matrix: migrate Synapse -> tuwunel (Rust homeserver, fresh start, federated)

Replace the cramped Synapse deployment with tuwunel v1.7.1: embedded RocksDB
drops the CNPG dependency (both init-containers, the db ESO, the Reloader
annotation all gone), env-var config, fsGroup-owned encrypted PVC, federation
on, tuwunel-served well-known delegation to :443. server_name unchanged
(matrix.viktorbarzin.me); fresh start (no Synapse->RocksDB migration path).
Registered @viktor admin then disabled registration (403).

Cleanup: removed the orphaned pg-matrix Vault static role and dropped the
matrix Postgres DB/role; updated service-catalog, upgrade-config, CLAUDE.md
PG-rotation list, and the Matrix OIDC->orphaned auth notes. Design+plan in
docs/plans/2026-06-08-matrix-synapse-to-tuwunel-*.

Already applied via scripts/tg (matrix tier-1 + targeted vault tier-0), so
[ci skip] to avoid CI reconciling an unrelated pre-existing vault OIDC
tune-TTL drift.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/architecture/authentication.md

@@ -102,7 +102,7 @@ Authentik provides OIDC for 10 applications:
 | Kubernetes | OIDC (public client) | K8s API authentication (kubectl / kubelogin CLI) |
 | Kubernetes Dashboard | OIDC (confidential) | Built for dashboard SSO — currently **idle** (apiserver OIDC blocked; dashboard uses forward-auth + token-paste) |
 | Linkwarden | OIDC | Bookmark manager SSO |
-| Matrix | OIDC | Matrix homeserver SSO |
+| Matrix | OIDC | ⚠️ Legacy/orphaned — Synapse→tuwunel migration 2026-06-08; tuwunel uses native password auth, OIDC SSO not wired |
 | Wrongmove | OIDC | Real estate app SSO |
 
 ### Kubernetes API authentication (OIDC) — CURRENTLY NON-FUNCTIONAL

docs/plans/2026-06-08-matrix-synapse-to-tuwunel-design.md

@@ -0,0 +1,52 @@
+# Matrix: Synapse → tuwunel migration — Design
+
+**Date:** 2026-06-08
+**Status:** Implemented
+**Stack:** `stacks/matrix` (+ `stacks/vault` cleanup)
+
+## Context
+
+The `matrix` homeserver ran **Synapse** (`matrixdotorg/synapse:v1.151.0`) on a
+cramped `256Mi/512Mi` allocation. Synapse (Python) wants 1–2 GB; at 512Mi it was
+starved. During a Slack-vs-Discord-vs-Matrix evaluation Viktor confirmed Slack
+stays his primary hub, but wanted a **working, federated Matrix server kept
+available "in case I need it."** The resource pain was Synapse-specific — not
+inherent to Matrix — so the fix was to swap the homeserver implementation, not
+abandon Matrix.
+
+## Decision
+
+Replace Synapse with **tuwunel v1.7.1** (Rust, RocksDB) — the
+enterprise/Swiss-government-backed official successor to the (archived 2026-01-19)
+conduwuit.
+
+| Choice | Decision | Rationale |
+|---|---|---|
+| Homeserver | **tuwunel** (vs continuwuity) | Corporate-backed, full-time staff → best longevity for a set-and-forget server |
+| Data | **Fresh start** (no migration) | No supported Synapse(Postgres)→RocksDB path; Viktor confirmed old rooms/messages disposable |
+| Federation | **ON** | A backup server is only useful if it can reach the wider Matrix network |
+| `server_name` | **unchanged** (`matrix.viktorbarzin.me`) | Element clients keep pointing at the same place; only a re-login needed |
+| Database | **embedded RocksDB** on the existing encrypted PVC | Drops the entire CNPG dependency; local-SSD LUKS2 suits RocksDB's small writes (NFS would be wrong) |
+| Registration | token-gated, then **disabled** | First user = admin; locked down after registering `@viktor` |
+| Auth | **native password** | tuwunel OIDC SSO not wired — Authentik Matrix OAuth app is now orphaned (harmless) |
+| Media cap | **50 MiB** | Kept under Cloudflare's 100 MB proxied-request ceiling |
+
+## Alternatives considered
+
+- **Keep Synapse, bump to 2 GB** — zero-migration, but stays the heavy Python
+  server; rejected in favour of the lightweight Rust target Viktor asked for.
+- **continuwuity** — community continuation; viable and lighter-community, but
+  tuwunel's corporate backing won on longevity.
+- **Synapse → tuwunel data migration** — not possible (different storage
+  engines); fresh start is the only path.
+
+## As-built
+
+- Fully env-var configured (`TUWUNEL_*`, `__` for nested) — no TOML ConfigMap.
+- tuwunel serves its own `.well-known/matrix/{client,server}` → federation
+  resolves to Cloudflare-proxied `:443` (no 8448 / SRV needed).
+- Ingress unchanged: `auth = "none"` (Matrix uses bearer/signed requests),
+  `dns_type = "proxied"`.
+- Pod `securityContext` `runAsUser/runAsGroup/fsGroup = 1000` so uid 1000 can
+  write the encrypted RocksDB PVC.
+- Image kept under Keel + diun semver management (`^v\d+\.\d+\.\d+$`).

