Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
59 commits
Select commit Hold shift + click to select a range
8b0ed63
fix(security): upgrade Synapse to v1.148.0 and migrate CI to GitHub A…
apham0001 Feb 26, 2026
4968439
Merge pull request #1 from apham0001/fix/upgrade-synapse-v1.148.0
apham0001 Feb 26, 2026
a62449a
feat: add multi-arch build (amd64/arm64) and Renovate config
apham0001 Feb 26, 2026
590b90c
Merge pull request #2 from apham0001/feat/multiarch-and-renovate
apham0001 Feb 26, 2026
4d7c8ef
chore: add AGPL-3.0 license
apham0001 Feb 26, 2026
f4608ab
Merge pull request #3 from apham0001/chore/add-agpl-license
apham0001 Feb 26, 2026
d354050
chore: enable renovate on fork + remove unused k8s manifests
apham0001 Feb 26, 2026
abd0b9c
Merge pull request #4 from apham0001/chore/renovate-fork-cleanup
apham0001 Feb 26, 2026
58ea9e1
feat: add Trivy security scan workflow
apham0001 Feb 26, 2026
b343106
chore(deps): update redis docker tag to v6.2.6
renovate[bot] Feb 26, 2026
f07b0cf
chore(deps): update hadolint/hadolint-action action to v3.3.0
renovate[bot] Feb 26, 2026
11def73
chore(deps): update actions/checkout action to v6
renovate[bot] Feb 26, 2026
34f9799
chore(deps): update postgres docker tag to v18
renovate[bot] Feb 26, 2026
46d8d62
Merge pull request #9 from apham0001/renovate/postgres-18.x
apham0001 Feb 26, 2026
fa051e7
Merge pull request #8 from apham0001/renovate/actions-checkout-6.x
apham0001 Feb 26, 2026
aaa95b4
Merge pull request #6 from apham0001/renovate/hadolint-hadolint-actio…
apham0001 Feb 26, 2026
130e48c
Merge pull request #5 from apham0001/renovate/redis-6.x
apham0001 Feb 26, 2026
a6ad872
Merge pull request #10 from apham0001/feat/security-scan
apham0001 Feb 26, 2026
532a919
fix: multi-stage build to reduce CVE surface
apham0001 Feb 26, 2026
e3f07dc
Merge pull request #11 from apham0001/fix/reduce-cve-surface
apham0001 Feb 26, 2026
0ce7468
chore: switch license from AGPL-3.0 to MIT
apham0001 Feb 26, 2026
bc63335
Merge pull request #15 from apham0001/chore/switch-mit-license
apham0001 Feb 26, 2026
09366f2
chore(deps): update aquasecurity/trivy-action action to v0.34.1
renovate[bot] Feb 26, 2026
72e5627
chore(deps): update actions/checkout action to v6
renovate[bot] Feb 26, 2026
2bb7d43
chore(deps): update github/codeql-action action to v4
renovate[bot] Feb 26, 2026
e54a960
Merge pull request #14 from apham0001/renovate/github-codeql-action-4.x
apham0001 Feb 26, 2026
8dd5798
Merge pull request #13 from apham0001/renovate/actions-checkout-6.x
apham0001 Feb 26, 2026
695d1b6
Merge pull request #12 from apham0001/renovate/aquasecurity-trivy-act…
apham0001 Feb 26, 2026
472da39
feat: enable automerge for all Renovate updates
apham0001 Feb 26, 2026
39f1b27
chore: remove .gitlab issue templates
apham0001 Feb 26, 2026
