test

lp/matrix/-d

@@ -0,0 +1 @@
+{"errcode":"M_FORBIDDEN","error":"You are not a server admin"}

lp/matrix/README.md

@@ -70,3 +70,59 @@ nc -zv coturn-lp.allarddcs.nl 5349
 
 #checken certificaat:
 kubectl describe secret coturn-cert -n matrix
+
+#HOOKSHOT
+
+
+#passkey genereren en in secret zetten. Passkey wordt gebruikt om andere sleutels versleuteld op te slaan.
+
+openssl genpkey -out passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
+kubectl -n matrix create secret generic hookshot-passkey --from-file=passkey.pem
+
+#opvragen access token:
+
+curl -X POST "https://matrix-lp.allarddcs.nl/_matrix/client/v3/login"   -H "Content-Type: application/json"   -d '{
+    "type": "m.login.password",
+    "user": "admin",
+    "password": "Matrix01@"
+  }'
+
+syt_YWRtaW4_laSGClQJFMQNKKjqyfVj_1XLp4x
+
+#room aanmaken:
+
+curl -k -X POST \
+  -H "Authorization: Bearer syt_YWRtaW4_bUqQKyFkonSgjkghnuxY_4IsleV" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"harbor","preset":"private_chat"}' \
+  "https://matrix-lp.allarddcs.nl/_matrix/client/v3/createRoom"
+
+{"room_id":"!AmeLKsUWrKBIkosFbY:matrix-lp.allarddcs.nl"}
+
+#toevoegen hookshot bot aan room:
+
+curl -X POST \
+  -H "Authorization: Bearer syt_YWRtaW4_bUqQKyFkonSgjkghnuxY_4IsleV" \
+  -H "Content-Type: application/json" \
+  "https://matrix-lp.allarddcs.nl/_synapse/admin/v1/join/AmeLKsUWrKBIkosFbY:matrix-lp.allarddcs.nl" \
+  -d '{
+    "user_id": "@hookshot:matrix-lp.allarddcs.nl"
+  }'
+
+Opmerking: doordat de bot is toegevoegd wordt de status van de room veranderd in: gemanaged door de appservice. 
+Daardoor kun je de room niet publiceren en ook geen leden uitnodigen.
+
+#toevoegen allardhook aan room:
+
+curl -k -X POST   -H "Authorization: Bearer $ACCESS_TOKEN" \
+  -H "Content-Type: application/json" \
+   "https://matrix-lp.allarddcs.nl/_synapse/admin/v1/join/!BPcyrRUfYdBJrFVdlV:matrix-lp.allarddcs.nl" \
+  -d '{
+    "user_id": "@allard:matrix-lp.allarddcs.nl"
+  }'
+
+#herstarten hookshot
+
+#transformationFunction in state-event schrijven:
+
+curl -k -X PUT   -H "Authorization: Bearer $ACCESS_TOKEN"   -H "Content-Type: application/json"   "https://matrix-lp.allarddcs.nl/_matrix/client/r0/rooms/!BPcyrRUfYdBJrFVdlV:matrix-lp.allarddcs.nl/state/uk.half-shot.matrix-hookshot.generic.hook/generic-1"   -d @harbor-webhook.json

lp/matrix/as-token.txt

@@ -0,0 +1 @@
+d3c8fccbe082aa2a59da362b3805abe4c4cebcd7e822cdbd700d84e7c55c485f

lp/matrix/create-passkey-secret.sh

@@ -0,0 +1 @@
+microk8s kubectl -n matrix create secret generic hookshot-passkey --from-file=passkey.pem

lp/matrix/harbor-webhook.bak

@@ -0,0 +1,5 @@
+{
+  "name": "Harbor Webhook",
+  "webhookId": "harbor",
+  "transformationFunction": "try { const repo=data.repository||{}; const resources=(data.event_data && data.event_data.resources)||[]; let msg=`📦 Repository: ${repo.namespace||''}/${repo.name||''}\n📝 Type: ${data.type||''}\n👤 Operator: ${data.operator||''}\n`; if(resources.length>0){ msg+=`\n💠 Resources:\n`; resources.forEach((r,idx)=>{ msg+=`\n🔹 Resource ${idx+1}:\n`; msg+=`  🏷 Tag: ${r.tag||''}\n`; msg+=`  🆔 Digest: ${r.digest||''}\n`; msg+=`  🌐 URL: ${r.resource_url||''}\n`; }); } result={plain:msg, version:'v2'}; } catch(e){ result={plain:`Error processing webhook: ${e.message}`, version:'v2'}; }"
+}

