9 changed files with 168 additions and 35 deletions
--- a/kustomizations/matrix/ingress.yaml
+++ b/kustomizations/matrix/ingress.yaml
@ -7,7 +7,7 @@ metadata:
    app.kubernetes.io/part-of: matrix
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/cors-allow-origin: https://chat.distrust.co,https:app.matrix.org
+    nginx.ingress.kubernetes.io/cors-allow-origin: https://chat.distrust.co
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 110m
 spec:
@ -16,9 +16,6 @@ spec:
    - hosts:
      - matrix.distrust.co
      secretName: matrix-distrust-co-tls
-    - hosts:
-      - matrix-fed.distrust.co
-      secretName: matrix-fed-distrust-co-tls
  rules:
    - host: matrix.distrust.co
      http:
@ -30,16 +27,6 @@ spec:
                name: synapse
                port:
                  name: http
-    - host: matrix-fed.distrust.co
-      http:
-        paths:
-          - path: /_matrix/
-            pathType: Prefix
-            backend:
-              service:
-                name: synapse
-                port:
-                  name: http
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@ -50,7 +37,7 @@ metadata:
    app.kubernetes.io/part-of: matrix
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/cors-allow-origin: https://chat.distrust.co,https:app.matrix.org
+    nginx.ingress.kubernetes.io/cors-allow-origin: "*" 
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 110m
    # This combination of configurations allows for the media-repo to function
@ -76,14 +63,32 @@ spec:
                name: media-repo
                port:
                  name: http
-    - host: matrix-fed.distrust.co
-      http:
-        paths:
-          - path: /_matrix/
+          - path: /_matrix/client/r0/media
            pathType: Prefix
            backend:
              service:
-                name: synapse
+                name: media-repo
+                port:
+                  name: http
+          - path: /_matrix/client/v1/media
+            pathType: Prefix
+            backend:
+              service:
+                name: media-repo
+                port:
+                  name: http
+          - path: /_matrix/client/v3/media
+            pathType: Prefix
+            backend:
+              service:
+                name: media-repo
+                port:
+                  name: http
+          - path: /_matrix/federation/v1/media
+            pathType: Prefix
+            backend:
+              service:
+                name: media-repo 
                port:
