jklein
1ddb5f457e
Three changes, across both workloads (Synapse StatefulSet and delegation nginx Deployment). 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the whole matrix.delegation block with its own contexts, probes and resources. 2. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }} and the key is added to values.yaml with default true, so behaviour is unchanged. The domain checkpoint found a second reader: the delegation nginx serves ingress.domain in its /.well-known/matrix/{server,client} endpoints, and read it without a guard. Gating alone would therefore have published '{"m.server": ":443"}' and base_url "https://" - a federation-breaking answer that renders and starts cleanly. Both reads are now required(), so that case fails loudly. Only clusterIssuer actually becomes unnecessary when the Ingress is off. 3. Null-safety for hardening, probes and resources (#99) for both workloads. The rebuilt probes keep each workload's own endpoint: Synapse /health, delegation /.well-known/matrix/server - the endpoint that workload exists to serve - including its shorter 3s timeout. The delegation pod context keeps having no fsGroup, because it mounts no volume that needs one. The nginx checksum/config annotation from #82 is untouched. storage stays deliberately not null-safe: an erased block yields an invalid PVC, which is the loud class #99 excludes. Rendering is byte-identical to 6.0.0, both with the CI values (which enable delegation) and with the production bundle values.
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
{{- if .Values.matrix.delegation.enabled }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-configmap
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
# The container runs as the unprivileged nginx user with a read-only root
|
|
# filesystem: pid file and temp paths live in the /tmp emptyDir, and the
|
|
# listen port is unprivileged (8080).
|
|
pid /tmp/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
|
|
server {
|
|
listen 8080;
|
|
|
|
location /.well-known/matrix/server {
|
|
return 200 '{"m.server": "{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}:443"}';
|
|
add_header Content-Type application/json;
|
|
}
|
|
|
|
location /.well-known/matrix/client {
|
|
return 200 '{"m.homeserver": {"base_url": "https://{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}"}}';
|
|
add_header Content-Type application/json;
|
|
add_header "Access-Control-Allow-Origin" *;
|
|
}
|
|
}
|
|
}
|
|
{{- end }} |