Skip to content

Commit b552173

Browse files
gaelgatelementgaelgatelement
authored
Merge pull request #348 from element-hq/gaelg/tls-enable-by-default
Add ingress.tlsEnabled to disable ingress
2 parents 72e75f9 + ab2ce55 commit b552173

15 files changed

+143
-10
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,8 @@ traefik LoadBalancer 10.43.184.49 172.20.1.60 8080:32100/TCP,844
302302

303303
4. Configure your reverse proxy so that the DNS names you configured are routed to the external IP of traefik on port 8080 (HTTP) and 8443 (HTTPS).
304304

305+
5. If the certificates are handled in your reverse proxy, you can point to port 8080 (HTTP) only and disable TLS in ESS. Copy the file `charts/matrix-stack/ci/fragments/quick-setup-external-cert.yaml` to `tls.yaml`.
306+
305307
##### Example configurations
306308
To make running ESS Community behind a reverse proxy as easy as possible, you can find below some configuration examples for popular webservers.
307309

‎charts/matrix-stack/ci/fragments/quick-setup-external-cert.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Copyright 2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
5+
ingress:
6+
tlsEnabled: false

‎charts/matrix-stack/ci/quick-setup-external-cert-pg-external-values.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright 2024-2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
#
5+
# source_fragments: quick-setup-all-enabled.yaml quick-setup-hostnames.yaml quick-setup-external-cert.yaml quick-setup-postgresql.yaml
6+
# DO NOT EDIT DIRECTLY. Edit the fragment files to add / modify / remove values
7+
8+
# initSecrets, postgres, wellKnownDelegation don't have any required properties to be set and defaults to enabled
9+
elementWeb:
10+
ingress:
11+
host: chat.your.tld
12+
ingress:
13+
tlsEnabled: false
14+
matrixAuthenticationService:
15+
ingress:
16+
host: account.your.tld
17+
postgres:
18+
database: your-matrix-auth-service-database-name
19+
host: your-db-host.tld
20+
password:
21+
value: your-matrix-auth-service-user-password
22+
port: 5432
23+
sslMode: prefer
24+
user: your-matrix-auth-service-user
25+
serverName: your.tld
26+
synapse:
27+
ingress:
28+
host: matrix.your.tld
29+
postgres:
30+
database: your-synapse-database-name
31+
host: your-db-host.tld
32+
password:
33+
value: your-synapse-user-password
34+
port: 5432
35+
sslMode: prefer
36+
user: your-synapse-user

‎charts/matrix-stack/ci/quick-setup-external-cert-pg-with-helm-values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Copyright 2024-2025 New Vector Ltd
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-only
4+
#
5+
# source_fragments: quick-setup-all-enabled.yaml quick-setup-hostnames.yaml quick-setup-external-cert.yaml
6+
# DO NOT EDIT DIRECTLY. Edit the fragment files to add / modify / remove values
7+
8+
# initSecrets, postgres, wellKnownDelegation don't have any required properties to be set and defaults to enabled
9+
elementWeb:
10+
ingress:
11+
host: chat.your.tld
12+
ingress:
13+
tlsEnabled: false
14+
matrixAuthenticationService:
15+
ingress:
16+
host: account.your.tld
17+
serverName: your.tld
18+
synapse:
19+
ingress:
20+
host: matrix.your.tld

‎charts/matrix-stack/configs/well-known/partial-haproxy.cfg.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ frontend well-known-in
2121
{{ if .baseDomainRedirect.enabled }}
2222
{{- if $root.Values.elementWeb.enabled }}
2323
{{- with $root.Values.elementWeb }}
24-
{{- $elementWebHttps := include "element-io.ess-library.ingress.tlsSecret" (dict "root" $root "context" (dict "hosts" (list (required "elementWeb.ingress.host is required" .ingress.host)) "tlsSecret" .ingress.tlsSecret "ingressName" "element-web")) }}
24+
{{- $elementWebHttps := include "element-io.ess-library.ingress.tlsHostsSecret" (dict "root" $root "context" (dict "hosts" (list (required "elementWeb.ingress.host is required" .ingress.host)) "tlsSecret" .ingress.tlsSecret "ingressName" "element-web")) }}
2525
http-request redirect code 301 location http{{ if $elementWebHttps }}s{{ end }}://{{ tpl .ingress.host $root }} unless well-known
2626
{{- end }}
2727
{{- else if .baseDomainRedirect.url }}

