apiVersion: apps/v1
kind: Deployment
metadata:
  name: matrix-synapse
  labels:
    helm.sh/chart: matrix-synapse-3.12.28
    app.kubernetes.io/name: matrix-synapse
    app.kubernetes.io/instance: matrix-synapse
    app.kubernetes.io/version: "1.153.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: synapse
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: matrix-synapse
      app.kubernetes.io/instance: matrix-synapse
      app.kubernetes.io/component: synapse
  template:
    metadata:
      annotations:
        checksum/config: c0f93c4beb460f846799d1674260e4d63286aaf0e9985d47f85dcb37847863f6
        checksum/secrets: 491cf516a28ed40d9defe569859307b9bd8d64940c156ff9733737c25bf3205e
      labels:
        app.kubernetes.io/name: matrix-synapse
        app.kubernetes.io/instance: matrix-synapse
        app.kubernetes.io/component: synapse
    spec:
      serviceAccountName: matrix-synapse
      securityContext: {}
      initContainers:
        - name: volume-permissions
          command:
            - sh
            - -c
            - |
              chown 666:666 -R /synapse/data
          image: "alpine:3.23.4@sha256:c7989ac7a27b473e1795973c98d714f62b4dd0b134594d36880505ce0bfd716b"
          imagePullPolicy: Always
          resources: {}
          securityContext:
            runAsNonRoot: false
            runAsUser: 0
          volumeMounts:
            - name: media
              mountPath: /synapse/data
      containers:
        - name: synapse
          command:
            - sh
            - -c
            - |
              export POSTGRES_PASSWORD=$(echo "${POSTGRES_PASSWORD:-}" | sed 's/\//\\\//g' | sed 's/\&/\\\&/g') && \
              export REDIS_PASSWORD=$(echo "${REDIS_PASSWORD:-}" | sed 's/\//\\\//g' | sed 's/\&/\\\&/g') && \
              cat /synapse/secrets/*.yaml | \
                sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
                    -e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
                       > /synapse/config/conf.d/secrets.yaml

              exec python -B -m synapse.app.homeserver \
                          -c /synapse/config/homeserver.yaml \
                          -c /synapse/config/conf.d/
          env:
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: matrix-synapse-postgresql-18-cluster-app
                  key: password
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: matrix-synapse-valkey-config
                  key: password
          image: "ghcr.io/element-hq/synapse:v1.153.0@sha256:8ba9310909c4f255f942e504d9e5e5d9a7f20e3fa1cdf5aea8acb704b6a15098"
          imagePullPolicy: IfNotPresent
          securityContext: {}
          ports:
            - name: http
              containerPort: 8008
              protocol: TCP
            - name: replication
              containerPort: 9093
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /health
              port: http
          readinessProbe:
            httpGet:
              path: /health
              port: http
          startupProbe:
            failureThreshold: 12
            httpGet:
              path: /health
              port: http
          volumeMounts:
            - name: config
              mountPath: /synapse/config
            - name: tmpconf
              mountPath: /synapse/config/conf.d
            - name: secrets
              mountPath: /synapse/secrets
            - name: signingkey
              mountPath: /synapse/keys
            - name: media
              mountPath: /synapse/data
            - name: tmpdir
              mountPath: /tmp
            - mountPath: /synapse/config/conf.d/config.yaml
              mountPropagation: None
              name: synapse-config
              readOnly: true
              subPath: config.yaml
            - mountPath: /synapse/config/conf.d/oidc.yaml
              mountPropagation: None
              name: oidc-config
              readOnly: true
              subPath: oidc.yaml
            - mountPath: /synapse/config/conf.d/hookshot-registration.yaml
              mountPropagation: None
              name: hookshot-config
              readOnly: true
              subPath: hookshot-registration.yaml
            - mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
              mountPropagation: None
              name: mautrix-discord-config
              readOnly: true
              subPath: mautrix-discord-registration.yaml
            - mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
              mountPropagation: None
              name: mautrix-whatsapp-config
              readOnly: true
              subPath: mautrix-whatsapp-registration.yaml
            - mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
              mountPropagation: None
              name: double-puppet-config
              readOnly: true
              subPath: double-puppet-registration.yaml
          resources:
            requests:
              cpu: 10m
              memory: 130Mi
      volumes:
        - name: config
          configMap:
            name: matrix-synapse
        - name: secrets
          secret:
            secretName: matrix-synapse
        - name: signingkey
          secret:
            secretName: "matrix-synapse-signing-key"
            items:
              - key: "signing.key"
                path: signing.key
        - name: tmpconf
          emptyDir: {}
        - name: tmpdir
          emptyDir: {}
        - name: media
          persistentVolumeClaim:
            claimName: matrix-synapse
        - csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: matrix-synapse-config
          name: synapse-config
        - csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: matrix-synapse-oidc-config
          name: oidc-config
        - csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: matrix-synapse-hookshot-config
          name: hookshot-config
        - csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: matrix-synapse-mautrix-discord-config
          name: mautrix-discord-config
        - csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: matrix-synapse-mautrix-whatsapp-config
          name: mautrix-whatsapp-config
        - csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: matrix-synapse-double-puppet-config
          name: double-puppet-config
