test

2025-12-22 08:24:52 +01:00
parent 4b6f071349
commit d623200d5d
50 changed files with 3941 additions and 147 deletions
--- a/lp/hookshot/hookshot/.helmignore
+++ b/lp/hookshot/hookshot/.helmignore
@@ -0,0 +1,24 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+*.tgz
--- a/lp/hookshot/hookshot/.yamllint
+++ b/lp/hookshot/hookshot/.yamllint
@@ -0,0 +1,7 @@
+---
+extends: default
+rules:
+  line-length:
+    level: warning
+    max: 120
+  braces: disable
--- a/lp/hookshot/hookshot/Chart.yaml
+++ b/lp/hookshot/hookshot/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+appVersion: 6.0.2
+description: Deploy a Matrix Hookshot instance to Kubernetes
+name: hookshot
+type: application
+version: 0.1.16
--- a/lp/hookshot/hookshot/README.md
+++ b/lp/hookshot/hookshot/README.md
@@ -0,0 +1,122 @@
+# hookshot
+
+![Version: 0.1.13](https://img.shields.io/badge/Version-0.1.13-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.2.0](https://img.shields.io/badge/AppVersion-3.2.0-informational?style=flat-square)
+Deploy a Matrix Hookshot instance to Kubernetes
+
+Status: Beta
+
+## About
+
+This chart creates a basic Hookshot deployment inside Kubernetes.
+
+# Installation
+
+You'll need to have the Helm repository added to your local environment:
+
+``` bash
+helm repo add hookshot https://matrix-org.github.io/matrix-hookshot
+helm repo update
+```
+
+Which should allow you to see the Hookshot chart in the repo:
+
+``` bash
+helm search repo hookshot
+
+NAME                            CHART VERSION   APP VERSION     DESCRIPTION               
+matrix-org/hookshot             0.1.13          1.16.0          A Helm chart for Kubernetes
+```
+
+Before you can install, however, you'll need to make sure to configure Hookshot properly.
+
+# Configuration
+
+You'll need to create a `values.yaml` for your deployment of this chart. You can use the [included defaults](./values.yaml) as a starting point.
+
+## Helm Values
+
+To configure Hookshot-specific parameters, the value `.Values.hookshot.config` accepts an arbitrary YAML map as configuration. This gets templated into the container by [templates/configmap.yaml](./templates/configmap.yaml) - thus anything you can set in the [Example Configuration](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html) can be set here.
+
+## Existing configuration
+
+If you have an existing configuration file for Hookshot, you can create a configmap like so:
+
+``` bash
+kubectl create --namespace "your hookshot namespace" configmap hookshot-custom-config --from-file=config.yml --from-file=registration.yml --from-file=passkey.pem
+```
+
+Note that the filenames must remain as listed based on the templating done in [templates/configmap.yaml](./templates/configmap.yaml)
+
+Once created, you can set `.Values.hookshot.existingConfigMap` to `custom-hookshot-config` (or whichever name you chose for your secret) and set `.Values.hookshot.config` to `{}` or null to prevent confusion with the default parameters.
+
+# Installation
+
+Once you have your `values.yaml` file ready you can install the chart like this:
+
+``` bash
+helm install hookshot --create-namespace --namespace hookshot matrix-org/hookshot -f values.yaml
+```
+
+And upgrades can be done via:
+
+``` bash
+helm upgrade hookshot --namespace hookshot matrix-org/hookshot -f values.yaml
+```
+
+# External access
+
+You'll need to configure your Ingress connectivity according to your environment. This chart should be compatible with most Ingress controllers and has been tested successfully with [ingress-nginx](https://github.com/kubernetes/ingress-nginx) and EKS ALB. You should also ensure that you have a way to provision certificates i.e. [cert-manager](https://cert-manager.io/) as HTTPS is required for appservice traffic.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` | Affinity settings for deployment |
+| autoscaling.enabled | bool | `false` |  |
+| fullnameOverride | string | `""` | Full name override for helm chart |
+| hookshot.config | object | `{"bridge":{"bindAddress":"0.0.0.0","domain":"example.com","port":9002,"url":"https://example.com"},"generic":{"allowJsTransformationFunctions":true,"enableHttpGet":false,"enabled":true,"urlPrefix":"https://example.com/","userIdPrefix":"_webhooks_","waitForComplete":false},"listeners":[{"bindAddress":"0.0.0.0","port":9000,"resources":["webhooks","widgets"]},{"bindAddress":"0.0.0.0","port":9001,"resources":["metrics"]}],"logging":{"colorize":false,"json":false,"level":"info","timestampFormat":"HH:mm:ss:SSS"},"metrics":{"enabled":true},"passFile":"/data/passkey.pem","widgets":{"addToAdminRooms":false,"branding":{"widgetTitle":"Hookshot Configuration"},"publicUrl":"https://webhook-hookshot.example.com/widgetapi/v1/static","roomSetupWidget":{"addOnInvite":false},"setRoomName":false}}` | Raw Hookshot configuration. Gets templated into a YAML file and then loaded unless an existingConfigMap is specified. |
+| hookshot.existingConfigMap | string | `nil` | Name of existing ConfigMap with valid Hookshot configuration |
+| hookshot.passkey | string | `""` |  |
+| hookshot.registration.as_token | string | `""` |  |
+| hookshot.registration.hs_token | string | `""` |  |
+| hookshot.registration.id | string | `"matrix-hookshot"` |  |
+| hookshot.registration.namespaces.rooms | list | `[]` |  |
+| hookshot.registration.namespaces.users | list | `[]` |  |
+| hookshot.registration.rate_limited | bool | `false` |  |
+| hookshot.registration.sender_localpart | string | `"hookshot"` |  |