‎charts/matrix-stack/source/common/ingress.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
"className": {
1717
"type": "string"
1818
},
19+
"tlsEnabled": {
20+
"type": "boolean"
21+
},
1922
"tlsSecret": {
2023
"type": "string"
2124
},

‎charts/matrix-stack/source/common/ingress_without_host.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010
"className": {
1111
"type": "string"
1212
},
13+
"tlsEnabled": {
14+
"type": "boolean"
15+
},
1316
"tlsSecret": {
1417
"type": "string"
1518
},

‎charts/matrix-stack/source/common/sub_schema_values.yaml.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,9 @@ imagePullSecrets: []
155155
## What Ingress Class Name that should be used for {{ 'all Ingresses by default' if global else 'this Ingress' }}
156156
# className:
157157

158+
## Disable TLS configuration by setting it to false
159+
tlsEnabled: true
160+
158161
## The name of the Secret containing the TLS certificate and the key that should be used for {{ 'all Ingresses by default' if global else 'this Ingress' }}
159162
# tlsSecret:
160163

‎charts/matrix-stack/source/synapse/ingress_with_additional_paths.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
"className": {
1717
"type": "string"
1818
},
19+
"tlsEnabled": {
20+
"type": "boolean"
21+
},
1922
"tlsSecret": {
2023
"type": "string"
2124
},

‎charts/matrix-stack/templates/ess-library/_ingress.tpl‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,28 +32,31 @@ annotations:
3232

3333
{{- define "element-io.ess-library.ingress.tls" -}}
3434
{{- $root := .root -}}
35-
{{- with required "element-io.ess-library.ingress.tlsSecret missing context" .context -}}
35+
{{- with required "element-io.ess-library.ingress.tls missing context" .context -}}
3636
{{- $ingress := required "element-io.ess-library.ingress.tls missing ingress" .ingress -}}
3737
{{- $host := .host | default $ingress.host -}}
38+
{{- $tlsEnabled := and $root.Values.ingress.tlsEnabled .ingress.tlsEnabled -}}
3839
{{- $ingressName := required "element-io.ess-library.ingress.tls missing ingressName" .ingressName -}}
39-
{{- with (include "element-io.ess-library.ingress.tlsSecret" (dict "root" $root "context" (dict "hosts" (list $host) "tlsSecret" $ingress.tlsSecret "ingressName" $ingressName))) }}
40+
{{- if $tlsEnabled }}
4041
tls:
42+
{{- with (include "element-io.ess-library.ingress.tlsHostsSecret" (dict "root" $root "context" (dict "hosts" (list $host) "tlsSecret" $ingress.tlsSecret "ingressName" $ingressName))) }}
4143
{{ . | nindent 2 }}
4244
{{- end -}}
4345
{{- end -}}
4446
{{- end -}}
47+
{{- end -}}
4548

46-
{{- define "element-io.ess-library.ingress.tlsSecret" -}}
49+
{{- define "element-io.ess-library.ingress.tlsHostsSecret" -}}
4750
{{- $root := .root -}}
48-
{{- with required "element-io.ess-library.ingress.tlsSecret missing context" .context -}}
49-
{{- $ingressName := required "element-io.ess-library.ingress.tlsSecret missing ingress name" .ingressName -}}
51+
{{- with required "element-io.ess-library.ingress.tlsHostsSecret missing context" .context -}}
52+
{{- $ingressName := required "element-io.ess-library.ingress.tlsHostsSecret missing ingress name" .ingressName -}}
5053
{{- $hosts := .hosts -}}
5154
{{- $tlsSecret := coalesce .tlsSecret $root.Values.ingress.tlsSecret -}}
52-
{{- if or $tlsSecret $root.Values.certManager -}}
5355
- hosts:
5456
{{- range $host := $hosts }}
5557
- {{ (tpl $host $root) | quote }}
5658
{{- end }}
59+
{{ if or $tlsSecret $root.Values.certManager }}
5760
secretName: {{ (tpl ($tlsSecret | default (printf "{{ .Release.Name }}-%s-certmanager-tls" $ingressName)) $root) | quote }}
5861
{{- end -}}
5962
{{- end -}}

0 commit comments

Comments
 (0)