                  name: http
 ---
--- a/kustomizations/matrix/kustomization.yaml
+++ b/kustomizations/matrix/kustomization.yaml
@ -11,7 +11,7 @@ resources:
 - ingress.yaml
 images:
  - name: matrixdotorg/synapse
-    newTag: v1.137.0@sha256:3eb481f26665ce57a7a60d2efc472568ebaeb71a9d01c489c883dccd78526152
+    newTag: v1.139.2@sha256:89b1f98ae38bea1d8a7d73295752b083b2ebbdaa8f226697e4637e03f9d0c745
  - name: coturn/coturn
    newTag: 4.6.2@sha256:9a5d44d1aebf28f1a96de4595bbab3eadc1ebd6bda705ca040df907f353f9fb2
  - name: dock.mau.dev/mautrix/slack
--- a/kustomizations/matrix/matrix-media-repo/config-secrets.enc.yaml
+++ b/kustomizations/matrix/matrix-media-repo/config-secrets.enc.yaml
--- a/kustomizations/matrix/matrix-media-repo/deployment.yaml
+++ b/kustomizations/matrix/matrix-media-repo/deployment.yaml
@ -11,7 +11,9 @@ spec:
        fsGroup: 1000
      containers:
        - name: media-repo
-          image: drgrove/matrix-media-repo
+          image: turt2live/matrix-media-repo
+          command:
+            - media_repo 
          ports:
            - name: http
              containerPort: 8000
@ -20,12 +22,16 @@ spec:
              containerPort: 9000
              protocol: TCP
          volumeMounts:
-            - mountPath: /home/user/media/
+            - mountPath: /media/
              name: ephemeral
-            - mountPath: /home/user/config/media-repo.yaml
+            - mountPath: /data/media-repo.yaml
              name: config
              subPath: config.yaml
              readOnly: true
+            - mountPath: /mnt/keys/mmr.signing.key                                                                                
+              name: signing-key                                                                                                   
+              readOnly: true                                                                                                      
+              subPath: signing.key
          securityContext:
            capabilities:
              drop:
@ -37,5 +43,9 @@ spec:
        - name: config
          secret:
            secretName: mmr-config
+        - name: signing-key
+          secret:
+            defaultMode: 420
+            secretName: mmr-signing-key
        - name: ephemeral
          emptyDir: {}
--- a/kustomizations/matrix/matrix-media-repo/kustomization.yaml
+++ b/kustomizations/matrix/matrix-media-repo/kustomization.yaml
@ -12,4 +12,4 @@ generators:
 - secret-generator.yaml
 images:
