Remove HTTP listener IP restrictions from Stalwart config

Issue: Stalwart was blocking Traefik ingress controller's IP (10.244.2.227)
with "Blocked IP address" errors, causing 502 Bad Gateway responses.

Root cause: The allowed-ips security restriction on the HTTP listener was
blocking legitimate internal cluster traffic from Traefik.

Fix: Remove the [server.listener.http.security] section entirely. The HTTP
listener is already protected by:
- Running as ClusterIP service (not exposed externally)
- Traefik ingress with TLS termination
- Kubernetes NetworkPolicies (when enabled)

Internal cluster traffic should not be IP-restricted.

Related to DEV-422 (Stalwart not accessible).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-08-01 08:58:03 +00:00
parent ff1e31941a
commit 01585534f9

View file

@ -29,11 +29,6 @@ data:
bind = ["0.0.0.0:8080"]
protocol = "http"
# Security: Allow internal cluster IPs for Traefik ingress
# Pod network CIDR: 10.244.0.0/16
[server.listener.http.security]
allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
# SMTP Listener (Port 25)
[server.listener.smtp]
bind = ["0.0.0.0:25"]