### Install with Domain Matching Usernames

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Install the chart with the server name matching user domains, enabling well-known endpoint configuration. This simplifies setup by avoiding delegation.

```bash
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set wellknown.enabled=true
```

--------------------------------

### Install WebClient with Helm

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/webclient.md

Use this command to install the BundesMessenger Helm chart, enabling the WebClient and setting its URI. Ensure Synapse is also installed.

```bash
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set webclient.enabled=true \
  --set webclient.uri=app.example.com
```

--------------------------------

### Install BundesMessenger Helm Chart

Source: https://context7.com/bwi/bundesmessenger/llms.txt

Add the Helm repository and install the BundesMessenger chart. Supports domain configuration with or without delegation via well-known services. Also shows installation via OCI registry.

```bash
helm repo add bundesmessenger \
  https://gitlab.opencode.de/api/v4/projects/560/packages/helm/stable
```

```bash
# Option 1: Domain = Benutzernamen (ohne Delegation)
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set wellknown.enabled=true
```

```bash
# Option 2: Getrennte Server- und Benutzer-Domain (mit Delegation via well-known)
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set publicServerName=matrix.example.com \
  --set wellknown.enabled=true
```

```bash
# Installation via OCI-Registry
helm install bundesmessenger \
  oci://registry.opencode.de/bwi/bundesmessenger/backend/helm-chart/bundesmessenger \
  -f values.yaml --create-namespace -n bum
```

```bash
# Verbindung nach der Installation prüfen
curl https://matrix.example.com/_matrix/client/versions
```

```json
{"versions":["r0.0.1","r0.1.0","v1.1","v1.2","v1.3","v1.4"]}
```

--------------------------------

### Install with Subdomain for Server Name

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Install the chart using a subdomain for the server name, which will then be part of the user's MXIDs. This also enables the well-known endpoint configuration.

```bash
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=matrix.example.com \
  --set wellknown.enabled=true
```

--------------------------------

### Install Synapse-Admin with Helm

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/synapse-admin.md

Use this command to install Synapse-Admin alongside Synapse, enabling it and setting its URI. Ensure `serverName` and `adminAPIServerName` are configured appropriately for your environment.

```bash
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set adminAPIServerName=admin.example.com \
  --set synapse_admin.enabled=true \
  --set synapse_admin.uri=adminportal.example.com
```

--------------------------------

### Install BundesMessenger from Chart Museum

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Installs the BundesMessenger Helm chart from the Chart Museum repository. Ensure the repository is added first.

```sh
helm install bundesmessenger bundesmessenger/bundesmessenger
```

--------------------------------

### Install with DNS Delegation

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Use this command for the DNS delegation variant. This method requires additional DNS SRV records for federation.

```console
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set publicServerName=matrix.example.com
```

--------------------------------

### Install BundesMessenger from Local Chart with Namespace

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Installs the Bundes Messenger Helm chart from a local directory, creating a new namespace 'bum' and applying configurations from 'values.yaml'.

```console
helm install bundesmessenger . \
  -f values.yaml --create-namespace -n bum
```

--------------------------------

### Install BundesMessenger Admin-Portal with Helm

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/admin-portal.md

Use this command to install the BundesMessenger Admin-Portal. Ensure `adminAPIServerName` and `adminPortal.uri` are set appropriately for your environment. The admin API should not be directly exposed to the internet.

```console
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set adminAPIServerName=admin.example.com \
  --set adminPortal.enabled=true \
  --set adminPortal.uri=bum-adminportal.example.com
```

--------------------------------

### Install BundesMessenger from OCI Registry with Namespace

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Installs the Bundes Messenger Helm chart from the OCI registry, creating a new namespace 'bum' and applying configurations from 'values.yaml'.

```console
helm install bundesmessenger oci://registry.opencode.de/bwi/bundesmessenger/backend/helm-chart/bundesmessenger 
  -f values.yaml --create-namespace -n bum
```

