base/matrix/kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: matrix

resources:
  - namespace.yaml
  - tuwunel-deployment.yaml
  - tuwunel-service.yaml
  - tuwunel-config.yaml
  - tuwunel-pvc.yaml
  - vault-secrets.yaml
  - hydra-oauth2client.yaml
  - sol-deployment.yaml
  - sol-config.yaml
  - tuwunel-alertrules.yaml
feat(matrix): add tuwunel Matrix homeserver deployment manifests Kubernetes manifests for tuwunel — a Rust Matrix homeserver using RocksDB for storage. Includes deployment, service, PVC, ConfigMap (tuwunel.toml), Hydra OAuth2Client for SSO, and Vault secrets for credentials injection. Key design decisions: - enableServiceLinks: false to prevent K8s TUWUNEL_* env var conflicts - strategy: Recreate for RocksDB exclusive lock (no rolling updates) - Identity provider configured entirely via env vars (client_id/secret from hydra-maester Secret, not hardcoded) - OpenSearch model_id injected via ConfigMap from CLI post-apply hook - SSO-only auth (login_with_password=false, single_sso=true) - OpenSearch hybrid neural+BM25 search (768-dim, all-mpnet-base-v2) 2026-03-10 18:52:21 +00:00			`apiVersion: kustomize.config.k8s.io/v1beta1`
			`kind: Kustomization`

			`namespace: matrix`

			`resources:`
			`- namespace.yaml`
			`- tuwunel-deployment.yaml`
			`- tuwunel-service.yaml`
			`- tuwunel-config.yaml`
			`- tuwunel-pvc.yaml`
			`- vault-secrets.yaml`
			`- hydra-oauth2client.yaml`
feat(matrix): add Sol virtual librarian deployment manifests Sol is a Matrix bot with E2EE that archives conversations to OpenSearch and responds via Mistral AI function calling. Adds deployment, PVC, ConfigMap (sol.toml + system prompt), VaultStaticSecret for credentials, and production overlay image entry. 2026-03-20 21:38:48 +00:00			`- sol-deployment.yaml`
			`- sol-config.yaml`
feat(monitoring): comprehensive alerting overhaul, 66 rules across 14 PrometheusRules The Longhorn memory leak went undetected for 14 days because alerting was broken (email receiver, missing label selector, no node alerts). This overhaul brings alerting to production grade. Fixes: - Alloy Loki URL pointed to deleted loki-gateway, now loki:3100 - seaweedfs-bucket-init crash on unsupported `mc versioning` command - All PrometheusRules now have `release: kube-prometheus-stack` label - Removed broken email receiver, Matrix-only alerting New alert coverage: - Node: memory, CPU, swap, filesystem, inodes, network, clock skew, OOM - Kubernetes: deployment down, CronJob failed, pod crash-looping, PVC full - Backups: Postgres barman stale/failed, WAL archiving, SeaweedFS mirror - Observability: Prometheus WAL/storage/rules, Loki/Tempo/AlertManager down - Services: Stalwart, Bulwark, Tuwunel, Sol, Valkey, OpenSearch (smart) - SLOs: auth stack 99.9% burn rate, Matrix 99.5%, latency p95 < 2s - Recording rules for Linkerd RED metrics and node aggregates - Watchdog heartbeat → Matrix every 12h (dead pipeline detection) - Inhibition: critical suppresses warning for same alert+namespace - OpenSearchClusterYellow only fires with >1 data node (single-node aware) 2026-04-06 15:52:06 +01:00			`- tuwunel-alertrules.yaml`