From 3acfa1f5e17ccac39b8cff1e160b4df073a523f5 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sat, 4 Jul 2026 12:13:18 +0000
Subject: [PATCH] Remove config.toml ConfigMap and add TLS certificate mount

- Removed stalwart-config ConfigMap (config.toml not used in v0.16.11)
- All configuration is done via Stalwart API and stored in RocksDB
- Added TLS certificate mount from stalwart-tls secret
- Using stalwartlabs/stalwart:v0.16.11

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/stalwart/stalwart-fresh-deployment.yaml | 66 +++-----------------
 1 file changed, 7 insertions(+), 59 deletions(-)

diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index f81bb53..d88fd4c 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -18,65 +18,6 @@ spec:
       storage: 20Gi
 ---
 apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: stalwart-config
-  namespace: stalwart
-data:
-  config.toml: |
-    [server]
-    hostname = "mail.basicstack.de"
-
-    [server.listener.smtp]
-    bind = ["0.0.0.0:25"]
-    protocol = "smtp"
-
-    [server.listener.submission]
-    bind = ["0.0.0.0:587"]
-    protocol = "smtp"
-    tls.implicit = false
-
-    [server.listener.submissions]
-    bind = ["0.0.0.0:465"]
-    protocol = "smtp"
-    tls.implicit = true
-
-    [server.listener.imap]
-    bind = ["0.0.0.0:143"]
-    protocol = "imap"
-    tls.implicit = false
-
-    [server.listener.imaps]
-    bind = ["0.0.0.0:993"]
-    protocol = "imap"
-    tls.implicit = true
-
-    [server.listener.http]
-    bind = ["0.0.0.0:8080"]
-    protocol = "http"
-
-    [storage]
-    data = "rocksdb"
-    blob = "rocksdb"
-    fts = "rocksdb"
-    lookup = "rocksdb"
-
-    [store.rocksdb]
-    type = "rocksdb"
-    path = "/var/lib/stalwart"
-    compression = "lz4"
-
-    [directory.internal]
-    type = "internal"
-    store = "rocksdb"
-
-    [session.auth]
-    directory = "internal"
-
-    [jmap.protocol]
-    set.max-objects = 100000
----
-apiVersion: v1
 kind: Service
 metadata:
   name: stalwart-smtp
@@ -185,6 +126,9 @@ spec:
         - name: bootstrap-config
           mountPath: /etc/stalwart/config.json
           subPath: config.json
+        - name: tls-certs
+          mountPath: /etc/stalwart/certs
+          readOnly: true
         resources:
           requests:
             memory: "512Mi"
@@ -215,6 +159,10 @@ spec:
       - name: bootstrap-config
         configMap:
           name: stalwart-bootstrap-config
+      - name: tls-certs
+        secret:
+          secretName: stalwart-tls
+          defaultMode: 0444
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress