2026-07-01 18:08:31 +00:00
|
|
|
apiVersion: v1
|
|
|
|
|
kind: ConfigMap
|
|
|
|
|
metadata:
|
|
|
|
|
name: stalwart-stalwart-config
|
|
|
|
|
namespace: mail
|
|
|
|
|
labels:
|
|
|
|
|
app.kubernetes.io/instance: stalwart
|
|
|
|
|
app.kubernetes.io/name: stalwart
|
|
|
|
|
data:
|
|
|
|
|
config.json: |
|
|
|
|
|
{
|
|
|
|
|
"store": {
|
|
|
|
|
"db": {
|
|
|
|
|
"type": "rocksdb",
|
|
|
|
|
"path": "/var/lib/stalwart/data"
|
|
|
|
|
},
|
|
|
|
|
"blob": {
|
|
|
|
|
"type": "rocksdb",
|
|
|
|
|
"path": "/var/lib/stalwart/blobs"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"directory": {
|
|
|
|
|
"internal": {
|
|
|
|
|
"type": "internal",
|
|
|
|
|
"store": "db"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"authentication": {
|
|
|
|
|
"fallback-admin": {
|
|
|
|
|
"user": "admin",
|
Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
"secret": "REPLACED_BY_SECRET"
|
2026-07-01 18:08:31 +00:00
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"server": {
|
|
|
|
|
"hostname": "mail.basicstack.de",
|
|
|
|
|
"http": {
|
|
|
|
|
"bind": ["[::]:8080"],
|
|
|
|
|
"protocol": "http"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"session": {
|
|
|
|
|
"ehlo": {
|
|
|
|
|
"require": true
|
|
|
|
|
},
|
|
|
|
|
"auth": {
|
|
|
|
|
"directory": "internal"
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
"queue": {
|
|
|
|
|
"path": "/var/lib/stalwart/queue",
|
|
|
|
|
"hash": 64
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
---
|
|
|
|
|
apiVersion: v1
|
|
|
|
|
kind: Secret
|
|
|
|
|
metadata:
|
|
|
|
|
name: stalwart-stalwart-env
|
|
|
|
|
namespace: mail
|
|
|
|
|
labels:
|
|
|
|
|
app.kubernetes.io/instance: stalwart
|
|
|
|
|
app.kubernetes.io/name: stalwart
|
|
|
|
|
type: Opaque
|
|
|
|
|
stringData:
|
|
|
|
|
STALWART_LOG_LEVEL: "info"
|
|
|
|
|
STALWART_LOG_FORMAT: "json"
|