2026-07-04 13:22:36 +00:00
|
|
|
# Stalwart Mail Server v0.16.11
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
Clean deployment of Stalwart mail server with username/password authentication only.
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
## Architecture
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
- **Version**: v0.16.11
|
|
|
|
|
- **Authentication**: Username/password only (NO OAuth/OIDC)
|
|
|
|
|
- **Configuration**: API-based (stored in RocksDB)
|
|
|
|
|
- **Storage**: Encrypted hcloud-volumes (20Gi)
|
|
|
|
|
- **Backup**: Daily restic backup to S3 at 3 AM
|
|
|
|
|
- **Web UI**: https://mail.basicstack.de
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
## Files
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
- `stalwart-fresh-deployment.yaml` - Main deployment manifest
|
|
|
|
|
- `stalwart-admin-credentials-sealed.yaml` - Sealed secret for admin password
|
|
|
|
|
- `stalwart-s3-backup-sealed.yaml` - Sealed secret for S3 backup credentials
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
## Deployment
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
```bash
|
|
|
|
|
# Apply sealed secrets first
|
|
|
|
|
kubectl apply -f stalwart-admin-credentials-sealed.yaml
|
|
|
|
|
kubectl apply -f stalwart-s3-backup-sealed.yaml
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
# Create bootstrap config
|
|
|
|
|
kubectl create configmap stalwart-bootstrap-config \
|
|
|
|
|
--from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
|
|
|
|
|
-n stalwart
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
# Deploy Stalwart
|
|
|
|
|
kubectl apply -f stalwart-fresh-deployment.yaml
|
|
|
|
|
```
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
## Initial Admin Login
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
After deployment, log in at https://mail.basicstack.de with:
|
|
|
|
|
- Username: `admin`
|
|
|
|
|
- Password: (from stalwart-admin-credentials secret)
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
## Configuration
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-08-01 09:52:26 +00:00
|
|
|
> **IMPORTANT:** The configuration is stored in the RocksDB and cannot be overwritten by a configuration file!
|
|
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
All configuration is done via the web UI or API. The bootstrap config only points to the RocksDB database location. NO config.toml files are used.
|
2026-07-04 13:46:20 +00:00
|
|
|
|
2026-07-04 13:41:06 +00:00
|
|
|
Check https://stalw.art/docs/ref/ for configuration possibilities.
|
2026-07-04 16:11:57 +00:00
|
|
|
The API access via /jmap seems to be too complex for the agent and the configruation has been done manually.
|
|
|
|
|
|
2026-07-04 16:31:09 +00:00
|
|
|
Refer to [manual configuration steps](manual_config_steps.md)
|
2026-07-01 18:08:31 +00:00
|
|
|
|
2026-07-04 13:22:36 +00:00
|
|
|
## Ports
|
|
|
|
|
|
|
|
|
|
- SMTP: 25, 587, 465
|
|
|
|
|
- IMAP: 143, 993
|
|
|
|
|
- HTTP: 8080 (web UI)
|
|
|
|
|
|
|
|
|
|
## Storage
|
|
|
|
|
|
|
|
|
|
Data is stored in `/var/lib/stalwart` using the RocksDB database format. This includes:
|
|
|
|
|
- Email messages
|
|
|
|
|
- User accounts
|
|
|
|
|
- Server configuration
|
|
|
|
|
- TLS certificates configuration
|
2026-07-04 17:19:55 +00:00
|
|
|
|
|
|
|
|
## Certificate Renewal
|
|
|
|
|
|
|
|
|
|
Refer to [Automatic Renewal TLS Certificate](CERTIFICATE-RENEWAL.md)
|