+| hookshot.registration.url | string | `"http://example.com"` |  |
+| image.pullPolicy | string | `"IfNotPresent"` | Pull policy for Hookshot image |
+| image.repository | string | `"halfshot/matrix-hookshot"` | Repository to pull hookshot image from |
+| image.tag | string | `nil` | Image tag to pull. Defaults to chart's appVersion value as set in Chart.yaml |
+| imagePullSecrets | list | `[]` | List of names of k8s secrets to be used as ImagePullSecrets for the pod |
+| ingress.appservice.annotations | object | `{}` | Annotations for appservice ingress |
+| ingress.appservice.className | string | `""` | Ingress class name for appservice ingress |
+| ingress.appservice.enabled | bool | `false` | Enable ingress for appservice |
+| ingress.appservice.hosts | list | `[]` | Host configuration for appservice ingress |
+| ingress.appservice.tls | list | `[]` | TLS configuration for appservice ingress |
+| ingress.webhook.annotations | object | `{}` | Annotations for webhook ingress |
+| ingress.webhook.className | string | `""` | Ingress class name for webhook ingress |
+| ingress.webhook.enabled | bool | `false` | Enable ingress for webhook |
+| ingress.webhook.hosts | list | `[]` | Host configuration for webhook ingress |
+| ingress.webhook.tls | list | `[]` | TLS configuration for webhook ingress |
+| nameOverride | string | `""` | Name override for helm chart |
+| nodeSelector | object | `{}` | Node selector parameters |
+| podAnnotations | object | `{}` | Extra annotations for Hookshot pod |
+| podSecurityContext | object | `{}` | Pod security context settings |
+| replicaCount | int | `1` | Number of replicas to deploy. Consequences of using multiple Hookshot replicas currently unknown. |
+| resources | object | `{}` | Pod resource requests / limits |
+| securityContext | object | `{}` | Security context settings |
+| service.annotations | object | `{}` | Extra annotations for service |
+| service.appservice.port | int | `9002` | Appservice port as configured in container |
+| service.labels | object | `{}` | Extra labels for service |
+| service.metrics.port | int | `9001` | Metrics port as configured in container |
+| service.port | int | `80` | Port for Hookshot service |
+| service.type | string | `"ClusterIP"` | Service type for Hookshot service |
+| service.webhook.port | int | `9000` | Webhook port as configured in container |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+| tolerations | list | `[]` | Tolerations for deployment |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
--- a/lp/hookshot/hookshot/README.md.gotmpl
+++ b/lp/hookshot/hookshot/README.md.gotmpl
@@ -0,0 +1,74 @@
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+{{ template "chart.badgesSection" . }}
+{{ template "chart.description" . }}
+
+Status: Beta
+
+## About
+
+This chart creates a basic Hookshot deployment inside Kubernetes.
+
+# Installation
+
+You'll need to have the Helm repository added to your local environment:
+
+``` bash
+helm repo add hookshot https://matrix-org.github.io/matrix-hookshot
+helm repo update
+```
+
+Which should allow you to see the Hookshot chart in the repo:
+
+``` bash
+helm search repo hookshot
+
+NAME                            CHART VERSION   APP VERSION     DESCRIPTION                
+matrix-org/hookshot             0.1.13          1.16.0          A Helm chart for Kubernetes
+```
+
+Before you can install, however, you'll need to make sure to configure Hookshot properly.
+
+# Configuration
+
+You'll need to create a `values.yaml` for your deployment of this chart. You can use the [included defaults](./values.yaml) as a starting point.
+
+## Helm Values
+
+To configure Hookshot-specific parameters, the value `.Values.hookshot.config` accepts an arbitrary YAML map as configuration. This gets templated into the container by [templates/configmap.yaml](./templates/configmap.yaml) - thus anything you can set in the [Example Configuration](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html) can be set here.
+
+## Existing configuration
+
+If you have an existing configuration file for hookshot, you can create a configmap like so:
+
+``` bash
+kubectl create --namespace "your hookshot namespace" configmap hookshot-custom-config --from-file=config.yml --from-file=registration.yml --from-file=passkey.pem
+```
+
+Note that the filenames must remain as listed based on the templating done in [templates/configmap.yaml](./templates/configmap.yaml)
+
+Once created, you can set `.Values.hookshot.existingConfigMap` to `custom-hookshot-config` (or whichever name you chose for your secret) and set `.Values.hookshot.config` to `{}` or null to prevent confusion with the default parameters.
+
+# Installation
+
+Once you have your `values.yaml` file ready you can install the chart like this:
+
+``` bash
+helm install hookshot --create-namespace --namespace hookshot matrix-org/hookshot -f values.yaml
+```
+
+And upgrades can be done via:
+
+``` bash
+helm upgrade hookshot --namespace hookshot matrix-org/hookshot -f values.yaml
+```
+
+# External access
+
+You'll need to configure your Ingress connectivity according to your environment. This chart should be compatible with most Ingress controllers and has been tested successfully with [ingress-nginx](https://github.com/kubernetes/ingress-nginx) and EKS ALB. You should also ensure that you have a way to provision certificates i.e. [cert-manager](https://cert-manager.io/) as HTTPS is required for appservice traffic.
+
+{{ template "chart.maintainersSection" . }}
+{{ template "chart.sourcesSection" . }}
+{{ template "chart.requirementsSection" . }}
+{{ template "chart.valuesSection" . }}
+{{ template "helm-docs.versionFooter" . }}
--- a/lp/hookshot/hookshot/templates/NOTES.txt
+++ b/lp/hookshot/hookshot/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hookshot.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "hookshot.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "hookshot.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "hookshot.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
--- a/lp/hookshot/hookshot/templates/_helpers.tpl
+++ b/lp/hookshot/hookshot/templates/_helpers.tpl
@@ -0,0 +1,85 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hookshot.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hookshot.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Helper for configmap name
+*/}}
+{{- define "hookshot.configMapName" -}}
+{{- if .Values.hookshot.existingConfigMap }}
+{{- printf "%s" .Values.hookshot.existingConfigMap -}}
+{{- else }}
+{{- printf "%s-config" (include "hookshot.fullname" .) | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "hookshot.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "hookshot.labels" -}}
+helm.sh/chart: {{ include "hookshot.chart" . }}
+{{ include "hookshot.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "hookshot.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "hookshot.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "hookshot.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "hookshot.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "hookshot.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
--- a/lp/hookshot/hookshot/templates/_pod.tpl
+++ b/lp/hookshot/hookshot/templates/_pod.tpl
@@ -0,0 +1,160 @@
+{{- define "hookshot.pod" -}}
+{{- if .Values.schedulerName }}
+schedulerName: "{{ .Values.schedulerName }}"
+{{- end }}
+serviceAccountName: {{ template "hookshot.serviceAccountName" . }}
+automountServiceAccountToken: {{ .Values.serviceAccount.autoMount }}
+{{- if .Values.securityContext }}
+securityContext:
+{{ toYaml .Values.securityContext | indent 2 }}
+{{- end }}
+{{- if .Values.hostAliases }}
+hostAliases:
+{{ toYaml .Values.hostAliases | indent 2 }}
+{{- end }}
+{{- if .Values.priorityClassName }}
+priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+initContainers:
+
+{{- if .Values.image.pullSecrets }}
+imagePullSecrets:
+{{- $root := . }}
+{{- range .Values.image.pullSecrets }}
+  - name: {{ tpl . $root }}
+{{- end}}
+{{- end }}
+containers:
+  - name: {{ .Chart.Name }}
+    {{- if .Values.image.sha }}
+    image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}@sha256:{{ .Values.image.sha }}"
+    {{- else }}
+    image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+    {{- end }}
+    imagePullPolicy: {{ .Values.image.pullPolicy }}
+  {{- if .Values.command }}
+    command:
+    {{- range .Values.command }}
+      - {{ . }}
+    {{- end }}
+  {{- end}}
+{{- if .Values.containerSecurityContext }}
+    securityContext:
+{{- toYaml .Values.containerSecurityContext | nindent 6 }}
+{{- end }}
+    volumeMounts:
+{{- if or (and (not .Values.hookshot.existingConfigMap) (.Values.hookshot.config)) (.Values.hookshot.existingConfigMap) }}
+      - name: config
+        mountPath: "/data"
+{{- end }}
+    ports:
+      - name: webhook
+        containerPort: 9000
+        protocol: TCP
+      - name: metrics
+        containerPort: 9001
+        protocol: TCP
+      - name: appservice
+        containerPort: 9002
+        protocol: TCP
+    env:
+      
+    envFrom:
+    {{- if .Values.envFromSecret }}
+      - secretRef:
+          name: {{ tpl .Values.envFromSecret . }}
+    {{- end }}
+    {{- if .Values.envRenderSecret }}
+      - secretRef:
+          name: {{ template "hookshot.fullname" . }}-env
+    {{- end }}
+    {{- range .Values.envFromSecrets }}
+      - secretRef:
+          name: {{ tpl .name $ }}
+          optional: {{ .optional | default false }}
+    {{- end }}
+    {{- range .Values.envFromConfigMaps }}
+      - configMapRef:
+          name: {{ tpl .name $ }}
+          optional: {{ .optional | default false }}
+    {{- end }}
+    livenessProbe:
+{{ toYaml .Values.livenessProbe | indent 6 }}
+    readinessProbe:
+{{ toYaml .Values.readinessProbe | indent 6 }}
+{{- if .Values.lifecycleHooks }}
+    lifecycle: {{ tpl (.Values.lifecycleHooks | toYaml) . | nindent 6 }}
+{{- end }}
+    resources:
+{{ toYaml .Values.resources | indent 6 }}
+{{- with .Values.extraContainers }}
+{{ tpl . $ | indent 2 }}
+{{- end }}
+{{- with .Values.nodeSelector }}
+nodeSelector:
+{{ toYaml . | indent 2 }}
+{{- end }}
+{{- $root := . }}
+{{- with .Values.affinity }}
+affinity:
+{{ tpl (toYaml .) $root | indent 2 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+topologySpreadConstraints:
+{{ toYaml . | indent 2 }}
+{{- end }}
+{{- with .Values.tolerations }}
+tolerations:
+{{ toYaml . | indent 2 }}
+{{- end }}
+volumes:
+  - name: config
+    configMap:
+      name: {{ template "hookshot.configMapName" . }}
+{{- $root := . }}
+{{- range .Values.extraConfigmapMounts }}
+  - name: {{ tpl .name $root }}
+    configMap:
+      name: {{ tpl .configMap $root }}
+      {{- if .items }}
+      items: {{ toYaml .items | nindent 6 }}
+      {{- end }}
+{{- end }}
+
+{{- range .Values.extraSecretMounts }}
+{{- if .secretName }}
+  - name: {{ .name }}
+    secret:
+      secretName: {{ .secretName }}
+      defaultMode: {{ .defaultMode }}
+      {{- if .items }}
+      items: {{ toYaml .items | nindent 6 }}
+      {{- end }}
+{{- else if .projected }}
+  - name: {{ .name }}
+    projected: {{- toYaml .projected | nindent 6 }}
+{{- else if .csi }}
+  - name: {{ .name }}
+    csi: {{- toYaml .csi | nindent 6 }}
+{{- end }}
+{{- end }}
+{{- range .Values.extraVolumeMounts }}
+  - name: {{ .name }}
+    {{- if .existingClaim }}
+    persistentVolumeClaim:
+      claimName: {{ .existingClaim }}
+    {{- else if .hostPath }}
+    hostPath:
+      path: {{ .hostPath }}
+    {{- else }}
+    emptyDir: {}
+    {{- end }}
+{{- end }}
+{{- range .Values.extraEmptyDirMounts }}
+  - name: {{ .name }}
+    emptyDir: {}
+{{- end -}}
+{{- if .Values.extraContainerVolumes }}
+{{ tpl (toYaml .Values.extraContainerVolumes) . | indent 2 }}
+{{- end }}
+{{- end }}
--- a/lp/hookshot/hookshot/templates/configmap.yaml
+++ b/lp/hookshot/hookshot/templates/configmap.yaml
@@ -0,0 +1,21 @@
+---
+{{- if not .Values.hookshot.existingConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "hookshot.configMapName" . }}
+  namespace: {{ template "hookshot.namespace" . }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+{{- with .Values.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+data:
+  config.yml: |
+{{ toYaml .Values.hookshot.config | indent 4 }}
+  registration.yml: |
+{{ toYaml .Values.hookshot.registration | indent 4 }}
+  passkey.pem: |
+{{ .Values.hookshot.passkey | indent 4 }}
+{{- end }}
--- a/lp/hookshot/hookshot/templates/deployment.yaml
+++ b/lp/hookshot/hookshot/templates/deployment.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hookshot.fullname" . }}
+  namespace: {{ template "hookshot.namespace" . }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "hookshot.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "hookshot.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- include "hookshot.pod" . | nindent 6 }}
--- a/lp/hookshot/hookshot/templates/hpa.yaml
+++ b/lp/hookshot/hookshot/templates/hpa.yaml
@@ -0,0 +1,30 @@
+---
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "hookshot.fullname" . }}
+  namespace: {{ template "hookshot.namespace" . }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "hookshot.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}
--- a/lp/hookshot/hookshot/templates/ingress-appservice.yaml
+++ b/lp/hookshot/hookshot/templates/ingress-appservice.yaml
@@ -0,0 +1,63 @@
+---
+{{- if .Values.ingress.appservice.enabled -}}
+{{- $fullName := include "hookshot.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if and .Values.ingress.appservice.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.appservice.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.appservice.annotations "kubernetes.io/ingress.class" .Values.ingress.appservice.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}-appservice
+  namespace: {{ template "hookshot.namespace" . }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+  {{- with .Values.ingress.appservice.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.appservice.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.appservice.className }}
+  {{- end }}
+  {{- if .Values.ingress.appservice.tls }}
+  tls:
+    {{- range .Values.ingress.appservice.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.appservice.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ .port }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ .port }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
--- a/lp/hookshot/hookshot/templates/ingress.yaml
+++ b/lp/hookshot/hookshot/templates/ingress.yaml
@@ -0,0 +1,63 @@
+---
+{{- if .Values.ingress.webhook.enabled -}}
+{{- $fullName := include "hookshot.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if and .Values.ingress.webhook.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.webhook.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.webhook.annotations "kubernetes.io/ingress.class" .Values.ingress.webhook.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ template "hookshot.namespace" . }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+  {{- with .Values.ingress.webhook.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.webhook.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.webhook.className }}
+  {{- end }}
+  {{- if .Values.ingress.webhook.tls }}
+  tls:
+    {{- range .Values.ingress.webhook.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.webhook.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ .port }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ .port }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
--- a/lp/hookshot/hookshot/templates/service.yaml
+++ b/lp/hookshot/hookshot/templates/service.yaml
@@ -0,0 +1,32 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hookshot.fullname" . }}
+  namespace: {{ template "hookshot.namespace" . }}
+{{- with .Values.service.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+{{- with .Values.service.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.webhook.port }}
+      targetPort: webhook
+      protocol: TCP
+      name: webhook
+    - port: {{ .Values.service.metrics.port }}
+      targetPort: metrics
+      protocol: TCP
+      name: metrics
+    - port: {{ .Values.service.appservice.port }}
+      targetPort: appservice
+      protocol: TCP
+      name: appservice
+  selector:
+    {{- include "hookshot.selectorLabels" . | nindent 4 }}
--- a/lp/hookshot/hookshot/templates/serviceaccount.yaml
+++ b/lp/hookshot/hookshot/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hookshot.serviceAccountName" . }}
+  namespace: {{ template "hookshot.namespace" . }}
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/lp/hookshot/hookshot/templates/tests/test-connection.yaml
+++ b/lp/hookshot/hookshot/templates/tests/test-connection.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "hookshot.fullname" . }}-test-connection"
+  labels:
+    {{- include "hookshot.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "hookshot.fullname" . }}:{{ .Values.service.webhook.port }}']
+  restartPolicy: Never
--- a/lp/hookshot/hookshot/values.yaml
+++ b/lp/hookshot/hookshot/values.yaml
@@ -0,0 +1,454 @@
+---
+# Note: This chart is released using the config.sample.yml file
+#
+# -- Number of replicas to deploy. Consequences of using multiple Hookshot replicas currently unknown.
+replicaCount: 1
+image:
+  # -- Repository to pull hookshot image from
+  repository: halfshot/matrix-hookshot
+  # -- Pull policy for Hookshot image
+  pullPolicy: IfNotPresent
+  # -- Image tag to pull. Defaults to chart's appVersion value as set in Chart.yaml
+  tag:
+# -- List of names of k8s secrets to be used as ImagePullSecrets for the pod
+imagePullSecrets: []
+# -- Name override for helm chart
+nameOverride: ""
+# -- Full name override for helm chart
+fullnameOverride: ""
+serviceAccount:
+  # -- Specifies whether a service account should be created
+  create: true
+  # -- Annotations to add to the service account
+  annotations: {}
+  # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template
+  name: ""
+# -- Extra annotations for Hookshot pod
+podAnnotations: {}
+# -- Pod security context settings
+podSecurityContext: {}
+# fsGroup: 2000
+
+# -- Security context settings
+securityContext: {}
+# capabilities:
+#   drop:
+#   - ALL
+# readOnlyRootFilesystem: true
+# runAsNonRoot: true
+# runAsUser: 1000
+
+service:
+  # -- Service type for Hookshot service
+  type: ClusterIP
+  # -- Port for Hookshot service
+  port: 80
+  # -- Extra annotations for service
+  annotations: {}
+  # -- Extra labels for service
+  labels: {}
+  webhook:
+    # -- Webhook port as configured in container
+    port: 9000
+  metrics:
+    # -- Metrics port as configured in container
+    port: 9001
+  appservice:
+    # -- Appservice port as configured in container
+    port: 9002
+ingress:
+  webhook:
+    # -- Enable ingress for webhook
+    enabled: false
+    # -- Ingress class name for webhook ingress
+    className: ""
+    # -- Annotations for webhook ingress
+    annotations: {}
+    # -- Host configuration for webhook ingress
+    hosts: []
+    # -- TLS configuration for webhook ingress
+    tls: []
+  appservice:
+    # -- Enable ingress for appservice
+    enabled: false
+    # -- Ingress class name for appservice ingress
+    className: ""
+    # -- Annotations for appservice ingress
+    annotations: {}
+    # -- Host configuration for appservice ingress
+    hosts: []
+    # -- TLS configuration for appservice ingress
+    tls: []
+# -- Pod resource requests / limits
+resources: {}
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+autoscaling:
+  enabled: false
+# -- Node selector parameters
+nodeSelector: {}
+# -- Tolerations for deployment
+tolerations: []
+# -- Affinity settings for deployment
+affinity: {}
+hookshot:
+  # -- Name of existing ConfigMap with valid Hookshot configuration
+  existingConfigMap:
+  # -- Raw Hookshot configuration. Gets templated into a YAML file and then loaded unless an existingConfigMap is specified.
+  config:
+    # This is an example configuration file
+    bridge:
+      # Basic homeserver configuration
+      domain: example.com
+      url: http://localhost:8008
+      mediaUrl: https://example.com
+      port: 9993
+      bindAddress: 127.0.0.1
+    logging:
+      # Logging settings. You can have a severity debug,info,warn,error
+      level: info
+      colorize: true
+      json: false
+      timestampFormat: HH:mm:ss:SSS
+    passFile: ./passkey.pem
+    # A passkey used to encrypt tokens stored inside the bridge.
+    # Run openssl genpkey -out passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096 to generate
+    listeners:
+      # HTTP Listener configuration.
+      # Bind resource endpoints to ports and addresses.
+      # 'port' must be specified. Each listener must listen on a unique port.
+      # 'bindAddress' will default to '127.0.0.1' if not specified, which may not be suited to Docker environments.
+      # 'resources' may be any of webhooks, widgets, metrics, provisioning
+      - port: 9000
+        bindAddress: 0.0.0.0
+        resources:
+          - webhooks
+      - port: 9001
+        bindAddress: 127.0.0.1
+        resources:
+          - metrics
+          - provisioning
+      - port: 9002
+        bindAddress: 0.0.0.0
+        resources:
+          - widgets
+  registration:
+  #cache:
+  #  # (Optional) Cache options for large scale deployments. 
+  #  #    For encryption to work, this must be configured.
+  #  redisUri: redis://localhost:6379
+
+  #encryption:
+  #  # (Optional) Configuration for encryption support in the bridge.
+  #  # If omitted, encryption support will be disabled.
+  #  storagePath:
+  #    # Path to the directory used to store encryption files. These files must be persist between restarts of the service.
+  #    ./cryptostore
+
+  #permissions:
+  #  # (Optional) Permissions for using the bridge. See docs/setup.md#permissions for help
+  #  - actor: example.com
+  #    services:
+  #      - service: "*"
+  #        level: admin
+
+  #github:
+  #  # (Optional) Configure this to enable GitHub support
+  #  auth:
+  #    # Authentication for the GitHub App.
+  #    id: 123
+  #    privateKeyFile: github-key.pem
+  #  webhook:
+  #    # Webhook settings for the GitHub app.
+  #    secret: secrettoken
+  #  oauth:
+  #    # (Optional) Settings for allowing users to sign in via OAuth.
+  #    client_id: foo
+  #    client_secret: bar
+  #    redirect_uri: https://example.com/oauth/
+  #  defaultOptions:
+  #    # (Optional) Default options for GitHub connections.
+  #    showIssueRoomLink: false
+  #    hotlinkIssues:
+  #      prefix: "#"
+  #  userIdPrefix:
+  #    # (Optional) Prefix used when creating ghost users for GitHub accounts.
+  #    _github_
+
+  #gitlab:
+  #  # (Optional) Configure this to enable GitLab support
+  #  instances:
+  #    gitlab.com:
+  #      url: https://gitlab.com
+  #  webhook:
+  #    secret: secrettoken
+  #    publicUrl: https://example.com/hookshot/
+  #  userIdPrefix:
+  #    # (Optional) Prefix used when creating ghost users for GitLab accounts.
+  #    _gitlab_
+  #  commentDebounceMs:
+  #    # (Optional) Aggregate comments by waiting this many miliseconds before posting them to Matrix. Defaults to 5000 (5 seconds)
+  #    5000
+
+  #jira:
+  #  # (Optional) Configure this to enable Jira support. Only specify `url` if you are using a On Premise install (i.e. not atlassian.com)
+  #  webhook:
+  #    # Webhook settings for JIRA
+  #    secret: secrettoken
+  #  oauth:
+  #    # (Optional) OAuth settings for connecting users to JIRA. See documentation for more information
+  #    client_id: foo
+  #    client_secret: bar
+  #    redirect_uri: https://example.com/oauth/
+
+  #generic:
+  #  # (Optional) Support for generic webhook events.
+  #  #'allowJsTransformationFunctions' will allow users to write short transformation snippets in code, and thus is unsafe in untrusted environments
+
+  #  enabled: false
+  #  outbound: false
+  #  urlPrefix: https://example.com/webhook/
+  #  userIdPrefix: _webhooks_
+  #  allowJsTransformationFunctions: false
+  #  waitForComplete: false
+  #  enableHttpGet: false
+  #  sendExpiryNotice: false
+  #  requireExpiryTime: false
+  #  maxExpiryTime: 30d
+
+  #figma:
+  #  # (Optional) Configure this to enable Figma support
+  #  publicUrl: https://example.com/hookshot/
+  #  instances:
+  #    your-instance:
+  #      teamId: your-team-id
+  #      accessToken: your-personal-access-token
+  #      passcode: your-webhook-passcode
+
+  #feeds:
+  #  # (Optional) Configure this to enable RSS/Atom feed support
+  #  enabled: false
+  #  pollIntervalSeconds: 600
+  #  pollTimeoutSeconds: 30
+  #  pollConcurrency: 4
+
+  #bot:
+  #  # (Optional) Define profile information for the bot user
+  #  displayname: Hookshot Bot
+  #  avatar: mxc://half-shot.uk/2876e89ccade4cb615e210c458e2a7a6883fe17d
+
+  #serviceBots:
+  #  # (Optional) Define additional bot users for specific services
+  #  - localpart: feeds
+  #    displayname: Feeds
+  #    avatar: ./assets/feeds_avatar.png
+  #    prefix: "!feeds"
+  #    service: feeds
+
+  #widgets:
+  #  # (Optional) EXPERIMENTAL support for complimentary widgets
+  #  addToAdminRooms: false
+  #  publicUrl: https://example.com/widgetapi/v1/static/
+  #  roomSetupWidget:
+  #    addOnInvite: false
+  #  disallowedIpRanges:
+  #    - 127.0.0.0/8
+  #    - 10.0.0.0/8
+  #    - 172.16.0.0/12
+  #    - 192.168.0.0/16
+  #    - 100.64.0.0/10
+  #    - 192.0.0.0/24
+  #    - 169.254.0.0/16
+  #    - 192.88.99.0/24
+  #    - 198.18.0.0/15
+  #    - 192.0.2.0/24
+  #    - 198.51.100.0/24
+  #    - 203.0.113.0/24
+  #    - 224.0.0.0/4
+  #    - ::1/128
+  #    - fe80::/10
+  #    - fc00::/7
+  #    - 2001:db8::/32
+  #    - ff00::/8
+  #    - fec0::/10
+  #  branding:
+  #    widgetTitle: Hookshot Configuration
+
+  #provisioning:
+  #  # (Optional) Provisioning API for integration managers
+  #  secret: "!secretToken"
+
+  #metrics:
+  #  # (Optional) Prometheus metrics support
+  #  enabled: true
+
+  #sentry:
+  #  # (Optional) Configure Sentry error reporting
+  #  dsn: https://examplePublicKey@o0.ingest.sentry.io/0
+  #  environment: production
+    #github:
+    #  # (Optional) Configure this to enable GitHub support
+    #  auth:
+    #    # Authentication for the GitHub App.
+    #    id: 123
+    #    privateKeyFile: github-key.pem
+    #  webhook:
+    #    # Webhook settings for the GitHub app.
+    #    secret: secrettoken
+    #  oauth:
+    #    # (Optional) Settings for allowing users to sign in via OAuth.
+    #    client_id: foo
+    #    client_secret: bar
+    #    redirect_uri: https://example.com/oauth/
+    #  defaultOptions:
+    #    # (Optional) Default options for GitHub connections.
+    #    showIssueRoomLink: false
+    #    hotlinkIssues:
+    #      prefix: "#"
+    #  userIdPrefix:
+    #    # (Optional) Prefix used when creating ghost users for GitHub accounts.
+    #    _github_
+
+    #gitlab:
+    #  # (Optional) Configure this to enable GitLab support
+    #  instances:
+    #    gitlab.com:
+    #      url: https://gitlab.com
+    #  webhook:
+    #    secret: secrettoken
+    #    publicUrl: https://example.com/hookshot/
+    #  userIdPrefix:
+    #    # (Optional) Prefix used when creating ghost users for GitLab accounts.
+    #    _gitlab_
+    #  commentDebounceMs:
+    #    # (Optional) Aggregate comments by waiting this many miliseconds before posting them to Matrix. Defaults to 5000 (5 seconds)
+    #    5000
+
+    #figma:
+    #  # (Optional) Configure this to enable Figma support
+    #  publicUrl: https://example.com/hookshot/
+    #  instances:
+    #    your-instance:
+    #      teamId: your-team-id
+    #      accessToken: your-personal-access-token
+    #      passcode: your-webhook-passcode
+
+    #jira:
+    #  # (Optional) Configure this to enable Jira support. Only specify `url` if you are using a On Premise install (i.e. not atlassian.com)
+    #  webhook:
+    #    # Webhook settings for JIRA
+    #    secret: secrettoken
+    #  oauth:
+    #    # (Optional) OAuth settings for connecting users to JIRA. See documentation for more information
+    #    client_id: foo
+    #    client_secret: bar
+    #    redirect_uri: https://example.com/oauth/
+
+    #generic:
+    #  # (Optional) Support for generic webhook events.
+    #  #'allowJsTransformationFunctions' will allow users to write short transformation snippets in code, and thus is unsafe in untrusted environments
+
+    #  enabled: false
+    #  enableHttpGet: false
+    #  urlPrefix: https://example.com/webhook/
+    #  userIdPrefix: _webhooks_
+    #  allowJsTransformationFunctions: false
+    #  waitForComplete: false
+
+    #feeds:
+    #  # (Optional) Configure this to enable RSS/Atom feed support
+    #  enabled: false
+    #  pollConcurrency: 4
+    #  pollIntervalSeconds: 600
+    #  pollTimeoutSeconds: 30
+
+    #provisioning:
+    #  # (Optional) Provisioning API for integration managers
+    #  secret: "!secretToken"
+
+    #bot:
+    #  # (Optional) Define profile information for the bot user
+    #  displayname: Hookshot Bot
+    #  avatar: mxc://half-shot.uk/2876e89ccade4cb615e210c458e2a7a6883fe17d
+
+    #serviceBots:
+    #  # (Optional) Define additional bot users for specific services
+    #  - localpart: feeds
+    #    displayname: Feeds
+    #    avatar: ./assets/feeds_avatar.png
+    #    prefix: "!feeds"
+    #    service: feeds
+
+    #metrics:
+    #  # (Optional) Prometheus metrics support
+    #  enabled: true
+
+    #cache:
+    #  # (Optional) Cache options for large scale deployments.
+    #  # For encryption to work, this must be configured.
+    #  redisUri: redis://localhost:6379
+
+    #queue:
+    #  # (Optional) Message queue configuration options for large scale deployments.
+    #  # For encryption to work, this must not be configured.
+    #  redisUri: redis://localhost:6379
+
+    #widgets:
+    #  # (Optional) EXPERIMENTAL support for complimentary widgets
+    #  addToAdminRooms: false
+    #  disallowedIpRanges:
+    #    - 127.0.0.0/8
+    #    - 10.0.0.0/8
+    #    - 172.16.0.0/12
+    #    - 192.168.0.0/16
+    #    - 100.64.0.0/10
+    #    - 192.0.0.0/24
+    #    - 169.254.0.0/16
+    #    - 192.88.99.0/24
+    #    - 198.18.0.0/15
+    #    - 192.0.2.0/24
+    #    - 198.51.100.0/24
+    #    - 203.0.113.0/24
+    #    - 224.0.0.0/4
+    #    - ::1/128
+    #    - fe80::/10
+    #    - fc00::/7
+    #    - 2001:db8::/32
+    #    - ff00::/8
+    #    - fec0::/10
+    #  roomSetupWidget:
+    #    addOnInvite: false
+    #  publicUrl: https://example.com/widgetapi/v1/static/
+    #  branding:
+    #    widgetTitle: Hookshot Configuration
+
+    #sentry:
+    #  # (Optional) Configure Sentry error reporting
+    #  dsn: https://examplePublicKey@o0.ingest.sentry.io/0
+    #  environment: production
+
+    #permissions:
+    #  # (Optional) Permissions for using the bridge. See docs/setup.md#permissions for help
+    #  - actor: example.com
+    #    services:
+    #      - service: "*"
+    #        level: admin
+    id: matrix-hookshot
+    as_token: ""
+    hs_token: ""
+    namespaces:
+      rooms: []
+      users: []
+    sender_localpart: hookshot
+    url: "http://example.com"
+    rate_limited: false
+  passkey: ""
--- a/lp/hookshot/output.yaml
+++ b/lp/hookshot/output.yaml
@@ -0,0 +1,172 @@
+---
+# Source: hookshot/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hookshot
+  namespace: matrix
+  labels:
+    helm.sh/chart: hookshot-0.1.16
+    app.kubernetes.io/name: hookshot
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "6.0.2"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: hookshot/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hookshot-config
+  namespace: matrix
+  labels:
+    helm.sh/chart: hookshot-0.1.16
+    app.kubernetes.io/name: hookshot
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "6.0.2"
+    app.kubernetes.io/managed-by: Helm
+data:
+  config.yml: |
+    bridge:
+      bindAddress: 127.0.0.1
+      domain: matrix-lp.allarddcs.nl
+      mediaUrl: https://matrix-lp.allarddcs.nl
+      port: 9993
+      url: http://matrix-lp:8008
+    listeners:
+    - bindAddress: 0.0.0.0
+      port: 9000
+      resources:
+      - webhooks
+    - bindAddress: 127.0.0.1
+      port: 9001
+      resources:
+      - metrics
+      - provisioning
+    - bindAddress: 0.0.0.0
+      port: 9002
+      resources:
+      - widgets
+    logging:
+      colorize: true
+      json: false
+      level: info
+      timestampFormat: HH:mm:ss:SSS
+    passFile: passkey.pem
+  registration.yml: |
+    as_token: ""
+    generic:
+      enabled: true
+      urlPrefix: https://hookshot-lp.allarddcs.nl
+    hs_token: ""
+    id: matrix-hookshot
+    namespaces:
+      rooms: []
+      users: []
+    rate_limited: false
+    sender_localpart: hookshot
+    url: http://example.com
+  passkey.pem: |
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hookshot
+  namespace: matrix
+  labels:
+    helm.sh/chart: hookshot-0.1.16
+    app.kubernetes.io/name: hookshot
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "6.0.2"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9000
+      targetPort: webhook
+      protocol: TCP
+      name: webhook
+    - port: 9001
+      targetPort: metrics
+      protocol: TCP
+      name: metrics
+    - port: 9002
+      targetPort: appservice
+      protocol: TCP
+      name: appservice
+  selector:
+    app.kubernetes.io/name: hookshot
+    app.kubernetes.io/instance: release-name
+---
+# Source: hookshot/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hookshot
+  namespace: matrix
+  labels:
+    helm.sh/chart: hookshot-0.1.16
+    app.kubernetes.io/name: hookshot
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "6.0.2"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hookshot
+      app.kubernetes.io/instance: release-name
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hookshot
+        app.kubernetes.io/instance: release-name
+    spec:
+      containers:
+        - name: hookshot
+          image: "halfshot/matrix-hookshot:6.0.2"
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: config
+              mountPath: "/data"
+          ports:
+            - name: webhook
+              containerPort: 9000
+              protocol: TCP
+            - name: metrics
+              containerPort: 9001
+              protocol: TCP
+            - name: appservice
+              containerPort: 9002
+              protocol: TCP
+          env:
+          envFrom:
+          livenessProbe:
+            null
+          readinessProbe:
+            null
+          resources:
+            {}
+      volumes:
+        - name: config
+          configMap:
+            name: release-name-hookshot-config
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "hookshot-test-connection"
+  labels:
+    helm.sh/chart: hookshot-0.1.16
+    app.kubernetes.io/name: hookshot
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "6.0.2"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['hookshot:9000']
+  restartPolicy: Never
--- a/lp/hookshot/values.yaml
+++ b/lp/hookshot/values.yaml
@@ -0,0 +1,244 @@
+---
+# Note: This chart is released using the config.sample.yml file
+#
+# -- Number of replicas to deploy. Consequences of using multiple Hookshot replicas currently unknown.
+replicaCount: 1
+image:
+  # -- Repository to pull hookshot image from
+  repository: halfshot/matrix-hookshot
+  # -- Pull policy for Hookshot image
+  pullPolicy: IfNotPresent
+  # -- Image tag to pull. Defaults to chart's appVersion value as set in Chart.yaml
+  tag:
+# -- List of names of k8s secrets to be used as ImagePullSecrets for the pod
+imagePullSecrets: []
+# -- Name override for helm chart
+nameOverride: ""
+# -- Full name override for helm chart
+fullnameOverride: ""
+serviceAccount:
+  # -- Specifies whether a service account should be created
+  create: true
+  # -- Annotations to add to the service account
+  annotations: {}
+  # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template
+  name: ""
+# -- Extra annotations for Hookshot pod
+podAnnotations: {}
+# -- Pod security context settings
+podSecurityContext: {}
+# fsGroup: 2000
+
+# -- Security context settings
+securityContext: {}
+# capabilities:
+#   drop:
+#   - ALL
+# readOnlyRootFilesystem: true
+# runAsNonRoot: true
+# runAsUser: 1000
+
+service:
+  # -- Service type for Hookshot service
+  type: ClusterIP
+  # -- Port for Hookshot service
+  port: 80
+  # -- Extra annotations for service
+  annotations: {}
+  # -- Extra labels for service
+  labels: {}
+  webhook:
+    # -- Webhook port as configured in container
+    port: 9000
+  metrics:
+    # -- Metrics port as configured in container
+    port: 9001
+  appservice:
+    # -- Appservice port as configured in container
+    port: 9002
+ingress:
+  webhook:
+    # -- Enable ingress for webhook
+    enabled: false
+    # -- Ingress class name for webhook ingress
+    className: ""
+    # -- Annotations for webhook ingress
+    annotations: {}
+    # -- Host configuration for webhook ingress
+    hosts: []
+    # -- TLS configuration for webhook ingress
+    tls: []
+  appservice:
+    # -- Enable ingress for appservice
+    enabled: false
+    # -- Ingress class name for appservice ingress
+    className: ""
+    # -- Annotations for appservice ingress
+    annotations: {}
+    # -- Host configuration for appservice ingress
+    hosts: []
+    # -- TLS configuration for appservice ingress
+    tls: []
+# -- Pod resource requests / limits
+resources: {}
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+autoscaling:
+  enabled: false
+# -- Node selector parameters
+nodeSelector: {}
+# -- Tolerations for deployment
+tolerations: []
+# -- Affinity settings for deployment
+affinity: {}
+hookshot:
+  # -- Name of existing ConfigMap with valid Hookshot configuration
+  existingConfigMap:
+  # -- Raw Hookshot configuration. Gets templated into a YAML file and then loaded unless an existingConfigMap is specified.
+  config:
+    # This is an example configuration file
+    bridge:
+      # Basic homeserver configuration
+      domain: matrix-lp.allarddcs.nl
+      url: http://matrix-lp:8008
+      mediaUrl: https://matrix-lp.allarddcs.nl
+      port: 9993
+      bindAddress: 127.0.0.1
+    passFile: passkey.pem
+    # A passkey used to encrypt tokens stored inside the bridge.
+    # Run openssl genpkey -out passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096 to generate
+    logging:
+      # Logging settings. You can have a severity debug,info,warn,error
+      level: info
+      colorize: true
+      json: false
+      timestampFormat: HH:mm:ss:SSS
+    listeners:
+      # HTTP Listener configuration.
+      # Bind resource endpoints to ports and addresses.
+      # 'port' must be specified. Each listener must listen on a unique port.
+      # 'bindAddress' will default to '127.0.0.1' if not specified, which may not be suited to Docker environments.
+      # 'resources' may be any of webhooks, widgets, metrics, provisioning
+      - port: 9000
+        bindAddress: 0.0.0.0
+        resources:
+          - webhooks
+      - port: 9001
+        bindAddress: 127.0.0.1
+        resources:
+          - metrics
+          - provisioning
+      - port: 9002
+        bindAddress: 0.0.0.0
+        resources:
+          - widgets
+  registration:
+
+    generic:
+  #  # (Optional) Support for generic webhook events.
+  #  #'allowJsTransformationFunctions' will allow users to write short transformation snippets in code, and thus is unsafe in untrusted environments
+
+      enabled: true
+  #  enableHttpGet: false
+      urlPrefix: https://hookshot-lp.allarddcs.nl
+  #  userIdPrefix: _webhooks_
+  #  allowJsTransformationFunctions: false
+  #  waitForComplete: false
+
+  #feeds:
+  #  # (Optional) Configure this to enable RSS/Atom feed support
+  #  enabled: false
+  #  pollConcurrency: 4
+  #  pollIntervalSeconds: 600
+  #  pollTimeoutSeconds: 30
+
+  #provisioning:
+  #  # (Optional) Provisioning API for integration managers
+  #  secret: "!secretToken"
+
+  #bot:
+  #  # (Optional) Define profile information for the bot user
+  #  displayname: Hookshot Bot
+  #  avatar: mxc://half-shot.uk/2876e89ccade4cb615e210c458e2a7a6883fe17d
+
+  #serviceBots:
+  #  # (Optional) Define additional bot users for specific services
+  #  - localpart: feeds
+  #    displayname: Feeds
+  #    avatar: ./assets/feeds_avatar.png
+  #    prefix: "!feeds"
+  #    service: feeds
+
+  #metrics:
+  #  # (Optional) Prometheus metrics support
+  #  enabled: true
+
+  #cache:
+  #  # (Optional) Cache options for large scale deployments.
+  #  # For encryption to work, this must be configured.
+  #  redisUri: redis://localhost:6379
+
+  #queue:
+  #  # (Optional) Message queue configuration options for large scale deployments.
+  #  # For encryption to work, this must not be configured.
+  #  redisUri: redis://localhost:6379
+
+  #widgets:
+  #  # (Optional) EXPERIMENTAL support for complimentary widgets
+  #  addToAdminRooms: false
+  #  disallowedIpRanges:
+  #    - 127.0.0.0/8
+  #    - 10.0.0.0/8
+  #    - 172.16.0.0/12
+  #    - 192.168.0.0/16
+  #    - 100.64.0.0/10
+  #    - 192.0.0.0/24
+  #    - 169.254.0.0/16
+  #    - 192.88.99.0/24
+  #    - 198.18.0.0/15
+  #    - 192.0.2.0/24
+  #    - 198.51.100.0/24
+  #    - 203.0.113.0/24
+  #    - 224.0.0.0/4
+  #    - ::1/128
+  #    - fe80::/10
+  #    - fc00::/7
+  #    - 2001:db8::/32
+  #    - ff00::/8
+  #    - fec0::/10
+  #  roomSetupWidget:
+  #    addOnInvite: false
+  #  publicUrl: https://example.com/widgetapi/v1/static/
+  #  branding:
+  #    widgetTitle: Hookshot Configuration
+
+  #sentry:
+  #  # (Optional) Configure Sentry error reporting
+  #  dsn: https://examplePublicKey@o0.ingest.sentry.io/0
+  #  environment: production
+
+  #permissions:
+  #  # (Optional) Permissions for using the bridge. See docs/setup.md#permissions for help
+  #  - actor: example.com
+  #    services:
+  #      - service: "*"
+  #        level: admin
+    id: matrix-hookshot
+    as_token: ""
+    hs_token: ""
+    namespaces:
+      rooms: []
+      users: []
+    sender_localpart: hookshot
+    url: "http://example.com"
+    rate_limited: false
+  passkey: ""