docs/plans/2026-06-08-matrix-synapse-to-tuwunel-plan.md

@@ -0,0 +1,58 @@
+# Matrix: Synapse → tuwunel migration — Plan (executed)
+
+**Date:** 2026-06-08 · **Companion:** `2026-06-08-matrix-synapse-to-tuwunel-design.md`
+
+## Executed steps
+
+1. **Vault** — generated a 32-byte `registration_token`, stored at
+   `secret/matrix`.
+2. **`stacks/matrix` rewrite** — replaced Synapse with tuwunel: removed the
+   `matrix-db-creds` ExternalSecret, both init-containers (`install-psycopg2`,
+   `inject-db-password`), the `extra-packages` volume, and the Reloader
+   annotation; added the `matrix-secrets` ExternalSecret (vault-kv `dataFrom`),
+   the `TUWUNEL_*` env, `securityContext` 1000, and the tuwunel image. Encrypted
+   PVC, Service (`80→8008`), and ingress (`auth="none"`, proxied) unchanged.
+   - The image is in the deployment's `ignore_changes` (KEEL_IGNORE_IMAGE); it
+     was **temporarily un-ignored** for this base-image swap, then re-added at
+     step 4 so Keel resumes tag management.
+   - `tg init -reconfigure` was required first (Tier-1 PG-backend creds rotate
+     weekly → "Backend configuration block has changed").
+3. **Apply** — `Plan: 1 to add, 2 to change, 1 to destroy`. tuwunel 1.7.1 came up
+   1/1, created a fresh RocksDB on the encrypted PVC (no permission errors —
+   fsGroup worked).
+4. **Verify** — all `200`: `/_tuwunel/server_version`, `.well-known/matrix/
+   {client,server}`, `/_matrix/client/versions`, `/_matrix/federation/v1/version`.
+   Registered `@viktor:matrix.viktorbarzin.me` (first user → admin) via the token
+   flow; `whoami` confirmed. Creds stored at `secret/matrix`
+   (`admin_user`, `admin_password`).
+5. **Lock down** — `TUWUNEL_ALLOW_REGISTRATION=false` + re-added image
+   `ignore_changes`; applied. Registration now returns `403 M_FORBIDDEN`.
+6. **Cleanup** —
+   - `stacks/vault`: removed the `pg_matrix` static role + its `allowed_roles`
+     entry (targeted apply — the full plan also wanted an **unrelated** OIDC
+     `tune`-TTL change, deliberately NOT applied; see residual items).
+   - Dropped the orphaned `matrix` Postgres DB (16 MB) + `matrix` role on the
+     CNPG primary (`pg-cluster-2`).
+   - Docs updated: `.claude/CLAUDE.md` (PG-rotation list), `service-catalog.md`,
+     `upgrade-config.json` (removed synapse image-rename + matrix PG entry),
+     `authentication.md` + `authentik-state.md` (Matrix OIDC → orphaned).
+
+## Rollback
+
+Fresh start was confirmed, so there is no Synapse data to preserve. To revert the
+*service*: restore the Synapse `main.tf` from git, re-add the `pg_matrix` Vault
+role, and restore the `matrix` Postgres DB from the daily per-db dump
+(`/backup/per-db/matrix/`). The reused encrypted PVC still holds Synapse's old
+`homeserver.yaml` / signing key / media at the volume root alongside the new
+RocksDB dir.
+
+## Residual / follow-up items (flagged to user)
+
+- **Authentik Matrix OAuth2 app is now orphaned** — tuwunel uses native password
+  auth (OIDC SSO not wired). Harmless; can be removed from the authentik stack
+  later if desired.
+- **Pre-existing drift in `stacks/vault`**: `vault_jwt_auth_backend.oidc` shows a
+  `tune` diff (explicit `768h` default/max lease TTLs being dropped). This
+  predates this migration and was **not** applied. Resolve separately.
+- **Synapse leftover files** remain on the encrypted PVC volume root (unused by
+  tuwunel). Can be `rm`'d after confidence in the new server.