138 lines
4.0 KiB
YAML
138 lines
4.0 KiB
YAML
# Element Web at element.renner.uno, locked to matrix.renner.uno: no custom
|
|
# homeserver, no guests, no registration, no integration manager, no
|
|
# analytics (no posthog block), no bug-report endpoint.
|
|
#
|
|
# feature_login_with_qr: "Sign in with QR code" on the welcome page, so a new
|
|
# browser can be linked from a signed-in device. Linking a phone from the
|
|
# desktop (Settings → Sessions → Link new device) needs no flag; it shows
|
|
# when the server offers MSC4108 and the session has cross-signing.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: element-config
|
|
namespace: matrix
|
|
data:
|
|
config.json: |
|
|
{
|
|
"default_server_config": {
|
|
"m.homeserver": {
|
|
"base_url": "https://matrix.renner.uno",
|
|
"server_name": "matrix.renner.uno"
|
|
}
|
|
},
|
|
"disable_custom_urls": true,
|
|
"disable_guests": true,
|
|
"disable_3pid_login": true,
|
|
"default_country_code": "DE",
|
|
"room_directory": { "servers": ["matrix.renner.uno"] },
|
|
"integrations_ui_url": "",
|
|
"integrations_rest_url": "",
|
|
"integrations_widgets_urls": [],
|
|
"bug_report_endpoint_url": "",
|
|
"show_labs_settings": false,
|
|
"features": {
|
|
"feature_login_with_qr": true
|
|
},
|
|
"setting_defaults": {
|
|
"UIFeature.registration": false,
|
|
"UIFeature.passwordReset": false,
|
|
"UIFeature.thirdPartyId": false,
|
|
"UIFeature.identityServer": false,
|
|
"UIFeature.deactivate": false
|
|
}
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: element-web
|
|
namespace: matrix
|
|
annotations:
|
|
configmap.reloader.stakater.com/reload: element-config
|
|
labels:
|
|
app.kubernetes.io/name: element-web
|
|
app.kubernetes.io/part-of: matrix
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: element-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: element-web
|
|
app.kubernetes.io/part-of: matrix
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: element-web
|
|
image: ghcr.io/element-hq/element-web:v1.12.30@sha256:3e7dbd4424de9e11c812bc740acf2725b2abe66ea0d0802023b56fd85d3fa09a
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
env:
|
|
# Unprivileged port: the image runs as nginx, not root.
|
|
- name: ELEMENT_WEB_PORT
|
|
value: "8080"
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 128Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /config.json
|
|
port: http
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /config.json
|
|
port: http
|
|
periodSeconds: 30
|
|
volumeMounts:
|
|
# The entrypoint copies /app/config*.json to /tmp and serves it
|
|
# from there, so the ConfigMap lands at the source path.
|
|
- name: config
|
|
mountPath: /app/config.json
|
|
subPath: config.json
|
|
readOnly: true
|
|
# Writable paths for a read-only root: the entrypoint renders the
|
|
# nginx template into conf.d; pid and temp files go to /tmp.
|
|
- name: conf-d
|
|
mountPath: /etc/nginx/conf.d
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: element-config
|
|
- name: conf-d
|
|
emptyDir: {}
|
|
- name: tmp
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: element-web
|
|
namespace: matrix
|
|
spec:
|
|
selector:
|
|
app.kubernetes.io/name: element-web
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: http
|