91e0f1e
Merge pull request #17 from apham0001/chore/remove-gitlab-templates
apham0001 Feb 26, 2026
2d30de9
Merge pull request #16 from apham0001/feat/renovate-automerge
apham0001 Feb 26, 2026
812fe3f
fix: update docker-compose images and fix issues
apham0001 Feb 26, 2026
e675410
fix: update docker-compose images, remove optimized variant
apham0001 Feb 26, 2026
78d40fd
fix: add signing key example and missing env vars
apham0001 Feb 26, 2026
dfb8ce8
Merge pull request #18 from apham0001/fix/docker-compose-images
apham0001 Feb 26, 2026
2603a4f
chore(deps): update postgres docker tag to v18
renovate[bot] Feb 26, 2026
b0ee9b6
Merge pull request #19 from apham0001/renovate/postgres-18.x
apham0001 Feb 26, 2026
632c4e6
chore: rename samples/ to docker-compose/
apham0001 Feb 26, 2026
fe5b8c0
Merge pull request #20 from apham0001/chore/rename-samples-to-deploy
apham0001 Feb 26, 2026
b3e831c
chore: update README with current project state
apham0001 Feb 26, 2026
a26306d
chore: remove helm chart reference
apham0001 Feb 26, 2026
0701398
Merge pull request #21 from apham0001/chore/update-readme
apham0001 Feb 26, 2026
e1cf237
chore: switch base image to ghcr.io/element-hq/synapse
apham0001 Feb 26, 2026
e1f12f8
Merge pull request #22 from apham0001/chore/switch-elementhq-synapse
apham0001 Feb 26, 2026
0761c6c
fix: update known_servers from papers.tech to octez.io
apham0001 Feb 26, 2026
efea81c
Merge pull request #23 from apham0001/fix/update-known-servers
apham0001 Feb 26, 2026
c26a3e3
feat: serve well-known Matrix endpoints from Synapse module
apham0001 Feb 26, 2026
3011060
Merge pull request #24 from apham0001/feat/well-known-module
apham0001 Feb 26, 2026
e83ec15
fix: use parent Resource for well-known endpoints
apham0001 Feb 26, 2026
5ed4926
docs: add Redis, PostgreSQL and known servers documentation
apham0001 Feb 26, 2026
b72ace2
feat: make Redis host configurable via REDIS_HOST env var
apham0001 Feb 26, 2026
ba86498
Merge pull request #25 from apham0001/fix/well-known-resource-tree
apham0001 Feb 26, 2026
82fea21
fix: use REDIS_HOST env var in homeserver.yaml too
apham0001 Feb 27, 2026
4ac547d
Merge pull request #26 from apham0001/fix/redis-host-homeserver
apham0001 Feb 27, 2026
1d986a4
feat: add helm chart and harden PDU size patch
apham0001 Feb 27, 2026
a6675f5
feat: add helm lint and KIND smoke test CI workflow
apham0001 Feb 27, 2026
238a56a
fix: improve smoke test CI - cluster name, endpoints, timeout
apham0001 Feb 27, 2026
140e29a
feat: move smoke test into build-and-publish workflow
apham0001 Feb 27, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
287 changes: 287 additions & 0 deletions .github/workflows/build-and-publish.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,287 @@
name: Build and Publish Docker Image

on:
push:
branches: [master, development]
tags: ["v*"]
pull_request:
branches: [master]

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
TEST_TAG: beacon-node:test

jobs:
lint:
name: Lint Dockerfile
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Run Hadolint
uses: hadolint/hadolint-action@v3.3.0
with:
dockerfile: docker/Dockerfile
failure-threshold: error

test:
name: Build & Validate Image
runs-on: ubuntu-latest
needs: lint
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Build image for testing
uses: docker/build-push-action@v6
with:
context: ./docker/
load: true
tags: ${{ env.TEST_TAG }}
cache-from: type=gha
cache-to: type=gha,mode=max

- name: Verify custom modules are installed
run: |
echo "--- Checking crypto_auth_provider.py ---"
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
python -c "import crypto_auth_provider; print('crypto_auth_provider OK')"

echo "--- Checking beacon_info_module.py ---"
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
python -c "import beacon_info_module; print('beacon_info_module OK')"

- name: Verify constants.py patch (max size 1048576)
run: |
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
python -c "from synapse.api.constants import EventContentFields; print('synapse.api.constants imported OK')"
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
grep -q '1048576' /usr/local/lib/python3.13/site-packages/synapse/api/constants.py \
&& echo "constants.py patch OK" \
|| (echo "FAIL: constants.py patch not applied" && exit 1)

- name: Verify entrypoint script exists and is executable
run: |
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
test -x /usr/local/bin/synctl_entrypoint.sh \
&& echo "entrypoint OK"

- name: Verify worker configs are present
run: |
for w in main_process worker1 worker2 worker3 worker4; do
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
test -f /config/workers/${w}.yaml \
&& echo "${w}.yaml OK" \
|| (echo "FAIL: ${w}.yaml missing" && exit 1)
done

- name: Verify pip dependencies
run: |
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
python -c "import psycopg2; print('psycopg2 OK')"
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
python -c "import pysodium; print('pysodium OK')"

- name: Verify config files are present
run: |
for f in homeserver.yaml synapse.log.config shared_config.yaml; do
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
test -f /config/${f} \
&& echo "/config/${f} OK" \
|| (echo "FAIL: /config/${f} missing" && exit 1)
done

- name: Verify systemd units are present
run: |
for f in synapse_master.service synapse_worker@.service matrix_synapse.target; do
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
test -f /etc/systemd/system/${f} \
&& echo "${f} OK" \
|| (echo "FAIL: ${f} missing" && exit 1)
done

- name: Verify wait-for.sh is executable
run: |
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
test -x /usr/local/bin/wait-for.sh \
&& echo "wait-for.sh OK"

- name: Verify /keys directory exists
run: |
docker run --rm --entrypoint="" ${{ env.TEST_TAG }} \
test -d /keys \
&& echo "/keys OK"

smoke-test:
name: KIND Smoke Test
runs-on: ubuntu-latest
needs: test
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Build image
uses: docker/build-push-action@v6
with:
context: ./docker/
load: true
tags: ${{ env.TEST_TAG }}
cache-from: type=gha
cache-to: type=gha,mode=max

- name: Set up Helm
uses: azure/setup-helm@v4

- name: Create KIND cluster
uses: helm/kind-action@v1

- name: Load image into KIND
run: kind load docker-image ${{ env.TEST_TAG }} --name chart-testing

- name: Add subchart repos & build deps
run: |
helm repo add kubelauncher https://kubelauncher.github.io/charts
helm dependency build charts/

- name: Lint chart
run: helm lint charts/

- name: Generate signing key
run: |
SIGNING_KEY="ed25519 a_test $(openssl rand -base64 32)"
echo "SIGNING_KEY=${SIGNING_KEY}" >> "$GITHUB_ENV"

- name: Install chart
run: |
helm install beacon-node charts/ \
--set image.repository=beacon-node \
--set image.tag=test \
--set image.digest="" \
--set image.pullPolicy=Never \
--set serverName=beacon-node-test.local \
--set "signingKey=${SIGNING_KEY}" \
--set postgresql.enabled=true \
--set postgresql.auth.password=testpass \
--set postgresql.auth.postgresPassword=testpass \
--set redis.enabled=true \
--set ingress.enabled=false \
--set workers.enabled=true \
--wait \
--timeout 300s

- name: Verify pods are running
run: |
kubectl get pods -o wide
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=beacon-node --timeout=120s

- name: Check beacon-node logs for errors
run: |
POD=$(kubectl get pod -l app.kubernetes.io/name=beacon-node -o jsonpath='{.items[0].metadata.name}')
kubectl logs "$POD" --tail=50
if kubectl logs "$POD" | grep -i "FATAL" | grep -v "reserved for"; then
echo "FATAL errors found in logs"
exit 1
fi
echo "No FATAL errors in logs"