  - name: turt2live/matrix-media-repo
-    newTag: v1.3.3@sha256:59cf338753598af400919caf332c92dd0e8e6c6e6e5d18270e52552c7c1e3c4b
+    newTag: v1.3.8@sha256:c344ce2975abb3611ba5b4fd028ff5268d5a8f2bfea3045d7ee6a95853577675
--- a/kustomizations/matrix/matrix-media-repo/secret-generator.yaml
+++ b/kustomizations/matrix/matrix-media-repo/secret-generator.yaml
@ -4,3 +4,4 @@ metadata:
  name: telegram-ksops-secrets
 files:
  - config-secrets.enc.yaml
+  - secret-key.enc.yaml
--- a/kustomizations/matrix/matrix-media-repo/secret-key.enc.yaml
+++ b/kustomizations/matrix/matrix-media-repo/secret-key.enc.yaml
@ -0,0 +1,118 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: mmr-signing-key
+type: Opaque
+stringData:
+    signing.key: ENC[AES256_GCM,data:kuOD9a7n19D1Z+hnaq15XC5RgoXqa+otNlQAUGtxGprK3SXD2WFTTWwr8pcjhnDpvescgzzj2t/TmxZpPK6YsZxNBCVICPiqzUpLV3kczyL/qk6IaUvtMgolHLgqj/T9os85XxiRM8u/zdu3P0iuutXr5w/p9aytKHKulU0tRho0px/5GqJrJgS+OMnwHw==,iv:FKLM6gudsJyVYIzRFjYQu6iu1IOQUO7xFYxbq0earIg=,tag:aE19CFwIAW6M6LejbNwkPw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2025-10-10T06:06:29Z"
+    mac: ENC[AES256_GCM,data:Yd2eZ28ffAIDDWcDJkzo0YzMNrCeJyB4sfHG7IO+oOozk/vKb/loGC/eLVogFgiR3iHGMfusDBQtNnvA4bVbUFt5e2rmA7KwjK1/WAaUawzTYFwZoVOcJseaDx3TbxiNYaYnUD4rPdaWooMYHWVD5M4Ibl4jVdJnb9cMaevnK8o=,iv:nfZgZb3r4GiE+XR1sVYNN1NjjWUdqicJloC5rgPVKnc=,tag:/2k4vRwaSwez4+moF6370A==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aARAAkFACzQmqyF9BqaD1qEjIO4e6owS/n4h3U6ee0Y7fhO8y
+            a5RJ4/HvMmfXcYeHm+CZjsFaui4YJkPS93clGTJzV4w15yXJUunIVjAmkvSrVh6P
+            GqRUtNpi1y+JCS3sjlAfvm3h9b08dNxFv7rTwZtDiP8zmcNuB0zbLBFR7G6ixetx
+            ZxL7piPYX75Rqoz8A/+V7VAtsoX8t3xv5xgjHzzfhiM3TeoQUgLnF8aN5huiSptf
+            dMmNMa0GGu5QaUjYJ3iHjv5eMtCJ79KwpuCfv5iX34Q++rTe5VUWoQabNAiE/Frt
+            Rc3JB8o8rfL6WME9qIIa5k654JlVDKqOvTH3mtHkOIWhD2+CEK89Siq3G35Kkct8
+            Ym7UNa6gE8IdSGkCOH81G4ZheU6Z8OKF1Z7dO+o7IdgIURTwLEFeBIC2PtWOKOJP
+            PnzqZNk1w4n4XK6hQg4bmIj8VaZXXgHEXcO/jaGCoRyr36BHCE1Sj1ae5cMUgDje
+            p6WKVO6gXfRg7SRJqQNUh03Lz0YKIjsI/429UPyf9mtXbHfvVyrW3+wyByok86FG
+            cGL1Y/N7thxAxXqHy4OZFCE0NMP2bobMzzGJTtDY9oPsGwTb6xk1g0wE5zg6IoQa
+            9hnObBJhdpvYcD6juz+V0wkeI30essnz7ZTtsLdfCox6mnP5BMTtzxmcRrCpNvHS
+            UQFIZa0XryYoXv3rcw6yUpkqv6aYzD3L4PnqYtGUEtbMoTb8NXa9Cp+1OeypqZ0g
+            7uO5zCKJgL6sBaPnJL5/n+afafzYcIOsQc2O+q0s4O1d5Q==
+            =3E6w
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUAQ//abo3n5r8YdQ6p+/X031/n8MCvWKw+ERGSvDuT2r7g8m8
