Skip to content

Commit 5d1dbf8

Browse files
gaelgatelementgaelgatelement
authored
Merge pull request #454 from element-hq/gaelg/add-syn2mas
Implement Synapse to MAS migration
2 parents a18278f + 36658e4 commit 5d1dbf8

File tree

60 files changed

+2102
-210
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+2102
-210
lines changed

‎charts/matrix-stack/ci/fragments/matrix-authentication-service-auth-synapse.yaml

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎charts/matrix-stack/ci/fragments/matrix-authentication-service-migrated-password-scheme.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Copyright 2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
5+
matrixAuthenticationService:
6+
additional:
7+
password-scheme.yml:
8+
config: |
9+
passwords:
10+
schemes:
11+
- version: 1
12+
algorithm: bcrypt
13+
- version: 2
14+
algorithm: argon2id

‎charts/matrix-stack/ci/fragments/matrix-authentication-service-pytest-extras.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ matrixAuthenticationService:
1919
configSecret: "{{ $.Release.Name }}-pytest-admin"
2020
configSecretKey: "admin.yaml"
2121

22+
syn2mas:
23+
extraEnv:
24+
- name: DEBUG_RENDERING
25+
value: "1"
26+
2227
postgres:
2328
podSecurityContext:
2429
runAsGroup: 0

‎charts/matrix-stack/ci/fragments/matrix-authentication-service-syn2mas-dryrun.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright 2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
5+
matrixAuthenticationService:
6+
syn2mas:
7+
enabled: true
8+
dryRun: true
9+
10+
additional:
11+
password-scheme.yml:
12+
config: |
13+
passwords:
14+
schemes:
15+
- version: 1
16+
algorithm: bcrypt
17+
- version: 2
18+
algorithm: argon2id

‎charts/matrix-stack/ci/fragments/matrix-authentication-service-syn2mas-migrate.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright 2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
5+
matrixAuthenticationService:
6+
syn2mas:
7+
enabled: true
8+
dryRun: false
9+
10+
additional:
11+
password-scheme.yml:
12+
config: |
13+
passwords:
14+
schemes:
15+
- version: 1
16+
algorithm: bcrypt
17+
- version: 2
18+
algorithm: argon2id

‎charts/matrix-stack/ci/matrix-authentication-service-keep-auth-in-synapse-values.yaml

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎charts/matrix-stack/ci/matrix-authentication-service-synapse-secrets-externally-values.yaml renamed to ‎charts/matrix-stack/ci/matrix-authentication-service-synapse-syn2mas-dry-run-secrets-externally-values.yaml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,22 @@
22
#
33
# SPDX-License-Identifier: AGPL-3.0-only
44
#
5-
# source_fragments: matrix-authentication-service-minimal.yaml matrix-authentication-service-postgres.yaml matrix-authentication-service-postgres-secrets-externally.yaml matrix-authentication-service-secrets-externally.yaml synapse-minimal.yaml synapse-postgres.yaml synapse-postgres-secrets-externally.yaml synapse-secrets-externally.yaml
5+
# source_fragments: matrix-authentication-service-minimal.yaml matrix-authentication-service-postgres.yaml matrix-authentication-service-postgres-secrets-externally.yaml matrix-authentication-service-secrets-externally.yaml synapse-minimal.yaml synapse-postgres.yaml synapse-postgres-secrets-externally.yaml synapse-secrets-externally.yaml matrix-authentication-service-syn2mas-dryrun.yaml
66
# DO NOT EDIT DIRECTLY. Edit the fragment files to add / modify / remove values
77

88
# initSecrets, postgres don't have any required properties to be set and defaults to enabled
99
elementWeb:
1010
enabled: false
1111
matrixAuthenticationService:
12+
additional:
13+
password-scheme.yml:
14+
config: |
15+
passwords:
16+
schemes:
17+
- version: 1
18+
algorithm: bcrypt
19+
- version: 2
20+
algorithm: argon2id
1221
encryptionSecret:
1322
secret: '{{ $.Release.Name }}-mas-external'
1423
secretKey: encryption
@@ -34,6 +43,9 @@ matrixAuthenticationService:
3443
rsa:
3544
secret: '{{ $.Release.Name }}-mas-external'
3645
secretKey: keysRSA
46+
syn2mas:
47+
dryRun: true
48+
enabled: true
3749
synapseOIDCClientSecret:
3850
secret: '{{ $.Release.Name }}-mas-external'
3951
secretKey: synapseOIDC