- name: Smoke test Synapse endpoints
run: |
POD=$(kubectl get pod -l app.kubernetes.io/name=beacon-node -o jsonpath='{.items[0].metadata.name}')

echo "--- /.well-known/matrix/server ---"
RESPONSE=$(kubectl exec "$POD" -- curl -sf http://localhost:8008/.well-known/matrix/server)
echo "$RESPONSE"
echo "$RESPONSE" | grep -q "m.server" || (echo "FAIL: missing m.server" && exit 1)

echo "--- /.well-known/matrix/client ---"
RESPONSE=$(kubectl exec "$POD" -- curl -sf http://localhost:8008/.well-known/matrix/client)
echo "$RESPONSE"
echo "$RESPONSE" | grep -q "m.homeserver" || (echo "FAIL: missing m.homeserver" && exit 1)

echo "--- /_matrix/client/versions ---"
RESPONSE=$(kubectl exec "$POD" -- curl -sf http://localhost:8008/_matrix/client/versions)
echo "$RESPONSE"
echo "$RESPONSE" | grep -q "versions" || (echo "FAIL: missing versions" && exit 1)

echo "--- /_matrix/federation/v1/version ---"
RESPONSE=$(kubectl exec "$POD" -- curl -sf http://localhost:8008/_matrix/federation/v1/version)
echo "$RESPONSE"
echo "$RESPONSE" | grep -q "Synapse" || (echo "FAIL: unexpected version response" && exit 1)

echo "--- /_matrix/client/v3/login ---"
RESPONSE=$(kubectl exec "$POD" -- curl -sf http://localhost:8008/_matrix/client/v3/login)
echo "$RESPONSE"
echo "$RESPONSE" | grep -q "m.login.password" || (echo "FAIL: login flow missing" && exit 1)

echo "All smoke tests passed"

- name: Debug on failure
if: failure()
run: |
echo "=== Pod status ==="
kubectl get pods -o wide
echo "=== Events ==="
kubectl get events --sort-by='.lastTimestamp'
echo "=== Beacon node logs ==="
POD=$(kubectl get pod -l app.kubernetes.io/name=beacon-node -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)
[ -n "$POD" ] && kubectl logs "$POD" --tail=100
echo "=== PostgreSQL logs ==="
PG_POD=$(kubectl get pod -l app.kubernetes.io/name=postgresql -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)
[ -n "$PG_POD" ] && kubectl logs "$PG_POD" --tail=50

publish:
name: Publish to GHCR
runs-on: ubuntu-latest
needs: [test, smoke-test]
if: github.event_name != 'pull_request'
permissions:
contents: read
packages: write

steps:
- name: Checkout
uses: actions/checkout@v6

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=sha
type=ref,event=branch
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=raw,value=latest,enable={{is_default_branch}}

- name: Build and push
uses: docker/build-push-action@v6
with:
context: ./docker/
platforms: linux/amd64,linux/arm64
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
61 changes: 61 additions & 0 deletions .github/workflows/security-scan.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
name: Security Scan

on:
push:
branches: [master]
paths:
- "docker/**"
- ".github/workflows/security-scan.yml"
pull_request:
branches: [master]
paths:
- "docker/**"
- ".github/workflows/security-scan.yml"
schedule:
- cron: "0 6 * * 1" # Weekly Monday 06:00 UTC

env:
TEST_TAG: beacon-node:scan

jobs:
trivy:
name: Trivy Image Scan
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Build image
uses: docker/build-push-action@v6
with:
context: ./docker/
load: true
tags: ${{ env.TEST_TAG }}
cache-from: type=gha

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.34.1
with:
image-ref: ${{ env.TEST_TAG }}
format: "sarif"
output: "trivy-results.sarif"
severity: "CRITICAL,HIGH"

- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v4
if: always()
with:
sarif_file: "trivy-results.sarif"

- name: Trivy summary (table)
uses: aquasecurity/trivy-action@0.34.1
if: always()
with:
image-ref: ${{ env.TEST_TAG }}
format: "table"
severity: "CRITICAL,HIGH"
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
data
.vscode
charts/charts/
charts/Chart.lock
Loading