "federation"]}],
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]250 }, {
251 port: 9092,
252 type: "metrics",
253 bind_address: "0.0.0.0",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]254 }],
255 },
256 },
257 },
258 svc: app.ns.Contain(kube.Service("synapse-generic")) {
259 target_pod:: app.genericWorker.deployment.spec.template,
260 },
261
262 # Following paths can be handled by generic workers.
263 # See: https://github.com/matrix-org/synapse/blob/master/docs/workers.md
264 paths:: [
Mateusz Lenik8bd24f42022-04-17 19:56:06 +0200[diff] [blame]265 "/_matrix/client/(r0|v3)/sync",
266 "/_matrix/client/(api/v1|r0|v3)/events",
267 "/_matrix/client/(api/v1|r0|v3)/initialSync",
268 "/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]269 "/_matrix/federation/v1/event/",
270 "/_matrix/federation/v1/state/",
271 "/_matrix/federation/v1/state_ids/",
272 "/_matrix/federation/v1/backfill/",
273 "/_matrix/federation/v1/get_missing_events/",
274 "/_matrix/federation/v1/publicRooms",
275 "/_matrix/federation/v1/query/",
276 "/_matrix/federation/v1/make_join/",
277 "/_matrix/federation/v1/make_leave/",
Mateusz Lenik8bd24f42022-04-17 19:56:06 +0200[diff] [blame]278 "/_matrix/federation/(v1|v2)/send_join/",
279 "/_matrix/federation/(v1|v2)/send_leave/",
280 "/_matrix/federation/(v1|v2)/invite/",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]281 "/_matrix/federation/v1/event_auth/",
282 "/_matrix/federation/v1/exchange_third_party_invite/",
283 "/_matrix/federation/v1/user/devices/",
284 "/_matrix/federation/v1/get_groups_publicised",
285 "/_matrix/key/v2/query",
Mateusz Lenik8bd24f42022-04-17 19:56:06 +0200[diff] [blame]286 "/_matrix/federation/(v1|unstable/org.matrix.msc2946)/hierarchy/",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]287 "/_matrix/federation/v1/send/",
Mateusz Lenik8bd24f42022-04-17 19:56:06 +0200[diff] [blame]288 "/_matrix/client/(api/v1|r0|v3|unstable)/createRoom",
289 "/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms",
290 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members",
291 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*",
292 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members",
293 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state",
294 "/_matrix/client/(v1|unstable/org.matrix.msc2946)/rooms/.*/hierarchy",
295 "/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary",
296 "/_matrix/client/(r0|v3|unstable)/account/3pid",
297 "/_matrix/client/(r0|v3|unstable)/devices",
298 "/_matrix/client/versions",
299 "/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer",
300 "/_matrix/client/(r0|v3|unstable)/joined_groups",
301 "/_matrix/client/(r0|v3|unstable)/publicised_groups",
302 "/_matrix/client/(r0|v3|unstable)/publicised_groups/",
303 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/",
304 "/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms",
305 "/_matrix/client/(api/v1|r0|v3|unstable)/search",
306 "/_matrix/client/(r0|v3|unstable)/keys/query",
307 "/_matrix/client/(r0|v3|unstable)/keys/changes",
308 "/_matrix/client/(r0|v3|unstable)/keys/claim",
309 "/_matrix/client/(r0|v3|unstable)/room_keys/",
310 "/_matrix/client/(api/v1|r0|v3|unstable)/login",
311 "/_matrix/client/(r0|v3|unstable)/register",
312 "/_matrix/client/v1/register/m.login.registration_token/validity",
313 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact",
314 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send",
315 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/",
316 "/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)",
317 "/_matrix/client/(api/v1|r0|v3|unstable)/join/",
318 "/_matrix/client/(api/v1|r0|v3|unstable)/profile/",
Piotr Dobrowolski7d0e56c2022-04-30 00:25:39 +0200[diff] [blame]319
320 # These need to be handled by stream writers, not supported yet
321 # "/_matrix/client/(r0|v3|unstable)/sendToDevice/",
322 # "/_matrix/client/(r0|v3|unstable)/.*/tags",
323 # "/_matrix/client/(r0|v3|unstable)/.*/account_data",
324 # "/_matrix/client/(r0|v3|unstable)/rooms/.*/receipt",
325 # "/_matrix/client/(r0|v3|unstable)/rooms/.*/read_markers",
326 # "/_matrix/client/(api/v1|r0|v3|unstable)/presence/",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]327 ],
328 },
329
330 # Synapse media worker. This handles access to uploads and media stored in app.dataVolume
331 mediaWorker: {
332 deployment: app.SynapseWorker("synapse-media", "synapse.app.media_repository", kube.StatefulSet) {
333 cfg+: {
334 mountData: true,
335 localConfig+: {
336 worker_listeners: [{
337 type: "http",
338 port: 8008,
339 x_forwarded: true,
340 bind_addresses: ["::"],
341 resources: [{ names: ["media"]}],
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]342 }, {
343 port: 9092,
344 type: "metrics",
345 bind_address: "0.0.0.0",
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]346 }],
347 },
348 },
349 },
350 svc: app.ns.Contain(kube.Service("synapse-media")) {
351 target_pod:: app.mediaWorker.deployment.spec.template,
352 },
353 },
Piotr Dobrowolski529e1812021-02-13 19:44:37 +0100[diff] [blame]354
355 appserviceWorker: if cfg.appserviceWorker then {
356 # Worker responsible for sending traffic to registered appservices
357 deployment: app.SynapseWorker("synapse-appservice", "synapse.app.appservice", kube.StatefulSet) {
358 cfg+: {
359 localConfig+: {
360 worker_listeners: [{
361 type: "http",
362 port: 8008,
363 x_forwarded: true,
364 bind_addresses: ["::"],
365 resources: [{ names: [] }],
366 }, {
367 port: 9092,
368 type: "metrics",
369 bind_address: "0.0.0.0",
370 }],
371 },
372 },
373 },
374 } else null,
375
376 federationSenderWorker: if cfg.federationWorker then {
377 deployment: app.SynapseWorker("synapse-federation-sender", "synapse.app.federation_sender", kube.StatefulSet) {
378 cfg+: {
379 localConfig+: {
380 worker_listeners: [{
381 type: "http",
382 port: 8008,
383 x_forwarded: true,
384 bind_addresses: ["::"],
385 resources: [{ names: [] }],
386 }, {
387 port: 9092,
388 type: "metrics",
389 bind_address: "0.0.0.0",
390 }],
391 },
392 },
393 spec+: {
394 replicas: 2,
395 },
396 },
397 } else null,
Piotr Dobrowolskib67ae482021-01-31 10:35:38 +0100[diff] [blame]398}