Sienna Meridian Satterwhite
d2148335de
Kubernetes manifests for tuwunel — a Rust Matrix homeserver using RocksDB for storage. Includes deployment, service, PVC, ConfigMap (tuwunel.toml), Hydra OAuth2Client for SSO, and Vault secrets for credentials injection. Key design decisions: - enableServiceLinks: false to prevent K8s TUWUNEL_* env var conflicts - strategy: Recreate for RocksDB exclusive lock (no rolling updates) - Identity provider configured entirely via env vars (client_id/secret from hydra-maester Secret, not hardcoded) - OpenSearch model_id injected via ConfigMap from CLI post-apply hook - SSO-only auth (login_with_password=false, single_sso=true) - OpenSearch hybrid neural+BM25 search (768-dim, all-mpnet-base-v2)
92 lines
2.7 KiB
YAML
92 lines
2.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: tuwunel
|
|
namespace: matrix
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: tuwunel
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: tuwunel
|
|
spec:
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: tuwunel
|
|
image: tuwunel
|
|
ports:
|
|
- name: http
|
|
containerPort: 6167
|
|
protocol: TCP
|
|
env:
|
|
- name: TUWUNEL_CONFIG
|
|
value: /etc/tuwunel/tuwunel.toml
|
|
- name: TUWUNEL_TURN_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: tuwunel-secrets
|
|
key: TUWUNEL_TURN_SECRET
|
|
- name: TUWUNEL_REGISTRATION_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: tuwunel-secrets
|
|
key: TUWUNEL_REGISTRATION_TOKEN
|
|
- name: TUWUNEL_SEARCH_OPENSEARCH_MODEL_ID
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: opensearch-ml-config
|
|
key: model_id
|
|
optional: true
|
|
- name: TUWUNEL_IDENTITY_PROVIDER__0__BRAND
|
|
value: "Sunbeam"
|
|
- name: TUWUNEL_IDENTITY_PROVIDER__0__ISSUER_URL
|
|
value: "https://auth.DOMAIN_SUFFIX/"
|
|
- name: TUWUNEL_IDENTITY_PROVIDER__0__DEFAULT
|
|
value: "true"
|
|
- name: TUWUNEL_IDENTITY_PROVIDER__0__CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oidc-tuwunel
|
|
key: CLIENT_ID
|
|
- name: TUWUNEL_IDENTITY_PROVIDER__0__CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oidc-tuwunel
|
|
key: CLIENT_SECRET
|
|
volumeMounts:
|
|
- name: tuwunel-data
|
|
mountPath: /data
|
|
- name: tuwunel-config
|
|
mountPath: /etc/tuwunel/tuwunel.toml
|
|
subPath: tuwunel.toml
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /_matrix/client/versions
|
|
port: 6167
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 30
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_matrix/client/versions
|
|
port: 6167
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
limits:
|
|
memory: 1Gi
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 250m
|
|
volumes:
|
|
- name: tuwunel-data
|
|
persistentVolumeClaim:
|
|
claimName: tuwunel-data
|
|
- name: tuwunel-config
|
|
configMap:
|
|
name: tuwunel-config
|