lp/matrix/harbor-webhook.json

@@ -0,0 +1,5 @@
+{
+  "name": "Harbor Webhook",
+  "webhookId": "harbor",
+  "transformationFunction": "const repo = data.repository || {}; const resources = (data.event_data && data.event_data.resources) || []; let msg = ''; msg += '📦 Repository: ' + (repo.namespace || '') + '/' + (repo.name || '') + '\\n'; msg += '📝 Type: ' + (data.type || '') + '\\n'; msg += '👤 Operator: ' + (data.operator || '') + '\\n'; msg += '\\n'; msg += '💠 Resources:\\n'; resources.forEach((r, i) => { msg += '\\n'; msg += '🔹 Resource ' + (i + 1) + '\\n'; msg += '🏷 Tag: ' + (r.tag || '') + '\\n'; msg += '🆔 Digest: ' + (r.digest || '') + '\\n'; msg += '🌐 URL: ' + (r.resource_url || '') + '\\n'; }); result = { plain: msg, version: 'v2' };"
+}

lp/matrix/hookshot.yaml

@@ -0,0 +1,133 @@
+# ===========================
+# Hookshot Deployment
+# ===========================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-hookshot
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: matrix-hookshot
+  template:
+    metadata:
+      labels:
+        app: matrix-hookshot
+    spec:
+      containers:
+        - name: hookshot
+          image: halfshot/matrix-hookshot:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 9000  # webhooks
+            - containerPort: 9001  # metrics
+            - containerPort: 9002  # widgets
+            - containerPort: 9003  # appservice
+          env:
+            # tell hookshot where to find files
+            - name: CONFIG_PATH
+              value: /data/config.yml
+            - name: REGISTRATION_PATH
+              value: /data/registration.yml
+            - name: TRANSFORM_PATH
+              value: /data/transformationFunction.js
+          volumeMounts:
+            - name: hookshot-data
+              mountPath: /data
+            - name: hookshot-registration
+              mountPath: /data/registration.yml
+              subPath: registration.yml
+      volumes:
+        - name: hookshot-data
+          persistentVolumeClaim:
+            claimName: hookshot-pvc
+        - name: hookshot-registration
+          secret:
+            secretName: matrix-hookshot-registration
+
+---
+
+# ===========================
+# Hookshot Service
+# ===========================
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-hookshot
+  namespace: matrix
+spec:
+  selector:
+    app: matrix-hookshot
+  ports:
+    - name: webhooks
+      port: 9000
+      targetPort: 9000
+    - name: metrics
+      port: 9001
+      targetPort: 9000
+    - name: widgets
+      port: 9002
+      targetPort: 9000
+    - name: appservice
+      port: 9003
+      targetPort: 9003
+    - name: matrix
+      port: 9993
+      targetPort: 9993
+
+---
+# ===========================
+# Hookshot IngressRoute
+# ===========================
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: matrix-hookshot
+  namespace: matrix
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hookshot-lp.allarddcs.nl`) && PathPrefix(`/webhook`)
+      kind: Rule
+      services:
+        - name: matrix-hookshot
+          port: 9000
+  tls:
+    certResolver: default
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: hookshot-pv
+spec:
+  storageClassName: ""
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    server: 192.168.2.110
+    path: /mnt/nfs_share/hookshot
+    readOnly: false
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hookshot-pvc
+  namespace: matrix
+spec:
+  storageClassName: ""
+  volumeName: hookshot-pv
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi

lp/matrix/hs-token.txt

@@ -0,0 +1 @@
+c31f7a18d3d2d79bd7a03e2794d966317155c409699cb6fd0922023cf45f9c3b

lp/matrix/matrix.yaml

@@ -28,10 +28,16 @@ spec:
           volumeMounts:
           - mountPath: /data
             name: matrix
+          - name: hookshot-registration
+            mountPath: /appservices/hookshot-registration.yml
+            subPath: registration.yml
       volumes:
       - name: matrix
         persistentVolumeClaim:
           claimName: matrix-pvc
+      - name: hookshot-registration
+        secret:
+          secretName: matrix-hookshot-registration
 ---
 apiVersion: v1
 kind: Service
@@ -45,7 +51,7 @@ spec:
     port: 8008
   selector:
     app: matrix
-  type: NodePort
+  type: ClusterIP
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute

lp/matrix/passkey.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQCzd15wg6AJEMPP
+Yvx8C/68ypBQMzprQvMNgwB53ZPzJidKwrMUIwT/hyjvyFRo8scx4mNb66ASYmfi
+53P7apReX/yIibrcmDaVXxk4FdxVJ2xoK+OKV1zBbHsfFsyPVOqOOobiMbOuLxJK
+c8Pj3Z1kmD62+Oq/dr6hVHF5gpocie2RK5gJY6DVCc4/Eh2K/Gzhm3plDbYr82h/
+RMz6nRzDKxtEO/yvekOmL5BBC88seBnd2RZf9Dgts1qDslb5jIvgWwrZEsruAxcj
+BLlSGZ/yHTYdytTwX0nqCzqWKxjGTCwAvPDbmy4Y4D8zmaaTYHpvWPHbAkDb5vAo
+eJuI5+j48bTSJhw5s1kOtJ5OdRY6n7W20YtqP1HAg3zt2kVesHOhXLB8sQSlvHQL
+P5iF//i0qMw/CWbGERkzz1DPRuJNsXytBt6Gc+9yZ31Z3xbJTALG47V/ylNgAlnt
+qCqCUfrtJD/Pq0xG0tSpv5uYcRfadkWd0wIdYsIb9m8/7jaa7FVKshzzGIXmT/aY
+4AiVgP8RpkH3gIzoHYXwd3UD8D0RMeWCz94vwz0Ls6zCd5OX8kXo5dtvhUMW4XCQ
+glmlx6BXvWbR8H0VS7aT7KjI23/Pef2VzWo94G7tC8wNaXhvni1bjB8ZyFA6Y4qB
+JreQfo0tD/h3Z+XZmQXHPKpVEahHNQIDAQABAoICAE+ASa2+IV7itltglki9Z5Nq
+iJN+nhp2BgWuSr+xkKDd/fn4VixNdyFbVp8iN4JmSienCizmLHr4bNzve0mc5S0J
+iG1T1htysntpLVrTFFAErtlW1+2o1cY5sDENgIDeNSncc3QwYFCBObERp22B9v9h
+EicsDZHToI8HQV16pZqO31a34RoHsG+vcFYwSDYRrIokvguWD2VY5qm6aLN8dglf
+RyzrBf0WRHGSEG1ANf6VFaBZUrgfD+Pu1+IPVsglorE4o42V7Z+SbuVsakwcXeZ7
+WkXIXJw/Ghc78jAj103A4J1TFb+y9rC+ZkENh+UxkAtTc5B5ZxIDM9A53WzAj0s6
+FPSWUI6ttsj8sAN6zu/McQmW/ysBZclFP8V54lfCCT+02lz/bA5LYwPEIClMAtRP
+nmFuS/fRSP+J2I8hKALhVtufdFT1H7cVcHXsKNMWn8rBZTvMVs1VDfeUPz3EYgd8
+eORSSY/nD6ObY2Y++fpP8ARiR+W+DJR2c4SNqwCdEN7I0pa7I/RJNozu6LHPJZjb
+UOhUxySXUAPUR3WWG+Gfu9o2X2O8uRtw5Q7GokoZkeH+N1O6hCGZNUQqfj/l5qIu
+iqQtxyU7Bf6RQ3vbFdwAp3G1zgtmzN8wxRgPT6G1CezOsi6AJDXQcfA+AoAdhRfa
+W6j34JxNf9WiFWUueoDhAoIBAQDnLAB1vo+ZC6aVE+t60Lr8DVyWFpE/pm2pbC5R
+mlkBQY/qRfM0q78UGeJVNxmUXPOdtidD3BKl+wHDsN60k3Z99gN8XKTYvB1YA3hw
+C0mKnZi/4LoOtPt0zc+ZHgl4jkVsQayS6g2zkZAN+djOwIiPGo1+u3sJAOjT6ko9