--------------------------------

### Helm Installation Command for LiveKit Server

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/livekit-server.md

Install or upgrade the LiveKit server using the Helm chart. Ensure the namespace is created and the custom values file is applied.

```sh
helm repo add livekit https://helm.livekit.io
helm repo update

helm upgrade --install livekit livekit/livekit-server \
  --namespace livekit --create-namespace \
  --values livekit_values.yaml
```

--------------------------------

### Install with Well-Known Delegation

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Use this command for the well-known delegation variant when your domain does not match usernames. It sets up Synapse and Nginx for specific paths.

```console
helm install bundesmessenger bundesmessenger/bundesmessenger \
  --set serverName=example.com \
  --set publicServerName=matrix.example.com \
  --set wellknown.enabled=true
```

--------------------------------

### Install BundesMessenger from Chart Museum with Namespace

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Installs the Bundes Messenger Helm chart from the Chart Museum repository, creating a new namespace 'bum' and applying configurations from 'values.yaml'.

```console
helm install bundesmessenger bundesmessenger/bundesmessenger 
  -f values.yaml --create-namespace -n bum
```

--------------------------------

### Add Helm Repository and Install BundesMessenger

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/README.md

Use these Helm commands to add the BundesMessenger repository and install the chart. Ensure Helm 3.19+ and Kubernetes 1.32+ are prerequisites.

```bash
helm repo add bundesmessenger https://gitlab.opencode.de/api/v4/projects/560/packages/helm/stable
helm install bundesmessenger bundesmessenger/bundesmessenger
```

--------------------------------

### Install BundesMessenger from Local Chart

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Installs the Bundes Messenger Helm chart from a local directory, using a specified values file. Ensure you are in the chart's directory.

```console
helm install bundesmessenger . -f values.yaml
```

--------------------------------

### Set up Full Test Environment for BundesMessenger

Source: https://context7.com/bwi/bundesmessenger/llms.txt

Installs necessary prerequisites like Ingress Controller and Cert-Manager, configures a ClusterIssuer for Let's Encrypt staging, and deploys the BundesMessenger chart with custom configurations for TLS and services.

```bash
# 1. Ingress Controller installieren
helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace
```

```bash
# 2. Cert Manager installieren
helm upgrade --install cert-manager cert-manager \
  --namespace cert-manager --create-namespace \
  --repo https://charts.jetstack.io \
  --set crds.enabled=true
```

```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    email: ssl@example.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-staging-key
    solvers:
    - http01:
        ingress:
          class: nginx
```

```yaml
serverName: demo.example.com
adminAPIServerName: admin-api.demo.example.com
dataPrivacyUrl: example.com/datenschutz.html
imprintUrl: example.com/impressum.html

adminPortal:
  enabled: true
  uri: adminportal.demo.example.com
webclient:
  enabled: true
  uri: web.demo.example.com

schadcodescanner:
  enabled: true
contentscanner:
  enabled: true

postgresql:
  enabled: true
  image:
    tag: "18"

mas:
  enabled: true
  uri: auth.example.com

maspostgresql:
  enabled: true
  image:
    tag: "18"
```

```yaml
ingress:
  tls:
    - hosts:
        - demo.example.com
        - web.demo.example.com
        - admin-api.demo.example.com
        - adminportal.demo.example.com
        - auth.example.com
      secretName: ingress-bum-tls-certificate
  controllerSpecific:
    nginx:
      annotations:
        nginx.ingress.kubernetes.io/use-regex: "true"
        cert-manager.io/cluster-issuer: letsencrypt-staging
```

```bash
# 6. BundesMessenger installieren
helm upgrade --install demo1 bundesmessenger \
  --namespace bum --create-namespace \
  -f bum-configuration.yaml -f bum-tls.yaml \
  --repo https://gitlab.opencode.de/api/v4/projects/560/packages/helm/stable
```

--------------------------------

### Check Connection

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Verify the installation by accessing the client versions endpoint via your server's public name.

```json
{
   "versions":[
      "r0.0.1",
      "r0.1.0",
      "r0.2.0",
      "r0.3.0",
      "r0.4.0",
      "r0.5.0",
      "r0.6.0",
      "r0.6.1",
      "v1.1",
      "v1.2",
      "v1.3",
      "v1.4"
   ]
}
```

--------------------------------

### Install MAS using Helm Chart

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Use this command to upgrade or install the MAS Helm chart. Ensure `values.yaml` is customized and replace placeholders for release name and namespace.

```bash
helm upgrade --install <RELEASE> \
  oci://registry.opencode.de/bwi/bundesmessenger/backend/helm-chart/bundesmessenger \
  -f values.yaml --namespace <NAMESPACE>
```

--------------------------------

### Install Kube Prometheus Stack

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/monitoring-mit-grafana.md

Use this Helm command to install the Kube Prometheus Stack, which provides Prometheus and Grafana integration. Ensure you have Helm installed and configured.

```sh
helm upgrade --install kube-prometheus-stack kube-prometheus-stack \
  --repo https://prometheus-community.github.io/helm-charts \
  --namespace monitoring --create-namespace
```

--------------------------------

### Create and Start MAS Migration Pre-check Job

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Use this command to create and start a Kubernetes job from a CronJob template for the MAS migration pre-check. You can optionally follow the logs in real-time.

```bash
kubectl create job -n <NAMESPACE> --from=cronjob/<RELEASE>-precheck-mas-migration <JOBNAME>
```

```bash
# (optional) Logausgabe verfolgen
kubectl logs -n <NAMESPACE> -l job-name=<JOBNAME> -f --all-containers=true
```

--------------------------------

### Install Bundes Messenger via OCI Registry

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation-testumgebung.md

This command installs the Bundes Messenger using a Helm chart from an OCI registry. It requires specifying the OCI image path and relevant configuration files.

```shell
helm upgrade --install --namespace bum --create-namespace \
  -f bum-configuration.yaml -f bum-tls.yaml \
  demo1 oci://registry.opencode.de/bwi/bundesmessenger/backend/helm-chart/bundesmessenger
```

--------------------------------

### LiveKit CLI Load Test Example

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/livekit-server.md

Simulate load on a LiveKit server by joining multiple participants to a room. This command is useful for performance testing.

```sh
./livekit-cli load-test --url wss://livekit.example.com \
  --api-key devkey --api-secret secret \
  --room <roomID>:<matrixServerName> \
  --video-publishers 20
```

--------------------------------

### LiveKit CLI Join Room Example

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/livekit-server.md

Connect to a LiveKit room using the command-line tool. Requires the server URL, API key/secret, room ID, and an identity for the participant. The room ID may need escaping for special characters.

```sh
./livekit-cli join-room --url wss://livekit.example.com \
  --api-key devkey --api-secret secret \
  --room <roomID>:<matrixServerName> \
  --identity bot-user --publish-demo
```

--------------------------------

### Create and Start MAS Configuration Generation Job

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Create and start a Kubernetes job from a CronJob template to generate MAS configuration. Use `kubectl create job` and monitor logs with `kubectl logs`.

```bash
# Job aus CronJob-Vorlage erstellen und starten.
kubectl create job -n <NAMESPACE> --from=cronjob/<RELEASE>-generate-mas-config <JOBNAME>
#  Logausgabe verfolgen
kubectl logs -n <NAMESPACE> -l job-name=<JOBNAME> -f --all-containers=true
```

--------------------------------

### Gateway-API values.yaml Configuration (New Gateway)

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/controller.md

Example `values.yaml` snippet for Gateway-API controller when a new Gateway should be created. Includes GatewayClass definition and an empty `parentRefs` list.

```yaml
ingress:
  controller: gateway-api
  className: traefik
  ipRangeAdminAPI:
    - "192.168.10.0/24"
  ipRangeAdminPortal:
    - "192.168.11.0/24"
  headers:
    cors:
      enabled: true
      allowOrigins: ["*"]
    security:
      enabled: true
  tls:
    - hosts:
        - matrix.example.com
      secretName: matrix-tls
      certClusterIssuer: letsencrypt-prod
  controllerSpecific:
    gatewayAPI:
      gatewayClass:
        name: "bundesmessenger-gateway"
        ports:
          http: 8080
          https: 8443
      parentRefs: [] # Leere Liste, daher wird ein neues Gateway erstellt
      labels: {}
      annotations: {}
      HTTPCorsFilter: true # Experimenteller Schalter für CORS-Filter nach GEP-1767
```

--------------------------------

### Install Bundes Messenger via Helm Chart Museum

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation-testumgebung.md

Use this command to install the Bundes Messenger using a Helm chart from a Chart Museum repository. Ensure you have the necessary configuration files (`bum-configuration.yaml`, `bum-tls.yaml`).

```shell
helm upgrade --install demo1 bundesmessenger \
  --namespace bum --create-namespace \
  -f bum-configuration.yaml -f bum-tls.yaml \
  --repo https://gitlab.opencode.de/api/v4/projects/560/packages/helm/stable
```

--------------------------------

### Gateway-API values.yaml Configuration (Existing Gateway)

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/controller.md

Example `values.yaml` snippet for Gateway-API controller when an existing Gateway is present. Specifies controller, class, IP ranges, headers, and TLS settings.

```yaml
ingress:
  controller: gateway-api
  className: traefik
  ipRangeAdminAPI:
    - "192.168.10.0/24"
  ipRangeAdminPortal:
    - "192.168.11.0/24"
  headers:
    cors:
      enabled: true
      allowOrigins: ["*"]
    security:
      enabled: true
  tls:
    - hosts:
        - matrix.example.com
      secretName: matrix-tls
      certClusterIssuer: letsencrypt-prod
  controllerSpecific:
    gatewayAPI:
      parentRefs:
        - name: my-gateway
          namespace: gateway-system
      labels: {}
      annotations: {}
      HTTPCorsFilter: false # Experimenteller Schalter für CORS-Filter nach GEP-1767
```

--------------------------------

### MAS Migration Checker as a Job Blueprint

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

This example shows how to define a Kubernetes Job manifest for the MAS migration checker. Ensure all required resources (ConfigMaps, Secrets, Volumes) are provisioned beforehand.

```bash
 
```

--------------------------------

### Create and Run Dry-Run Migration Job from CronJob

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Manually create and start a Kubernetes job for the MAS dry-run migration, based on a CronJob template. Optionally, follow the live logs.

```bash
# Job aus CronJob-Vorlage erstellen und starten.
kubectl create job -n <NAMESPACE> --from=cronjob/<RELEASE-NAME>-dry-run-mas-migration <JOBNAME>
# (Optional) Live-Logs folgen
kubectl logs -n <NAMESPACE> -l job-name=<JOBNAME> -f --all-containers=true
```

--------------------------------

### Configure PostgreSQL for Major Upgrade Dump

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/postgresql-upgrade-advanced.md

Define extra volumes and volume mounts in your Helm values to prepare for a PostgreSQL major version upgrade. This setup allows an init script to import a pre-existing SQL dump.

```yaml
postgresql:
  extraVolumes:
    - name: major-upgrade-dump
      persistentVolumeClaim:
        claimName: postgresql-major-upgrade
  extraVolumeMounts:
    - name: major-upgrade-dump
      mountPath: /major-upgrade-dump
  initdb:
    scripts:
        # (string) Wiederherstellen der Datenbank nach einem Upgrade.
        # Das Skript wird genau dann ausgeführt, wenn die Datenbank noch nicht
        # initialisiert ist und die Datei `/major-upgrade-dump/upgrade-to-18.sql`
        # existiert.
        05-reinit.sh: |
          #!/bin/sh
          set -e
          BACKUP_FILE=/major-upgrade-dump/upgrade-to-18.sql
          [ -f "$BACKUP_FILE" ] || exit 0
          echo "Re-importing Synapse database…"
          psql -v ON_ERROR_STOP=1 --dbname "$CUSTOM_DB" --username "$POSTGRES_USER" < "$BACKUP_FILE"
          echo "✅ Successfully re-imported Synapse database!"
```

--------------------------------

### Install Cert-Manager with Helm

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/simple-selfsigned-setup.md

Installs the cert-manager Helm chart, including its Custom Resource Definitions (CRDs), into the 'cert-manager' namespace. Ensure Helm is installed and configured.

```sh
helm upgrade --install cert-manager cert-manager \
  --namespace cert-manager --create-namespace \
  --repo https://charts.jetstack.io \
  --set installCRDs=true
```

--------------------------------

### Kubernetes Secret Example

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/sygnal-push.md

This is an example of a Kubernetes Secret resource. It stores sensitive data, such as private keys and configuration files, in a base64 encoded format.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: sygnal-pusher-secret
  namespace: bum
stringData:
  fcm-example.json: |
    [...]
data:
  MyKey.p007: [...]
```

--------------------------------

### Manual Media Repository Backup

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Prepare a directory and optionally set variables for backing up the Synapse media repository.

```bash
# Falls Media-Repo aktiviert wurde:
INSTANZ="media-repository"
# Ansonsten synapse-main:
INSTANZ="synapse"

# Anlegen eines Backupverzeichnis PostgreSQL Dump
mkdir -p ./backup
```

--------------------------------

### Installiere Ingress Controller

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation-testumgebung.md

Installiert den Ingress-Controller mit Helm. Stellt sicher, dass der Namespace 'ingress-nginx' existiert.

```shell
helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace
```

--------------------------------

### Backup values.yaml

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Create a backup of the values.yaml or bum-configuration.yaml file before migration.

```bash
cp values.yaml values.backup.$(date +%Y%m%d)
```

```bash
# bzw.
cp bum-configuration.yaml bum-configuration.backup.$(date +%Y%m%d)
```

--------------------------------

### Terraform IONOS Cloud Provider and Datacenter Setup

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation-k8s-ionos.md

Configure the IONOS Cloud provider and define a virtual data center resource. Ensure the provider version is compatible with your setup.

```terraform
// vdc.tf

terraform {
  required_providers {
    ionoscloud = {
      source = "ionos-cloud/ionoscloud"
      version = "~> 6.4.0"
    }
  }
}

provider "ionoscloud" {
  username = "${var.ionos_user}"
  password = "${var.ionos_password}"
}

///////////////////////////////////////////////////////////
// Virtual Data Center
///////////////////////////////////////////////////////////

resource "ionoscloud_datacenter" "publicK8s" {
  name        = "publicK8s-VDC"
  location    = "de/txl"
  description = "VDC managed by Terraform - do not edit manually"
  sec_auth_protection = false
}
```

--------------------------------

### Placeholder Variables for Configuration

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

This section details common placeholders used in configuration files. Ensure these are replaced with your actual deployment names and paths.

```plain
<NAMESPACE> # der Namespace vom Deployment des Bundes Messenger
<RELEASE> # der Name des Deployments des BundesMessengers.
<REPOSITORY> # das Repository oder die Registry, aus der das Helm-Chart
<JOBNAME> # NAme des zu erstellenden Job aus einem Blueprint Cronjob
```

--------------------------------

### Installiere Cert Manager

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation-testumgebung.md

Installiert den Cert Manager mit Helm, um Zertifikate zu verwalten. Stellt sicher, dass der Namespace 'cert-manager' existiert und CRDs aktiviert sind.

```shell
helm upgrade --install cert-manager cert-manager \
  --namespace cert-manager --create-namespace \
  --repo https://charts.jetstack.io \
  --set crds.enabled=true
```

--------------------------------

### Add BundesMessenger Helm Repository

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Adds the Bundes Messenger Helm chart repository to your Helm configuration. This is a prerequisite for installing from the Chart Museum.

```console
helm repo add bundesmessenger https://gitlab.opencode.de/api/v4/projects/560/packages/helm/stable
```

--------------------------------

### Main Process: Mount and Configure Module

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/synapse-modules.md

Mounts the ConfigMap containing the module code into the Synapse main process container and configures the module to automatically accept invites.

```yaml
synapse:
  extraVolumes:
    - name: synapse-auto-accept-invite
      configMap:
        name: synapse-auto-accept-invite
  extraVolumeMounts:
    - name: synapse-auto-accept-invite
      mountPath: /usr/local/lib/python3.9/dist-packages/synapse_auto_accept_invite
      readOnly: true
extraConfig:
  modules:
    - module: synapse_auto_accept_invite.InviteAutoAccepter
      config:
        accept_invites_only_for_direct_messages: false
```

--------------------------------

### BundesMessenger Monitoring Configuration

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/monitoring-mit-grafana.md

Configure the BundesMessenger to send data to Prometheus by enabling monitoring and setting the appropriate labels obtained from your Prometheus setup.

```yaml
monitoring:
  enabled: true
  labels:
    # Beispielausgabe des vorherigen Befehls
    release: kube-prometheus-stack
```

--------------------------------

### Create Initial Admin User with MAS

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/templates/NOTES.txt

Use this command to register an initial administrative user for the Matrix Authentication Service (MAS). Ensure to replace placeholders with your desired username and password. The username must be in lowercase, and the password needs to meet complexity requirements. Providing an email address is also recommended.

```bash
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=matrix-authentication-service" -o jsonpath="{.items[0].metadata.name}")
kubectl exec --namespace {{ .Release.Namespace }} $POD_NAME -- mas-cli manage -c /mas/config/config.yaml -c /mas/dbpass/mas-secret.yaml register-user NUTZER --password 'PASSWORT' --admin --yes -e nutzer@example.com
```

--------------------------------

### Show Chart Information from OCI Registry

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Displays information about the Bundes Messenger Helm chart available in the OCI registry. This command does not install the chart.

```console
helm show chart oci://registry.opencode.de/bwi/bundesmessenger/backend/helm-chart/bundesmessenger
```

--------------------------------

### Wende Cert Manager Konfiguration an

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation-testumgebung.md

Wendet die ClusterIssuer-Konfiguration auf den Kubernetes-Cluster an.

```shell
kubectl apply -f certmanager-ClusterIssuer.yaml
```

--------------------------------

### Reference Secret in Application Configuration

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/secrets.md

Configure an application to use a specific secret from Kubernetes. This example shows how to specify the secret name and the key for a password.

```yaml
externalRedis:
  existingSecret: redis
  existingSecretPasswordKey: password
```

--------------------------------

### Get Ingress Resources

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/UPGRADE.md

Use this command to list existing Ingress resources in a specific namespace. This is a prerequisite for identifying and removing old resources before upgrading.

```bash
kubectl get ingress -n <namespace>
```

--------------------------------

### Remove OIDC Provider from Synapse Configuration

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Remove the OIDC provider configuration section (`extraConfig.oidc_providers`) from Synapse's configuration in `values.yaml` to complete the migration setup.

```yaml
# values.yaml (Ausschnitt)
extraConfig:
  oidc_providers: # Diesen Abschnitt loeschen
      ...
```

--------------------------------

### MAS Migration Preparation Configuration

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Enable MAS for migration in `values.yaml`. Set `mas.enabled` to `false` initially and `mas.migration.enabled` to `true`. Backup functionality can also be enabled.

```yaml
# values.yaml
mas:
  enabled: false          # noch nicht produktiv aktivieren!
  migration:
    enabled: true         # aktiviert Pre-Check, Dry-Run & Migration-Jobs
    backup:
      enabled: true       # Aktiviert Backup-Funktion
      storage: 16Gi        # Speicherplatz für Backup
  uri: "mas.example.com"  # Erreichbare URI für den MAS
  extraConfig:            # spezifische Konfiguration ab hier
    passwords:
    […]
```

--------------------------------

### Select Ingress Controller

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/controller.md

Configure the desired Ingress controller. Options include nginx (default), traefik, or gateway-api.