+            DqrBQmX578jHVmZkC2B6fYqEBuQAeyEJyQ56MLMuGMNSET8dgNS4Uj/gwvsuEDQf
+            NhU10WLkfQ3g2/o654BVzPC2b3UQTL4mmXqp0+ID79uynn0/WZ0TQQ8xj/uUaDS1
+            h6/uC7mmDGTHaxF3gFuYkvWMghU0bqX5BfrAPdICAr8FIqxUGIvUD6KkBu9hWTYP
+            RLtfwpU/DAcT/7pNtic25WzzQt7W0mok3zUZZq5r2UqO35x2XOrgC5DQ69QYf7JZ
+            a9S236gEpAS0Kl1IWSvY2kDzj/J27T3nonY2kX3a+UqVWX15LEmVmNNUMwjz91/b
+            0G+26vustzinHBs30EHGBqhyELjRW0RjcmlVGNXvZwhgGL5/LNIEcfBi19tIang1
+            dRYE9TasSeRbyTU/A/CXFDeuGtC8K552SzXjv1zP6gkwZFb0/zd0/XHPSyGyOLbM
+            1PC3JhkA8GEYQ7l9y5BdPXxZseuoSHDPHfMRIcnogx6w6rfBdd9+78M1WjnGzhYi
+            /utORBaiwU9Zk+Xm3B+WbkDl5+jio+UIp9nHoYAGfuJ9A6TZYBIavB6K171wALke
+            Kl6hoTxef/VGwdfXB9ikUy0bi0Km1vVpZGVzIjSFXiSlLkaamhxUFSgDPGZN21rS
+            UQHeXKkhgKXTEVvi+kypRbN2/174bElGTWz1C2TWPNJAcvvKmRw66t5g8pahnXbm
+            SYQoB5JaAl0URu6zHWBYhCjQjiyePhnxHV4tgGtEYAdY3g==
+            =xXRR
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAAsxa6N9jRT1AUqfWI7gIfJK6i6g0F5oxRYJ5A2mjhc89k
+            ZAN4/tO9GC+Fg8+lLhPHdiz6v2T1+92AFXET3jm+ax6rYei2woMHNXKzgqxjkQEQ
+            xQ/3LcQ3+FOTrvy7Gir9HQ/DoWSePBF7tx16unxH75hi6AgOiT0nFoEbXP3CJXie
+            lVOO5r5jKgBg9LENj/U+9LHjXB6W0PbVdhxdeStk2TTKcmuDnrGeqKZ3SyZ9V33p
+            DEfydW+T0ac156Eb2tdszzW5e87oPmW78wvLkotboZcPVWBadRtJkzVn3JXoMAda
+            gN+W2+I4/4iQN8ITBQ+2i5GsdbHtnrmPkzSbtSqhujwZ1k/a7uRmHy46ejDK9QnT
+            lQzm2OKyjTlCDhnxnKj0eTE4nN0CDyxGBNlNVG2piKd8i+HpqrjKJ9IUcMj7oO3U
+            8rtQ2A0LHquNvu6ZatP6fUk3tKgLaEslV4ORXMlILdZXlYqgznmvWJaII3XVeu8l
+            G/tHPkOhrcQDIecBeYcTLZYXtPtmY1UNJZfbDazG/9J0rdq/r9NmnB7woy7FSYEp
+            yRNji1i/89nVLsu94ra1D6FHyxgIFTSLkD7s1iCMTsz0UdwfbxqdLIWumYrm04XF
+            wM2eTB8OAGe8mdfi1q4te0FEDMLTpdYBhYDDjHmBv4fXwKPcWkgixvNJtT6xPgLS
+            UQEvOn03hQ8MCQ5kh1R1FoTOw1UpgV0eqJSateC2wkBKbZ/4NWPbnZA7XAW6Jb98
+            JidKJ8TiYiI33hxUhu4nUeZWjNcd7MgHyl1Do2r7SfyICw==
+            =TXST
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ/+I9khYJfqjCHhrAaElVWKgn4c+7C+oilVNE0132pQZfLb
+            u17yv6AYY5zThK6Lg0GZMKaKFn+JuF9wonTyixJQccJ+w2MxsJQRNQZTV/t19HrQ
+            B+6YFLVPNyOglr7jf+o5BnOdIvpR0Cog5JDzn0j4iwpRWRSGW1sWXiABKWUIW0Ks
+            nR7Rm/k3Jm8zYO6LtoyYog5HGUEHRMuOY6Yoj/EEbfDLKFU5WZ+hfKnbGGM9KW31
+            RkXoCtjm2AstZTia5+Y0E3wNb9bbvpbkewyQd5KqaHmHaX3MzuoYKNHGVEgPMfla
+            Y26aED5uSLETv+C1U/jYJyxyVJxNYb2JBrS8a7+p+mo00Cvbs/pbM/cr5Y/Ogu7Q
+            Ed0+Ixst3LzSTOcYAAiEC/LpWztaIp/4h/cAfE7eKnsoFUVcv2lLpLHyI7fS/sJH
