From 2ec560e0908d30614e12965d6bdf259765e2b5ef Mon Sep 17 00:00:00 2001 From: CTO Date: Sat, 5 Sep 2026 10:03:07 +0000 Subject: [PATCH] feat(vikunja): enable mailer via port-25 in-cluster relay (DEV-563) Vikunja now sends reminder/notification emails through `stalwart-smtp.stalwart.svc.cluster.local:25` using unauthenticated relay from the pod-network CIDR that Stalwart already trusts. The `vikunja@basicstack.de` principal exists in Stalwart but its password is unknown and admin API access to reset it is currently broken (admin/andreas/paperclip password auth returns `{"type":"failure"}` per `stalwart-oidc-only-admin` note). Verified end-to-end: message from `vikunja@basicstack.de` sent via port-25 relay arrived in the passbolt mailbox. Co-Authored-By: Paperclip --- apps/vikunja/README.md | 6 ++++-- apps/vikunja/vikunja-deployment.yaml | 10 ++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/apps/vikunja/README.md b/apps/vikunja/README.md index 8ba0b01..c1f88c5 100644 --- a/apps/vikunja/README.md +++ b/apps/vikunja/README.md @@ -28,9 +28,11 @@ Both the app and Postgres pin to Hetzner location `fsn1` because their PVCs live - Vikunja does not map OIDC groups to the admin flag. Promote the first user post-login: `kubectl -n vikunja exec deploy/vikunja -- /app/vikunja/vikunja user set-admin --admin `. - **PKCE must be OFF on the Pocket ID client.** Vikunja 2.x's OAuth redirect (`frontend/src/helpers/redirectToProvider.ts`) does not send `code_challenge`, and the Go backend does not implement PKCE either. With `pkceEnabled: true` on Pocket ID the flow fails at `/authorize` with `invalid_request … 'code_challenge' parameter is missing`. Client is confidential (`isPublic: false`), so `client_secret` still authenticates the token exchange. -## Optional: SMTP +## SMTP -`VIKUNJA_MAILER_ENABLED=false` today. To enable reminder emails, create a Stalwart mailbox `vikunja@basicstack.de`, add its credentials as a sealed secret `vikunja-mailer`, and set `VIKUNJA_MAILER_ENABLED=true` plus host/port/from env vars. +Reminder emails go through Stalwart on `stalwart-smtp.stalwart.svc.cluster.local:25` using unauthenticated in-cluster relay. Stalwart's port-25 listener trusts the pod-network CIDR (`10.244.0.0/16`), so no SMTP AUTH is required and no sealed secret is needed. Envelope-from is `vikunja@basicstack.de` (the mailbox already exists in Stalwart as principal `g`). + +If a future policy tightens the port-25 CIDR trust, switch to submission on `stalwart-smtp:587` with STARTTLS and a `vikunja-mailer` sealed secret (`VIKUNJA_MAILER_USERNAME`/`VIKUNJA_MAILER_PASSWORD` from a secretKeyRef, `VIKUNJA_MAILER_AUTHTYPE=plain`); creating that secret requires a working Stalwart admin session to (re)set the vikunja principal's password. ## Change control diff --git a/apps/vikunja/vikunja-deployment.yaml b/apps/vikunja/vikunja-deployment.yaml index 070b0c4..6d5439a 100644 --- a/apps/vikunja/vikunja-deployment.yaml +++ b/apps/vikunja/vikunja-deployment.yaml @@ -100,7 +100,17 @@ spec: name: vikunja-oidc-secret key: client-secret - name: VIKUNJA_MAILER_ENABLED + value: "true" + - name: VIKUNJA_MAILER_HOST + value: stalwart-smtp.stalwart.svc.cluster.local + - name: VIKUNJA_MAILER_PORT + value: "25" + - name: VIKUNJA_MAILER_FORCESSL value: "false" + - name: VIKUNJA_MAILER_SKIPTLSVERIFY + value: "true" + - name: VIKUNJA_MAILER_FROMEMAIL + value: vikunja@basicstack.de resources: requests: cpu: 100m