stack.basicstack.de/apps/stalwart/README.md

# Stalwart Mail Server v0.16.11

Clean deployment of Stalwart mail server with username/password authentication only.

## Architecture

- **Version**: v0.16.11
- **Authentication**: Username/password only (NO OAuth/OIDC)
- **Configuration**: API-based (stored in RocksDB)
- **Storage**: Encrypted hcloud-volumes (20Gi)
- **Backup**: Daily restic backup to S3 at 3 AM
- **Web UI**: https://mail.basicstack.de

## Files

- `stalwart-fresh-deployment.yaml` - Main deployment manifest
- `stalwart-admin-credentials-sealed.yaml` - Sealed secret for admin password
- `stalwart-s3-backup-sealed.yaml` - Sealed secret for S3 backup credentials

## Deployment

```bash
# Apply sealed secrets first
kubectl apply -f stalwart-admin-credentials-sealed.yaml
kubectl apply -f stalwart-s3-backup-sealed.yaml

# Create bootstrap config
kubectl create configmap stalwart-bootstrap-config \
  --from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
  -n stalwart

# Deploy Stalwart
kubectl apply -f stalwart-fresh-deployment.yaml
```

## Initial Admin Login

After deployment, log in at https://mail.basicstack.de with:
- Username: `admin`
- Password: (from stalwart-admin-credentials secret)

## Configuration

All configuration is done via the web UI or API. The bootstrap config only points to the RocksDB database location. NO config.toml files are used.

## Ports

- SMTP: 25, 587, 465
- IMAP: 143, 993
- HTTP: 8080 (web UI)

## Storage

Data is stored in `/var/lib/stalwart` using the RocksDB database format. This includes:
- Email messages
- User accounts
- Server configuration
- TLS certificates configuration