+            Ywp8tlqlfx7DaCqYEVjPMSfI9qBbJomoQ77szHL+Gyi4ibyF0iRz0/NnF5lmu5H5
+            sDAYiqnHEIpk1v+gWXoj/CQq7a5jJf044cYylcO+al27cugr+jr5TBQQVv+wDNJV
+            LqpAxmmz8yUJ6RlTSg5JwNlNCCOONv6f+lX0Cjk7V0kPcOMgbVn19Su7zIvhM7wd
+            m9mzuVWWx2SBGzORdK9W4tt7lybU7aCvusT1jP1nwXF/JCz9lyEbb1syaNIAiXHS
+            UQE2Va23CUVgB+cV/ImXBCEuAjZhiSMFVCtWOZrcqPS8EZX9s6WzscpsEmFnDE7t
+            GVR3u1IyjxTsuTxxYU0ldSjHqYFjQrgRD3ZBzwZcgeajqw==
+            =bF9b
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoMRyGipvXTgUChfL1Lryej14FI9+8dvWQculBjPQzg6x
+            oxdPzz07ifIX8D64zfToE+qc439l/RYwiMx9XyGscEim0D1GIFPwxOm4DCXT+/5m
+            wlLkOBP7oMwirqSazS7dNF1hE83717QTi1GqC0UqhoMINtxrhQIv1Y6xxREqD1Wd
+            eW3M45p1i8iSZkzF7n0EhIK3J59Wl3vxt9FUX3YRWk1JH0oaqIc1VCH3TJc73DAx
+            9e1jIVQSo4R8BfQc5Y64xRh0eq/87Ud2E2x9JbZmpnw4FN/OHg9QqRMaZ9r6EQ/l
+            VerhJFkfSj3UVAfODzViKXyNTKRak1GOcQBE5lfAXynAW1nfTTx0re0rl6/tvOwC
+            i02a/raksTI8afak1RMclNFqlihsegGU239ZGDRPb4apL32nYY0SMim58vET8rv5
+            eTiQE1udg+1ttIRAGq/PxzHKlc6FUEdyJ6i2Da16c0K76FpF3Gnxxhw+Tleixx3h
+            6+PbhC2qEgt7LS8TNg9J2WTDy4Hlw5YEmzOAM9NA6UYrH9BHsR87sbdriz6pAC55
+            CnFkWptrME4CjUP72qIezRYt/4784ABTw6poQ51jP30641YhgPoYLrWS8hWQYaE3
+            jcrum3JQnLTjsE88OclcreKNvNj+b1t0uxuHa/6UdMnyRCd8osJ22s6JJHLGgB/S
+            UQHvy+Rv0QJ65DjsJ4TfdRBLcKXaF7Ar5SaANqGi8EYwjVbhfImwx5VSEsvQclEU
+            7JihoETtCrRwJM1BkJz3nuBAaYDm1Y+lWHSyVZ6xi8G0eg==
+            =n6cE
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1
--- a/kustomizations/matrix/synapse/config-secrets.enc.yaml
+++ b/kustomizations/matrix/synapse/config-secrets.enc.yaml
@ -4,8 +4,7 @@ metadata:
    name: config
 type: Opaque
 stringData:
-    homeserver.yaml: ENC[AES256_GCM,data:nw5i5StYk6zi2fel+31NIPTcbvsqmyFSwDOuuqAdQJCLahjNWK0OZtpFk47l5pex/25quaYLSP3c8So189rnvqNLPXdb2ux42hu88OAxs2vrkOKqOtFGZsHZEwYj4x/2LR0teLZMwfqqtZNIlgLD6RL/6mmcxKvQ9+Tme/xRfDxh3YUoakePjZv8aF8Z+SF7VA9XXZwuDiSTkK1vmnkBoEUPVjhu3QvT8YGDmwis+VZV7iCoMwIuV11Fvw7a/ntXjf9UV+NCOkP0Koyhz3Iz0nmZjy+Lq88SunMgxwTK1OWh9/aTKOF3D8j7W/yUI9TgscYHbz+prQkAkIFlnmR3Eu+YEJRxRcKLLWkJTX1R/r7X9xq5h5cc/aX/mvyxgupBkgYTq0xNHxwgdc+Dc6tdiH0vji4QeygQm0QonYDQOvn5/fN2Rs5yggIq2X8kc/Z6TfkmCUb1rQ34JXSmvQVgoJM15oaN5q0N/5F5EYDuXjQ0zJfSd3trWikvE9hdM4ZJqKaHc/cNcUhmse9Q35vPY12TDjp8j0rJPadTSVFwg+G0V/i5PzwH7VgCStvkRu9KqVc9E8BCMk3xz19TSVV/64ipQnRbtEgqyqk9WEwm3RIwn4Ge9Tj3hVCSqtIRdJQdD9aNtfKBofyqnqt5uXPkHSeRBbk8FQ6T0n3wY6CFtCAxULmmxfooMbPlQV9+TRIv53DbY0+j4TsYdwsasrFGSx3nKqtaZP9XJOpuSfpe/Pf/z6zfpJgGsxurY2q+iUe13jVfqUj8UZq0zHPD4nzEAUVtGHQ9whulIyvrIoSeCghAXIXieOioIOHMxEf4ndLoq0kfpo9AuasHZU9g/ur1PlVfDKtNTnv+ouVjvNfrXoVVOoVJr6+pPW3y5N1eTv9TZRuAlGw1cLfam+xeHFfwSt1zABPgTeq4YMonisiAhNaoJk5PrRqUzx053nxkuHEKinkKV5AqFco0CzfE4bsKZBD0rG5HgeVG8HbTPU8D4egaoBssLKZbehCoyY8hAEDqZKmfR8gAIlv9Vad+B22Or13NPBvkgiFYCBfAkMHI8DzrX+rIDfmHLfhcRBhZycxtk/ccTD4n9HZZkMlOeFO/cY7slaiycgqeJScRJOcEwM6AFXum740Mazv8wINvc5vJ6XzhxOMWzz8VhoJWDCuq6Nmz8cPvAck6Zs/BJD4PygJRc11ELTh9d6bjlg49Zl8AnX+bOMCZ6OyX8Z+vSZyro2eUzBJFjUI9vbctEHCtUyEdRUxS7lp8P8FeKk5rax6s6D1arSF8jA5byhvk07ppXZz6r7k3U5W9YmfVCEeGiW1RrdlJCejnlQ0x237FSRrAgrutP5Np3JaGHQOMDcC1QiLk11y+P7elAI6RQAa+cVZR3WiVjPCgw7xaqp5hp2sUFvUKqXF3,iv:Ck6LL0DwSJOGN3rGFFeDAT0HCiykrfa4QU0LS9eeIss=,tag:O0AzdpZB3NclQXxmW1x+Ew==,type:str]
-    mautrix-slack-bridge.yaml: ENC[AES256_GCM,data:7prhlEl/Ftf2CJWX67OF36fU386C5aGtrG45ofQCepBlI1Chi9ntswRd4VmiOnEt3vepgy4WFPRrAGu+1ycvILgCztK/2hFhEEmnf6vOlNkddXhkyuB9AgOTeCZ/ieTFXw0kErmaAvFwCkdp/SZIh+rqOTGk/3QoPqv7+1mLTxyuUOGeKlizs+4AfzFqpommfQNC2ZPpbOCtih/OZty+nbleyYnwBCyiIEOSI/to8m2aAIlg69fIT6cOwj4xiglO5dovXtr3Qe0VqkxBPOzD+1T5cFl2Q6zW0pFI320lP9MDwif92l8tTUEh12io6QtI5vQj7sNOoJ1FtnJwToL1V/vjESjl5MN1+LpZVicX4V2fUevJbms+7HUJFz4hETv1x/9tNmGSm5blZBz3qtUBJM/mRyBhnznjok0E9EXbGI6ox9O8scsvmXSYnkZHgFTXerqY/DmWmfFenWJLopNy7x1YNXUyb9z90//shUK5/Knau/YcCAKkDmzg6RObgHjkdCx/lfVePIkdKqrwS52lL5+CCgIKDVQm7Ds58E/0b+84N/6FWCwy5YV1+1R0SEywgVQ1WzjxJnR/Yg80tKQVqAzroFO5RWhffQEAyp3YQSURVQiZw4L89UXrfSvDvXu85olcGq1rXWGrDHgZSo7NKCbEQ29q8LsDgw==,iv:GyV3W2Rl+0T3pwrV1/Qv3OV4gYb8btnHMu340brhEcw=,tag:xRywHK6w5TfUdZTfS9XYhw==,type:str]
+    homeserver.yaml: ENC[AES256_GCM,data:Ol+PzD2AADuktoZm9G8VpnZwqPdcW6/4ADhwiwesxU3mCy0aWXR+OZ24o/6eXW4KpoTDkQ3rx34wRaNDATaNAzFk6ZL4aESNKfuBD2nN5x9Et1eygiYk8R6yEd3ot1TVKxiHfZ9zPRmL+DcK+BFLb6vLTPTgDbqnqHSikU9IakNMhwCGQMHSISYZD2zsVBS1aGuVqHB+PguUmueSkOL1P70rNkvG5GOXRoTe8p8v01KRlNPIiaH4wMmMl4/tZRPfOX7OF9NgNJJaChoBdPAbtFTZ2dmgf791zuybz5tT+cFN5zxYQLuljGCyzYjwEKL07dO7xukjmJrXg4bezttCrB1yrBq9U+vmdjpXpg1oqcBwcWfNBsyeFIhodfABUSKL1iiaTvc8J4bpFmFZI+/rQ0QPlRmhZwMYAY8DmR6mLyLD25u+NFUQfWK+mHbKIGeejGpenacuVvJ68EAJZrInkEmXuF5YOWnZOcDY3aGkXaDxXO9L6Fd6dWeUmozv1ar+8MGt4Bdxw9kS+BeelAFwCUkHZ7ltnUP2ZEP22WcHRMoijtEzK82nD76yhOH6x3l+b1DKTUe898DK0/f20xRg+Z2BIoE9+N9R0g6OplaJoVzs5hwXQ0LRzKR6Ky9Gk+tU44hHD7wy9VOTIhqRvDjtFHrf7C4j0FOA9sx0hHzkimfNnYXm3AEnzfxDKXfYSrbk82LM2FFlBjXg7sW2O/MYNXv6Q5LSZfHZ9JIsJB9s+pKz++/OsECLm7ozgLfJdRAdwjVuHMvb1P5ymEgjFNlGBhemdOWEy5sSZy5oK/GVogLgygM/MS4As05gIpDHfSYXQWHgYGx5m7WIfXG9ez2LbrYJgXN02h5sC4YwggYxDl6H6wXPEYctQKgtzIzM7Xa4NDIMTWAnga89LqkaQGzcnouBGc0HbzDfJag/X4Jer3yw5QDfnjRcVx2gqguKt4hJJBRKlTe0H5wHV6lbSdYKk7BFu+FDyBYI1TnZusTsQgKgGaIv4pYpdg1o3IaA1zOrFaTr6INPB80ZduEe/AtNmrGpZah+Mgn3fbGVv+Gy3Bt9wB7oZZ9Fh5oH/WU+EGeqQTyjC/5q06a5xlER5794KiNug7AbOtqrFFSv8zYEUxZ1F2w42LY7+NlqqH3gutwLFINmnWRCEYnNUGRnbWEz4MJjIrAgt2GFcMYwFFIDXgqVyokHfmiWPyTGERudN6HR9bSrImVqNrAIJWJBK6y/AEFze8VrxMbE7clDoMd4bS9tY4qX0+/ajOvQC4db1t4kA6Wa0O3rICRd+Nx+8SLxAWRCcl5I0bDMSUr+GOPBFwX92a4N7fU=,iv:znTlWvwxZlKhHx5o+aMkUYBX6o0hic+5WqSblGh7TI4=,tag:U6PbMtLy+SRZowDRvcPYqA==,type:str]
    mautrix-telegram-bridge.yaml: ENC[AES256_GCM,data:WI3qnnmTi6/k0BdVOLFndk9nQPlBXMwvB+JAg68Q8o6eUjaFGQ3UzitmexxmX5JK70G6ZdCmqsfsut2M2eGGxYH4FrwP8nMIz/vtD1IeXciu7IFmNOptNC5NZI41C7UP+OO21SFPeu+tWblu8qa3+OrJOQaL+GLLnRDDk21w6HTR2vvRieTy4c8NSC2XYhoiplZ7Z1FIRKTO75jjQN/L8bGVM3a0nNCmi8cGt+LPtyJBv7Espr3l1kUhiLMUxVK2zeP5HRgXWxB9UeUdqdJa8Yfz8QPHQmroOTMsmXLnocM8LVPOleSWLrYfKvML22g1oTesR5LxazdIc5BRL3upPwz7AO6nOcOKNZVuyVUUmrg2wNscKs6r5LDBJzsNxte4OEtzygpVAjHyiAqYU61atycVzYgfziY7cy0dUmkhikyBfmO5mVFP2YkEINtPkX7tJW4E5s2vqRP8L0PB3rwqBPQPHr3llsUQf1rKLjEThwEcWc1OBgDaZJiRxUd/P5m2lMvdh+hW6y8gDNURtY5uwSh7k7DNJ8n6MSzX8ZnhBAsuwg9tXU0YwgR+uT14D3xsGfUJDYTKpsr5ejY4adbQjOMzgbhadz8iKbZdr8cWVPotBIR76SaGgRXqITWl5ygf1N0PVkgzrkTxdLmIv+7ttqndblkjyW/2W5NvY3iU+skC+GZpgLNDEmGGkmITpBIfxEEYBLNQZynD+NaA9hiATr+TVzAcp760FSOqbFLeDMx3YOpbcNQ77FdPq6qcCPxfe1nstzlQixjf4cEpdfuQWkFZIrlV4EBYh/WNH0VP,iv:7PhPWul/rDWEJB5ecn0myPMwbC6akihS0xZEvyeEB9s=,tag:TMAusZ7EneDQgLsthzaL8w==,type:str]
    doublepuppet.yaml: ENC[AES256_GCM,data:bA8r1TZECeDxIuUxkBcM0MOFdplcB5wus7KEir7LfPWFA06aUCz5o2BU/YKSzf5NlEtwQLlCiaDdONPPfLMvjHxaXBfyd2YCIoqeP7GCCqRnfZE4zaY2QajrUkBZQV9DAvf23Mt9Zw6ByLUHWIGvB95WOGHXxKeyDo0jnUgDWu+Osm+UIkbYKEOBw/rF3NOAUBQxxh9AlxwU/IUMV3++dhbGaTF46RN7FF/XLUJ4d3zt/f9r/UUrPwksiyUFyDRjRuV0ABn0aLneeJhcL2H4MeFnkjuRie9t292ief1UGbbqZnSMSuh//V7UrxKJw3o/asVRQQkxJOVQfAa6TUcBq/kxhuYXDBg1mAFD8/RGmA6pjJGH5+q9Cqaqmj6PgLRU+HS2iZnkkz6FRK6GmSAXu1vcwB0GC6NkLXU75B8j+3b8DV+rM6boKzQgAVNT+McCm0Zg2DdtMvQ//Qqetg8AXOvHXSJZ/zU7HsM42fm8Zk49uF6abKY=,iv:227zkv9T+yoycJNumdo0rV44ngXlM5hYu/1kRBj93r0=,tag:yQq2Aiw2sB4kmp/CeJ0G3g==,type:str]
    appservice-matrix-bridge.yaml: ENC[AES256_GCM,data:D7v8HJ1UbN/LI0OQ/VZnMqELIE7C2WiaxNYEGZJg6e0zV7sZ+xV16nQkrfmVEHbIfEsdf/LlmEZmf5JTrqfVi4LPAL9zFYwvJAOKTLmjqKWJSUS+qLqzBgoHwuwvn2qWnZjCDDuqQ8h+L8hDcLoI+GOW805icJxrg3ZX8zrVFldoG23YV9WhPQwnTbpi5LRDGMWWDTxxOFt6/ZgLyRTRAs8D601VEAI7ulyMPsIPZzKOx1aBIWb5VzmP+BKcWj8yYTR6UhFg0ac9a7Kb/U8u/soBRnBLmSEFnL6pVrv2utsyS4SdZNaSZN/PZtgxctdvPFYo/fGH+iFeYWZ11izyaTUngSgOvGTwvdEkn98wd2hwKnM0HvOOm28VX76/2wTiqU0e301AD5ouUKvvTFqJqqowQJp5DD5DX4BZ0jS6n9+QsH8MfeSP89ZgKIhNvHQ8KAnm1yJu5nEvaOt7NVkEL9CVFtrymDqRCCS3/FMVYBtq4bjJsrQ6yXqIzSPH,iv:Kv4eGx1vFgs+sV6iwBZD/nR0h2GzLKqjNJmgsRldNrY=,tag:QGmJZUhn23c1pez9+MCrfg==,type:str]