```yaml
ingress:
  controller: nginx  # möglich: nginx | traefik | gateway-api
```

--------------------------------

### Retrieve Secret Value with kubectl

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/secrets.md

Extract a specific secret value from a Kubernetes Secret using `kubectl get secret` and `jsonpath`. The output is base64 decoded.

```sh
# Ausgeben des Geheimnisses `user-password` im Secret `login-secret`.
kubectl --namespace=bum get secret "login-secret" \
  -o jsonpath='{.data.user-password}' \
  | base64 --decode; echo
```

```sh
# Ausgeben des Geheimnisses `admin-password` im Secret `login-secret`.
kubectl --namespace=bum get secret "login-secret" \
  -o jsonpath='{.data.admin-password}' \
  | base64 --decode; echo
```

--------------------------------

### Create Database Dump and Copy Media Data

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Commands to create a database dump of the Synapse database and copy media data from a Kubernetes pod. Ensure you replace placeholders like <POSTGRES-POD>, <NAMESPACE>, and <RELEASE>.

```bash
kubectl exec -it <POSTGRES-POD> -n <NAMESPACE> -- \
  env PGPASSWORD=$(kubectl get secret postgresql -n <NAMESPACE> -o jsonpath="{.data.password}" | base64 -d) \
  pg_dump -U synapse -d <SYNAPSE_DB> > ./backup/synapse-db-backup.dump
```

```bash
PODNAME="$(kubectl get pods --namespace <NAMESPACE> -l "app.kubernetes.io/name= bundesmessenger,app.kubernetes.io/instance=<RELEASE>,app.kubernetes.io/component=${INSTANZ}" -o jsonpath="{.items[0].metadata.name}")"

# Anlegen eines Backupverzeichnis für Media-Daten
mkdir /backup/media

kubectl cp <NAMESPACE>/$PODNAME:/synapse/data/media /backup/media --no-preserve=false
```

--------------------------------

### Identifizieren des Synapse-Containers mit kubectl

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/nutzerverwaltung.md

Ermittelt den Namen des Synapse-Hauptprozess-Containers in einem bestimmten Namespace und Deployment. Dies ist der erste Schritt zur Ausführung von Befehlen innerhalb des Synapse-Pods.

```bash
export POD_NAME=$(kubectl get pods --namespace bundesmessenger -l "app.kubernetes.io/name=bundesmessenger,app.kubernetes.io/instance=testmatrix,app.kubernetes.io/component=synapse" -o jsonpath="{.items[0].metadata.name}")
```

--------------------------------

### Manually Trigger MAS Migration Backup Job

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Manually create and start the MAS migration backup job from its CronJob template, and optionally follow its log output.

```sh
# Job aus CronJob-Vorlage erstellen und starten.
kubectl create job -n <NAMESPACE> --from=cronjob/mas-migration-backup-job <JOBNAME>
# (optional) Logausgabe verfolgen
kubectl logs -n <NAMESPACE> -l job-name=<JOBNAME> -f
```

--------------------------------

### OIDC Discovery Flow

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/matrix-authentication-service-migration.md

Details the sequence of HTTP requests involved in the OIDC discovery process, starting from the Matrix Client requesting client configuration to obtaining OIDC endpoints.

```text
Client
  |
  | GET https://matrix.example.com/.well-known/matrix/client
  v
Findet ISSUER
  |
  | GET https://auth.example.com/.well-known/openid-configuration
  v
OIDC Endpunkte erhalten
  |
  |--> AuthZ / Token-Abläufe starten
```

--------------------------------

### Upgrade with values.yaml (OCI Registry)

Source: https://github.com/bwi/bundesmessenger/backend/helm-chart/blob/main/docs/installation.md

Upgrade the Helm deployment using a values.yaml file from an OCI registry.

```console
helm upgrade bundesmessenger oci://registry.opencode.de/bwi/bundesmessenger/backend/helm-chart/bundesmessenger \
    -f values.yaml --create-namespace -n bum
```