117 lines
2.4 KiB
YAML
117 lines
2.4 KiB
YAML
|
# Stalwart Helm Fix - Proper Environment Configuration
|
||
|
|
image:
|
||
|
|
repository: stalwartlabs/stalwart
|
||
|
|
tag: "v0.16.9"
|
||
|
|
pullPolicy: Always
|
||
|
|
|
||
|
|
# IMPORTANT: Remove args to let Stalwart use environment variables
|
||
|
|
# The Helm chart should not pass --config if we want env-based config
|
||
|
|
extraArgs: []
|
||
|
|
|
||
|
|
# Enable recovery admin
|
||
|
|
recoveryAdmin:
|
||
|
|
enabled: true
|
||
|
|
username: admin
|
||
|
|
password: FreshSetup2026!
|
||
|
|
|
||
|
|
# Persistence
|
||
|
|
persistence:
|
||
|
|
enabled: true
|
||
|
|
storageClass: hcloud-volumes-encrypted
|
||
|
|
accessMode: ReadWriteOnce
|
||
|
|
size: 20Gi
|
||
|
|
|
||
|
|
# Service configuration
|
||
|
|
service:
|
||
|
|
type: LoadBalancer
|
||
|
|
ports:
|
||
|
|
smtp: 25
|
||
|
|
submission: 587
|
||
|
|
smtps: 465
|
||
|
|
imap: 143
|
||
|
|
imaps: 993
|
||
|
|
pop3: 110
|
||
|
|
pop3s: 995
|
||
|
|
sieve: 4190
|
||
|
|
mgmt: 8080
|
||
|
|
|
||
|
|
# Ingress
|
||
|
|
ingress:
|
||
|
|
enabled: true
|
||
|
|
className: traefik
|
||
|
|
annotations:
|
||
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||
|
|
hosts:
|
||
|
|
- host: mail.basicstack.de
|
||
|
|
paths:
|
||
|
|
- path: /
|
||
|
|
pathType: Prefix
|
||
|
|
portName: mgmt
|
||
|
|
tls:
|
||
|
|
- secretName: stalwart-tls
|
||
|
|
hosts:
|
||
|
|
- mail.basicstack.de
|
||
|
|
|
||
|
|
# Minimal config - just database location
|
||
|
|
config:
|
||
|
|
"@type": "RocksDb"
|
||
|
|
path: "/var/lib/stalwart"
|
||
|
|
|
||
|
|
# Security contexts
|
||
|
|
podSecurityContext:
|
||
|
|
fsGroup: 2000
|
||
|
|
runAsUser: 2000
|
||
|
|
runAsGroup: 2000
|
||
|
|
|
||
|
|
containerSecurityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities:
|
||
|
|
drop: [ALL]
|
||
|
|
add: [NET_BIND_SERVICE]
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
|
||
|
|
# Resources
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
memory: "512Mi"
|
||
|
|
cpu: "250m"
|
||
|
|
limits:
|
||
|
|
memory: "2Gi"
|
||
|
|
cpu: "2"
|
||
|
|
|
||
|
|
# Environment variables for proper configuration
|
||
|
|
env:
|
||
|
|
- name: RUST_LOG
|
||
|
|
value: "debug"
|
||
|
|
- name: STALWART_LOG_LEVEL
|
||
|
|
value: "debug"
|
||
|
|
|
||
|
|
# OIDC Configuration
|
||
|
|
envFrom:
|
||
|
|
- secretRef:
|
||
|
|
name: stalwart-stalwart-env
|
||
|
|
|
||
|
|
# Additional OIDC env vars
|
||
|
|
extraEnv:
|
||
|
|
- name: STALWART_OAUTH_ENABLE
|
||
|
|
value: "true"
|
||
|
|
- name: STALWART_OAUTH_ISSUER
|
||
|
|
value: "https://auth.basicstack.de"
|
||
|
|
- name: STALWART_OAUTH_REDIRECT_URI
|
||
|
|
value: "https://mail.basicstack.de/admin/oauth/callback"
|
||
|
|
- name: STALWART_OAUTH_SCOPES
|
||
|
|
value: "openid profile email"
|
||
|
|
- name: STALWART_OAUTH_CLIENT_ID
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: stalwart-oidc
|
||
|
|
key: oidc-client-id
|
||
|
|
- name: STALWART_OAUTH_CLIENT_SECRET
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: stalwart-oidc
|
||
|
|
key: oidc-client-secret
|