@ -15,8 +14,8 @@ sops:
    azure_kv: []
    hc_vault: []
    age: []
-    lastmodified: "2025-09-11T01:21:15Z"
-    mac: ENC[AES256_GCM,data:CkilEQZHdz/4ZVdxQ5uJzRef/CWW4JLxc8sGHdJ+fAq+fKs0Ur7IHAvQDu4GV8vZ0Ff3PqbrJODafVvbL0tww1d4Ucn53gz/ZfgSc6DACZ3d8RST/k6ad/JjsPCCifgogjA3TPQE4hehLY8JNi2cZVk02YY3xUFEeva6MWMy6J0=,iv:nRM0whcIFS2VYCN8m7IdGqeJHHPd8ep8zFDofhYKQGw=,tag:WhUk2vmscD3SajzJhSwgtA==,type:str]
+    lastmodified: "2025-10-09T06:22:00Z"
+    mac: ENC[AES256_GCM,data:36xREMG1GQn1UerBDrMiP90EvEBACURD5Y9FYXl++0J64ntrIqB7wWCJqdsgVIFGd/yh3fnV3eUSj6peSqoTYZp1uor1Vg5HW099XFPUePpEJPXtEJJbNzcuRDn0sQeJSKvFZ0SSI6a3OEg4c9AwfBfmwP0+MwVKCvl9x4V7oYg=,iv:oMWMLfzIr+uaf3+ObIG3dnCzIORrlj1KbcTwTFwIWbY=,tag:BjjPgN+iQD1l1OHNJ7VMPg==,type:str]
    pgp:
        - created_at: "2024-01-11T20:55:07Z"
          enc: |-
--- a/kustomizations/matrix/synapse/secret-key.enc.yaml
+++ b/kustomizations/matrix/synapse/secret-key.enc.yaml
@ -4,15 +4,15 @@ metadata:
    name: signing-key
 type: Opaque
 stringData:
-    signing.key: ENC[AES256_GCM,data:yrRjsuapmgDgBNNXGO9YyuZtkZaFPDg80SuJgdYWS3grCnN/hmkQ5x2icAf5i4f6TjAOreYxJYzRwQ==,iv:0ww6IrM9oY47ex1zYRULQx7TdATJ9odkk5k95yDo0ms=,tag:4/MjSSY2SltTuPtMtCRUtw==,type:str]
+    signing.key: ENC[AES256_GCM,data:lX/bUBlbbCEMa154rgZZdco50X1AFqpt8TpeltD8HbfdG8Vf0O2uUlCxVzg4NTmwzPgq8a2DZh+PPwF30V78mI8C5HsDSejzD8dqCab+Ycl6eOanvvwAqMHS2tSZIvZSsR6rsmC9/v4oDsS3cf9tN4KSycGrAQ==,iv:8KeQespynLU0s8aWtPtsi6zt0BXFWSBoqduFwa9pq90=,tag:c0zXQqkmWOT6nB9qZ4pExw==,type:str]
 sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
-    lastmodified: "2024-01-22T05:45:47Z"
-    mac: ENC[AES256_GCM,data:GitHfIeAeu4g0bf1obvjd0TS6j5AZ0qo00i4mwIL3MKtCVa3dLfGkx4dE9SD0NZqBMpHdZTWnns145uCXnJTVdyLAlz54AuG/bn7eO642SghLpUvhyhH+c+xxQF2c3UJiR7TBdjJBh0BUBSO/yOBB0ondzocW9T1hDg/ExBjeo8=,iv:77yhCNc2cJ7/uuXOEma5LEyU0YIJSQiw4IYLLASli04=,tag:41IvCCKLfQZUNHsv6DvMsA==,type:str]
+    lastmodified: "2025-10-10T06:00:23Z"
+    mac: ENC[AES256_GCM,data:amczAIhBZmHdBSNB3QiJ1Sg+iida69iaaV6ScrLO2KNJGVO9AsirAaAYKrozuNbRvfUGQcA95bwaD0bkkIuPNw3/s5vbUW7TznOuWj7vXt199b6ovgoj+l+2pxmxyYqJdWo+2LTTR/nvDbCsEPRzZymssJLn0fOyMRQ9teZNwBM=,iv:vgP+D5FNzq8betC6JOYqzFo656m/TIT7Vtwe9yVpWtc=,tag:UB2ID711iaN8Ks2sTsCqyA==,type:str]
    pgp:
        - created_at: "2024-01-11T20:55:07Z"
          enc: |-