vps/hosts/synapse.chans.xyz.md

synapse.chans.xyz — Matrix homeserver (ESS)

Role

Matrix homeserver running Element Server Suite (ESS) Community: Synapse + Matrix Authentication Service (MAS) + Element Web + Element Admin.

SSH

ssh -4 windy@synapse.chans.xyz

• User: windy (sudo via Ansible)
• IPv4: 169.58.86.13
• OS: Ubuntu 26.04

Stack

Layer	Detail
Runtime	K3s v1.36.2+k3s1 (single-node)
Ingress	K3s built-in Traefik (hostPort :80 / :443)
TLS	cert-manager v1.19.3 + letsencrypt-prod ClusterIssuer (HTTP-01)
DB	ESS embedded PostgreSQL 17 (PVC 20Gi, local-path)
Cache	ESS embedded Redis (PVC 2Gi)
Chart	oci://ghcr.io/element-hq/ess-helm/matrix-stack, version 26.7.2
Plane	Helm plane-ce-1.8.0 (app v1.4.1), namespace plane — self-hosted Plane project management

Matrix service endpoints

URL	Component
https://chat.chans.xyz	Element Web
https://synapse.chans.xyz	Synapse Client-Server / Federation API
https://account.chans.xyz	Matrix Authentication Service
https://admin.chans.xyz	Element Admin console
https://chans.xyz/.well-known/matrix/server	Federation discovery → synapse.chans.xyz:443
https://chans.xyz/.well-known/matrix/client	Client discovery → https://synapse.chans.xyz
mrtc.chans.xyz	Reserved for MatrixRTC (not deployed)

Public ports

Port	Protocol	Service
22/tcp	SSH	OpenSSH
80/tcp	HTTP	Let's Encrypt HTTP-01 / Traefik redirect
443/tcp	HTTPS	Matrix Client-Server, Federation, Element, MAS, Admin

All other ports internal only (no K3s API, no database, no Redis exposed).

Namespace layout

• ess — all ESS workloads (Synapse, MAS, Element, Postgres, Redis, HAProxy)
• matrix-system — cluster base resources (ResourceQuota, LimitRange, mrtc-placeholder)
• plane — Plane project management (Helm release plane-app)
• cert-manager — cert-manager

Plane (project management)

Self-hosted Plane on the same K3s node, deployed via the official plane-ce Helm chart.

Item	Detail
Release	plane-app (ns plane), chart plane-ce-1.8.0, app v1.4.1, revision 1
URL	https://plane.chans.xyz
Install date	2026-09-01
Values source	/home/windy/plane-k3s/values.yaml (plain file, not a git repo)
Images	artifacts.plane.so/makeplane/* (plane-frontend, plane-backend, plane-admin, plane-live), pullPolicy Always
Ingress	Traefik IngressRoute plane-app-ingress — /→web, /api /auth→api, /spaces→space, /god-mode→admin, /live→live, /uploads→minio; maxRequestBodyBytes 20Mi
TLS	Own namespace Issuer plane-app-cert-issuer (HTTP-01, LE prod, admin@chans.xyz); cert plane-app-ssl-cert (CN plane.chans.xyz)
DB	Bundled Postgres 15.7-alpine (PVC 5Gi, local-path)
Cache/queue	Bundled Redis (PVC 100Mi), RabbitMQ 3.13.6-management-alpine (PVC 100Mi)
Storage	Bundled MinIO (minio/minio:latest, root user admin, PVC 5Gi) — S3 for uploads/docs
Resources	Every workload: cpu 50m/500m, mem 50Mi/1000Mi, replicas 1
SMTP	Not configured (no smtp values) — Plane invites/password resets won't email yet

Workloads (all 1/1 Running): 7 Deployments (plane-app-{admin,api,beat-worker,live,space,web,worker}-wl) + 4 StatefulSets (plane-app-{minio,pgdb,rabbitmq,redis}-wl); init Jobs api-migrate-1 / minio-bucket-1 Completed. All PVCs Bound on local-path (root disk).

Plane configuration notes

• planeVersion: v1.4.1 pinned in values.yaml; chart tracks Plane's own tags.
• Secrets: Helm-generated Opaque secrets (plane-app-app-secrets, -doc-store-secrets, -pgdb-secrets, -rabbitmq-secrets, -live-secrets); requireExplicitSecrets: false. Values live in $SECRET_KEY, DATABASE_URL, AMQP_URL, REDIS_URL etc.
• Sentry / CORS: sentry_dsn and cors_allowed_origins empty (defaults fine for single-host).
• MinIO is latest tag — pin a version for reproducibility.
• Backup: NOT covered by /var/backups/matrix (which is paused anyway) — Plane Postgres/MinIO PVCs have no backup tier yet.

Plane verification

# Release + workloads
sudo helm list -A
sudo k3s kubectl -n plane get deploy,sts,pods -o wide
# Cert + ingress
sudo k3s kubectl -n plane get certificate,ingressroute
# Endpoint
curl -4 -s -o /dev/null -w '%{http_code}\n' https://plane.chans.xyz/

Local backup

Item	Detail
Path	/var/backups/matrix (root:root, 0700)
Schedule	Paused — matrix-backup.timer is disabled pending a reviewed backup design
Retention	7 days
Disk warning	80% (healthcheck), 90% (backup stops)
Content	Planned: PostgreSQL synapse + mas logical dumps, media store archive, /etc/matrix-bootstrap
Status	Not operational — no current Matrix backup or recovery tier. Plane data (its own Postgres + MinIO PVCs in ns plane) is also not covered by any backup.

Health checks

Daily via matrix-k3s-healthcheck.timer, outputs to /var/lib/vps-health/latest.json. Checks:

• K3s API / namespace health
• ESS pod restart counts
• Backup freshness
• Root disk usage
• Certificate expiry
• External HTTPS endpoints

Bootstrap secrets

Path: /etc/matrix-bootstrap/ (root:root, 0700) — individual files per secret key (0600). SMTP password, DB passwords, signing key etc. Included in local backup.

Identity

• Server name: chans.xyz (user IDs: @user:chans.xyz)
• Deployment type: New instance (no recovery from previous homeserver)
• Public registration: Disabled
• Authentication: MAS local passwords

Ansible

Inventory group: matrix_production (but NOT in managed which expects Docker Compose).

Routine status: cd ansible && ansible-playbook playbooks/health-report.yml --limit matrix. Use matrix-preflight.yml before a Matrix/K3s change, and use the gated matrix-stack.yml to apply a reviewed ESS chart version. Playbooks are in ansible/playbooks/matrix-*.yml; direct SSH is reserved for focused K3s diagnosis and imperative recovery work.

Known limitations

• MatrixRTC / Element Call / LiveKit / Coturn not deployed (mrtc.chans.xyz reserved only)
• SMTP email not yet configured (requires manual secret bootstrap followed by a reviewed Ansible stack deployment)
• Plane minio image uses latest tag (pin a version)
• No off-site Restic backup
• Single-node K3s (no HA for control plane)