+nWimHlQUSSHoLqlzw1At6Se+bbp6M08egsr8EXlLSnoY/zkAIu4SqwhyhsI47DBh
+ZR2y7rV8EPcIaUP8V2GvGj43U8LojjavzUkxxWGpfeF3DlNKS5ULR0tkXmbJNW2W
+znltrfB5T54HFhTxxVZ6wz9+6MRwC+mUY1oPSpbK70UkeNl3AoIBAQDGvbzrpaUJ
+9XOFQSljyEMVb5U0rXnU1736ycIPDcSI4cZn9SMuz7cd3XKR4pw2K8y7WWGoyINV
+GfSl5q+EEN5QbuqGoL15uNUw/Oto/UGKoOr5AwCxXfjw6cHpCVm1PN0P9NGFCdBK
+Ogwfec6ReriYtDtFADtyWomqCEi1VCZsJ1bkf832wQ6b6SjnQzAJU9O+Is0D3pOo
+ApTnW56sIIBEH5wgXnLChocv1NHBGPSa8M/OTYWpt6UQxj9npgX3YAzrlsQX4jV5
+JYZtMWtR8inOLLoHMztiGjTf3HRUZRpWNMSELoeD1LlC3IKjmyqxk25X8HmeqMQf
+UOyQrB0Vd8+zAoIBAQC5vyZjdYnGbJEeShI07dDAxC+3vUxaO2zz7CPPl9iaZMax
+dCE2GiX/jcjJtetMxd9NwtYL9aHaUjSZu91GdRKJpYope/tM1uIxHSDBzp/5zCW3
+T2fQd2Vw9govuu3bO13W3XI/3ebCeVypji7B+fwAGFLHGPeERYHO/PtIRNmYWNgw
+MI8ZE50+khozuZsgrORgWifhmTBml9fBQoeW3EQ9stNelqTD+TnIKSe6qlfRtXKH
+zM3hqUtiUAgCfXCuXhRHbjXMzoNYhYOyf54RXqZYFSEeHdwbOqsWU2LKAP+avF9z
+6iBNC1Yq6ehR3d6AJ6HncfruK2Jq1QES8Gy7IIuDAoIBAQDCBo8gSBE+DcGAQMOV
+xPepP8ydJxegMhgpdTvd0oUjVbiL2YlFtEiEAaROxLvZLx2rcnGjhE6jkLmGFhcY
+ihdg00hnsxoIcejA8MsrLsUEAGImRUYx4xqcqLpFNnm8NPVlFJBQn+oX7V/Uguim
+ovcBLkQG81kWJUntFDVXwhXY1PdCEXwVARmwIQtr6+5DzPEV2Yfp1Sy2g/63eH0K
+cpiG6Y1VFKBZRVlJ2y4EpMZ5VcyrDogFz2J5Y/KW0EFW5xD2F7TN1Gx8H6SDihHK
+aO9jd8sOKHg7KHaibumrUyFJNC7/FSX8EHvlyL5J17zwrIy3kfBKc101bZ3nCAFE
+6jl9AoIBAQDTDryGqb5NCG4O6LaV+coCYpvbcKnD7jss497XI9Fsg4cucypZvNX6
+zl9P4TFPLTWdBrgYxFr/rVS9Aks9sL+9bBMo9f1tVipfDiJ7NmmwYSdzew1ANxnH
+Sh2zfQcQVQsE3Y79bKY/5quJpUMxVJ+fgdSm4js+4ubQvDDGkpy24rpSgghD3IAd
+TJVY7t34aXLrp7L0i57OkxCa0gDCpVIkW2KrG4O2N7Aumk3XFmPttRBuAnZZV+22
+SiovNua1o1B9RYWx2Q/F1oJJMfZV1qDyHe4UxO+6GKO9Z2ETBjIimFc/s/zqLDSx
+BixkpeaGIwGU11xCAxH+NzqpvaqqAZ0P
+-----END PRIVATE KEY-----

lp/matrix/redis.yaml

@@ -0,0 +1,42 @@
+# ===========================
+# Redis Deployment
+# ===========================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+
+---
+
+# ===========================
+# Redis Service
+# ===========================
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: matrix
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+
+

lp/matrix/registration-secret.yaml

@@ -0,0 +1,22 @@
+# ===========================
+# Hookshot Registration Secret
+# ===========================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-hookshot-registration
+  namespace: matrix
+type: Opaque
+stringData:
+  registration.yml: |
+    id: hookshot
+    url: http://matrix-hookshot.matrix.svc.cluster.local:9993
+    as_token: d3c8fccbe082aa2a59da362b3805abe4c4cebcd7e822cdbd700d84e7c55c485f
+    hs_token: c31f7a18d3d2d79bd7a03e2794d966317155c409699cb6fd0922023cf45f9c3b
+    sender_localpart: hookshot
+    namespaces:
+      users:
+        - exclusive: false
+          regex: "^@(hookshot|_webhooks_.*):matrix-lp.allarddcs.nl$"
+      rooms: []
+      aliases: []

lp/matrix/synapse-admin.yaml

@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: synapse-admin
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: synapse-admin
+  template:
+    metadata:
+      labels:
+        app: synapse-admin
+    spec:
+      containers:
+        - name: synapse-admin
+          image: awesometechnologies/synapse-admin:latest
+          ports:
+            - containerPort: 80
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 15
+            timeoutSeconds: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: synapse-admin
+  namespace: matrix
+spec:
+  selector:
+    app: synapse-admin
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: synapse-admin
+  namespace: matrix
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  tls:
+    - hosts:
+        - synapse-admin.matrix-lp.allarddcs.nl
+  rules:
+    - host: synapse-admin.matrix-lp.allarddcs.nl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse-admin
+                port:
+                  number: 80

lp/matrix/werkt/hookshot.yaml

@@ -0,0 +1,221 @@
+# ===========================
+# Hookshot ConfigMap
+# ===========================
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: matrix-hookshot-config
+  namespace: matrix
+data:
+  config.yml: |
+    bridge:
+      domain: matrix-lp.allarddcs.nl
+      url: http://matrix.matrix.svc.cluster.local:8008
+      port: 9993
+      bindAddress: 0.0.0.0
+
+    homeserver:
+      url: http://matrix.matrix.svc.cluster.local:8008
+      domain: matrix-lp.allarddcs.nl
+
+    appservice:
+      id: hookshot
+      as_token: d3c8fccbe082aa2a59da362b3805abe4c4cebcd7e822cdbd700d84e7c55c485f
+      hs_token: c31f7a18d3d2d79bd7a03e2794d966317155c409699cb6fd0922023cf45f9c3b
+      bot:
+        username: hookshot
+        displayname: Hookshot
+
+    logging:
+      level: debug
+
+    listeners:
+      - port: 9000
+        bindAddress: 0.0.0.0
+        resources:
+          - webhooks
+      - port: 9001
+        bindAddress: 0.0.0.0
+        resources:
+          - metrics
+      - port: 9002
+        bindAddress: 0.0.0.0
+        resources:
+          - widgets
+      - port: 9003
+        bindAddress: 0.0.0.0
+        resources:
+          - appservice
+
+    # Redis for persistent token storage
+    cache:
+      redisUri: redis://redis:6379
+
+    generic:
+      enabled: true
+      urlPrefix: https://hookshot-lp.allarddcs.nl/webhook/
+      userIdPrefix: _webhooks_
+      includeHookBody: true
+      allowJsTransformationFunctions: true
+
+    passFile: /data/passkey.pem
+
+    connections:
+      - connectionType: uk.half-shot.matrix-hookshot.generic.hook
+        stateKey: generic-1
+        roomId: "!BPcyrRUfYdBJrFVdlV:matrix-lp.allarddcs.nl"
+        state:
+          name: "Harbor Webhook"
+          webhookId: harbor
+    }
+
+
+
+
+---
+# ===========================
+# Hookshot Deployment
+# ===========================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-hookshot
+  namespace: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: matrix-hookshot
+  template:
+    metadata:
+      labels:
+        app: matrix-hookshot
+    spec:
+      containers:
+        - name: hookshot
+          image: halfshot/matrix-hookshot:latest
+          ports:
+            - name: webhooks
+              containerPort: 9000
+            - name: metrics
+              containerPort: 9001
+            - name: widgets
+              containerPort: 9002
+            - name: appservice
+              containerPort: 9003
+            - name: matrix
+              containerPort: 9993
+          volumeMounts:
+            - name: config
+              mountPath: /data/config.yml
+              subPath: config.yml
+            - name: registration
+              mountPath: /data/registration.yml
+              subPath: registration.yml
+            - name: hookshot-passkey
+              mountPath: /data/passkey.pem
+              subPath: passkey.pem
+          env:
+            - name: CONFIG_FILE
+              value: /data/config.yml
+            - name: REGISTRATION_FILE
+              value: /data/registration.yml
+            - name: NODE_TLS_REJECT_UNAUTHORIZED
+              value: "0"
+            - name: NODE_OPTIONS
+              value: "--dns-result-order=ipv4first"
+      volumes:
+        - name: config
+          configMap:
+            name: matrix-hookshot-config
+        - name: registration
+          secret:
+            secretName: matrix-hookshot-registration
+        - name: hookshot-passkey
+          secret:
+            secretName: hookshot-passkey
+
+---
+
+# ===========================
+# Hookshot Service
+# ===========================
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-hookshot
+  namespace: matrix
+spec:
+  selector:
+    app: matrix-hookshot
+  ports:
+    - name: webhooks
+      port: 9000
+      targetPort: 9000
+    - name: metrics
+      port: 9001
+      targetPort: 9000
+    - name: widgets
+      port: 9002
+      targetPort: 9000
+    - name: appservice
+      port: 9003
+      targetPort: 9003
+    - name: matrix
+      port: 9993
+      targetPort: 9993
+
+---
+# ===========================
+# Hookshot IngressRoute
+# ===========================
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: matrix-hookshot
+  namespace: matrix
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hookshot-lp.allarddcs.nl`) && PathPrefix(`/webhook`)
+      kind: Rule
+      services:
+        - name: matrix-hookshot
+          port: 9000
+  tls:
+    certResolver: default
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: hookshot-pv
+spec:
+  storageClassName: ""
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    server: 192.168.2.110
+    path: /mnt/nfs_share/hookshot/lp
+    readOnly: false
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: hookshot-pvc
+  namespace: matrix
+spec:
+  storageClassName: ""
+  volumeName: hookshot-pv
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi

lp/matrix/werkt/matrix.yaml

@@ -0,0 +1,122 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix
+  namespace: matrix
+  labels:
+    app: matrix
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: matrix
+  template:
+    metadata:
+      labels:
+        app: matrix
+    spec:
+      containers:
+        - name: matrix
+          image: matrixdotorg/synapse:latest
+#          args:
+#          - generate
+          env:
+          - name: SYNAPSE_SERVER_NAME
+            value: "matrix-lp.allarddcs.nl"
+#          - name: SYNAPSE_REPORT_STATS
+#            value: "yes"
+          volumeMounts:
+          - mountPath: /data
+            name: matrix
+          - name: hookshot-registration
+            mountPath: /appservices/hookshot-registration.yml
+            subPath: registration.yml
+      volumes:
+      - name: matrix
+        persistentVolumeClaim:
+          claimName: matrix-pvc
+      - name: hookshot-registration
+        secret:
+          secretName: matrix-hookshot-registration
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix
+  namespace: matrix
+spec:
+  ports:
+  - name: http
+    targetPort: 8008
+    port: 8008
+  selector:
+    app: matrix
+  type: ClusterIP
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: matrix-http
+  namespace: matrix
+spec:
+  entryPoints:
+    - web
+  routes:
+  - match: Host(`matrix-lp.allarddcs.nl`)
+    kind: Rule
+    services:
+    - name: matrix
+      port: 8008
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: matrix-tls
+  namespace: matrix
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`matrix-lp.allarddcs.nl`)
+    kind: Rule
+    services:
+    - name: matrix
+      port: 8008
+  tls:
+    secretName: matrix-lp.allarddcs.nl-tls
+#    certResolver: letsencrypt
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: matrix-pv
+spec:
+  storageClassName: ""
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    server: 192.168.2.110
+    path: /mnt/nfs_share/matrix/lp
+    readOnly: false
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: matrix-pvc
+  namespace: matrix
+spec:
+  storageClassName: ""
+  volumeName: matrix-pv
+  accessModes:
+    - ReadWriteMany
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+

lp/matrix/werkt/registration-secret.yaml

@@ -0,0 +1,22 @@
+# ===========================
+# Hookshot Registration Secret
+# ===========================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-hookshot-registration
+  namespace: matrix
+type: Opaque
+stringData:
+  registration.yml: |
+    id: hookshot
+    url: http://matrix-hookshot.matrix.svc.cluster.local:9993
+    as_token: d3c8fccbe082aa2a59da362b3805abe4c4cebcd7e822cdbd700d84e7c55c485f
+    hs_token: c31f7a18d3d2d79bd7a03e2794d966317155c409699cb6fd0922023cf45f9c3b
+    sender_localpart: hookshot
+    namespaces:
+      users:
+        - exclusive: true
+          regex: "^@(hookshot|_webhooks_.*):matrix-lp.allarddcs.nl$"
+      rooms: []
+      aliases: []