‎charts/matrix-stack/ci/matrix-authentication-service-synapse-secrets-in-helm-values.yaml renamed to ‎charts/matrix-stack/ci/matrix-authentication-service-synapse-syn2mas-dry-run-secrets-in-helm-values.yaml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,22 @@
22
#
33
# SPDX-License-Identifier: AGPL-3.0-only
44
#
5-
# source_fragments: matrix-authentication-service-minimal.yaml matrix-authentication-service-postgres.yaml matrix-authentication-service-postgres-secrets-in-helm.yaml matrix-authentication-service-secrets-in-helm.yaml synapse-minimal.yaml synapse-postgres.yaml synapse-postgres-secrets-in-helm.yaml synapse-secrets-in-helm.yaml
5+
# source_fragments: matrix-authentication-service-minimal.yaml matrix-authentication-service-postgres.yaml matrix-authentication-service-postgres-secrets-in-helm.yaml matrix-authentication-service-secrets-in-helm.yaml synapse-minimal.yaml synapse-postgres.yaml synapse-postgres-secrets-in-helm.yaml synapse-secrets-in-helm.yaml matrix-authentication-service-syn2mas-dryrun.yaml
66
# DO NOT EDIT DIRECTLY. Edit the fragment files to add / modify / remove values
77

88
# initSecrets, postgres don't have any required properties to be set and defaults to enabled
99
elementWeb:
1010
enabled: false
1111
matrixAuthenticationService:
12+
additional:
13+
password-scheme.yml:
14+
config: |
15+
passwords:
16+
schemes:
17+
- version: 1
18+
algorithm: bcrypt
19+
- version: 2
20+
algorithm: argon2id
1221
encryptionSecret:
1322
value: CHANGEME-ahohhohgiavee5Koh8ahwo
1423
ingress:
@@ -42,6 +51,9 @@ matrixAuthenticationService:
4251
-----BEGIN RSA PRIVATE KEY-----
4352
MIIEowIBAAKCAQEA6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49AwEHoUQDQgAE6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49
4453
------END RSA PRIVATE KEY-----
54+
syn2mas:
55+
dryRun: true
56+
enabled: true
4557
synapseOIDCClientSecret:
4658
value: CHANGEME-eiv6wae8shooPhie4ief8ru2egahbah0
4759
synapseSharedSecret:

‎charts/matrix-stack/ci/matrix-authentication-service-synapse-syn2mas-migrate-secrets-externally-values.yaml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Copyright 2024-2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
#
5+
# source_fragments: matrix-authentication-service-minimal.yaml matrix-authentication-service-postgres.yaml matrix-authentication-service-postgres-secrets-externally.yaml matrix-authentication-service-secrets-externally.yaml synapse-minimal.yaml synapse-postgres.yaml synapse-postgres-secrets-externally.yaml synapse-secrets-externally.yaml matrix-authentication-service-syn2mas-dryrun.yaml matrix-authentication-service-syn2mas-migrate.yaml
6+
# DO NOT EDIT DIRECTLY. Edit the fragment files to add / modify / remove values
7+
8+
# initSecrets, postgres don't have any required properties to be set and defaults to enabled
9+
elementWeb:
10+
enabled: false
11+
matrixAuthenticationService:
12+
additional:
13+
password-scheme.yml:
14+
config: |
15+
passwords:
16+
schemes:
17+
- version: 1
18+
algorithm: bcrypt
19+
- version: 2
20+
algorithm: argon2id
21+
encryptionSecret:
22+
secret: '{{ $.Release.Name }}-mas-external'
23+
secretKey: encryption
24+
ingress:
25+
host: mas.ess.localhost
26+
postgres:
27+
database: mas
28+
host: postgres
29+
password:
30+
secret: '{{ $.Release.Name }}-mas-external'
31+
secretKey: postgresPassword
32+
user: mas
33+
privateKeys:
34+
ecdsaPrime256v1:
35+
secret: '{{ $.Release.Name }}-mas-external'
36+
secretKey: keysEcdsaPrime256v1
37+
ecdsaSecp256k1:
38+
secret: '{{ $.Release.Name }}-mas-external'
39+
secretKey: keysEcdsaSecp256k1
40+
ecdsaSecp384r1:
41+
secret: '{{ $.Release.Name }}-mas-external'
42+
secretKey: keysEcdsaSecp384r1
43+
rsa:
44+
secret: '{{ $.Release.Name }}-mas-external'
45+
secretKey: keysRSA
46+
syn2mas:
47+
dryRun: false
48+
enabled: true
49+
synapseOIDCClientSecret:
50+
secret: '{{ $.Release.Name }}-mas-external'
51+
secretKey: synapseOIDC
52+
synapseSharedSecret:
53+
secret: '{{ $.Release.Name }}-mas-external'
54+
secretKey: synapseShared
55+
matrixRTC:
56+
enabled: false
57+
serverName: ess.localhost
58+
synapse:
59+
appservices:
60+
- secret: '{{ $.Release.Name }}-synapse-external'
61+
secretKey: bridge_registration.yaml
62+
ingress:
63+
host: synapse.ess.localhost
64+
macaroon:
65+
secret: '{{ $.Release.Name }}-synapse-external'
66+
secretKey: macaroon
67+
postgres:
68+
database: synapse
69+
host: ess-postgres
70+
password:
71+
secret: '{{ $.Release.Name }}-synapse-external'
72+
secretKey: postgresPassword
73+
user: synapse_user
74+
registrationSharedSecret:
75+
secret: '{{ $.Release.Name }}-synapse-external'
76+
secretKey: registrationSharedSecret
77+
signingKey:
78+
secret: '{{ $.Release.Name }}-synapse-external'
79+
secretKey: signingKey
80+
wellKnownDelegation:
81+
enabled: false

