basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Remove HTTP listener IP restrictions from Stalwart config

Browse source 
Issue: Stalwart was blocking Traefik ingress controller's IP (10.244.2.227)
with "Blocked IP address" errors, causing 502 Bad Gateway responses.

Root cause: The allowed-ips security restriction on the HTTP listener was
blocking legitimate internal cluster traffic from Traefik.

Fix: Remove the [server.listener.http.security] section entirely. The HTTP
listener is already protected by:
- Running as ClusterIP service (not exposed externally)
- Traefik ingress with TLS termination
- Kubernetes NetworkPolicies (when enabled)

Internal cluster traffic should not be IP-restricted.

Related to DEV-422 (Stalwart not accessible).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-08-01 08:58:03 +00:00
parent ff1e31941a
commit 01585534f9
1 changed files with 0 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
apps/stalwart/stalwart-config.yaml
View file

@ -29,11 +29,6 @@ data:
bind = ["0.0.0.0:8080"] bind = ["0.0.0.0:8080"]
protocol = "http" protocol = "http"
# Security: Allow internal cluster IPs for Traefik ingress
# Pod network CIDR: 10.244.0.0/16
[server.listener.http.security]
allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
# SMTP Listener (Port 25) # SMTP Listener (Port 25)
[server.listener.smtp] [server.listener.smtp]
bind = ["0.0.0.0:25"] bind = ["0.0.0.0:25"]