‎charts/matrix-stack/ci/matrix-authentication-service-synapse-syn2mas-migrate-secrets-in-helm-values.yaml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Copyright 2024-2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
#
5+
# source_fragments: matrix-authentication-service-minimal.yaml matrix-authentication-service-postgres.yaml matrix-authentication-service-postgres-secrets-in-helm.yaml matrix-authentication-service-secrets-in-helm.yaml synapse-minimal.yaml synapse-postgres.yaml synapse-postgres-secrets-in-helm.yaml synapse-secrets-in-helm.yaml matrix-authentication-service-syn2mas-dryrun.yaml matrix-authentication-service-syn2mas-migrate.yaml
6+
# DO NOT EDIT DIRECTLY. Edit the fragment files to add / modify / remove values
7+
8+
# initSecrets, postgres don't have any required properties to be set and defaults to enabled
9+
elementWeb:
10+
enabled: false
11+
matrixAuthenticationService:
12+
additional:
13+
password-scheme.yml:
14+
config: |
15+
passwords:
16+
schemes:
17+
- version: 1
18+
algorithm: bcrypt
19+
- version: 2
20+
algorithm: argon2id
21+
encryptionSecret:
22+
value: CHANGEME-ahohhohgiavee5Koh8ahwo
23+
ingress:
24+
host: mas.ess.localhost
25+
postgres:
26+
database: mas
27+
host: postgres
28+
password:
29+
value: CHANGEME-ooWo6jeidahhei3Hae0eer9U
30+
user: mas
31+
privateKeys:
32+
ecdsaPrime256v1:
33+
value: |
34+
-----BEGIN EC PRIVATE KEY-----
35+
MHcCAQEEIYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49
36+
AwEHoUQDQgAE6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49
37+
AwEAAKBcZW5jb2duZXQwgggYMIINL6Ado018734nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49AwEH
38+
------END EC PRIVATE KEY-----
39+
ecdsaSecp256k1:
40+
value: |
41+
-----BEGIN EC PRIVATE KEY-----
42+
MHcCAQEEZFQZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49AwEHoUQDQgAE6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49
43+
------END EC PRIVATE KEY-----
44+
ecdsaSecp384r1:
45+
value: |
46+
-----BEGIN EC PRIVATE KEY-----
47+
MHcCAQEEZFQZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49AwEHoUQDQgAE6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49
48+
------END EC PRIVATE KEY-----
49+
rsa:
50+
value: |
51+
-----BEGIN RSA PRIVATE KEY-----
52+
MIIEowIBAAKCAQEA6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49AwEHoUQDQgAE6521bYjZ789034nLz+oXJyVWqgUdDmRlKxvTfHsBhFtGpOaAoGCCqGSM49
53+
------END RSA PRIVATE KEY-----
54+
syn2mas:
55+
dryRun: false
56+
enabled: true
57+
synapseOIDCClientSecret:
58+
value: CHANGEME-eiv6wae8shooPhie4ief8ru2egahbah0
59+
synapseSharedSecret:
60+
value: CHANGEME-iaw8eeSef4zeefie8ii3akien9tiaYah
61+
matrixRTC:
62+
enabled: false
63+
serverName: ess.localhost
64+
synapse:
65+
ingress:
66+
host: synapse.ess.localhost
67+
macaroon:
68+
value: CHANGEME-eek3Eigoh8ux8laeTingeej1
69+
postgres:
70+
database: synapse
71+
host: ess-postgres
72+
password:
73+
value: CHANGEME-ooWo6jeidahhei3Hae0eer9U
74+
user: synapse_user
75+
registrationSharedSecret:
76+
value: CHANGEME-ooWo6jeidahhei3Hae0eer9U
77+
signingKey:
78+
value: ed25519 0 bNQOzBUDszff7Ax81z6w0uZ1IPWoxYaazT7emaZEfpw
79+
wellKnownDelegation:
80+
enabled: false

0 commit comments

Comments
 (0)