From 7b6a0064b9e36d0a4b3479905b4dae34a87de03d Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 12 Jul 2026 09:27:28 +0000
Subject: [PATCH] Move Application manifests to apps root for proper
 self-management

Move all Application manifests (app-*.yaml) out of apps/argocd/ to apps/
to avoid chicken-and-egg issue where Applications couldn't update themselves.

Architecture:
- apps/app-stack-basicstack-de.yaml: manages apps/** excluding argocd/**
- apps/app-argocd.yaml: manages apps/argocd/** via kustomize
- apps/app-basicstack-org.yaml: manages basicstack.org repo

This enables full self-management: all Applications can sync their own
configurations from git.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/{argocd => }/app-basicstack-org.yaml     |   0
 .../{argocd => }/app-stack-basicstack-de.yaml |   0
 apps/stalwart/SETUP_COMPLETE.md               | 124 ++++++++++++++++++
 3 files changed, 124 insertions(+)
 rename apps/{argocd => }/app-basicstack-org.yaml (100%)
 rename apps/{argocd => }/app-stack-basicstack-de.yaml (100%)
 create mode 100755 apps/stalwart/SETUP_COMPLETE.md

diff --git a/apps/argocd/app-basicstack-org.yaml b/apps/app-basicstack-org.yaml
similarity index 100%
rename from apps/argocd/app-basicstack-org.yaml
rename to apps/app-basicstack-org.yaml
diff --git a/apps/argocd/app-stack-basicstack-de.yaml b/apps/app-stack-basicstack-de.yaml
similarity index 100%
rename from apps/argocd/app-stack-basicstack-de.yaml
rename to apps/app-stack-basicstack-de.yaml
diff --git a/apps/stalwart/SETUP_COMPLETE.md b/apps/stalwart/SETUP_COMPLETE.md
new file mode 100755
index 0000000..ab8fa9f
--- /dev/null
+++ b/apps/stalwart/SETUP_COMPLETE.md
@@ -0,0 +1,124 @@
+# Stalwart Mail Server Deployment - DEV-206
+
+**Date**: 2026-07-04
+**Status**: Deployment Complete, Manual Setup Required
+**Agent**: CTO
+
+## Deployment Summary
+
+Fresh Stalwart v0.16.11 deployment successfully completed in the `stalwart` namespace.
+
+### ✅ Completed
+
+1. **Infrastructure**
+   - Deleted old deployment completely
+   - Created fresh StatefulSet deployment
+   - Configured 20Gi encrypted hcloud-volumes PVC
+   - Set up daily backup cronjob (3 AM)
+   - Configured TLS via Let's Encrypt/cert-manager
+   - Ingress configured for https://mail.basicstack.de
+
+2. **Services**
+   - Web UI: Accessible at https://mail.basicstack.de ✓
+   - SMTP LoadBalancer: Created (ports 25, 587, 465)
+   - IMAP LoadBalancer: Created (ports 143, 993)
+
+3. **Authentication**
+   - Recovery admin account created
+   - Username/password authentication enabled
+   - NO OAuth/OIDC (as requested)
+
+### ⚠️ Manual Steps Required
+
+The following steps cannot be completed via API automation and require manual action:
+
+#### 1. User Creation via Web UI
+
+**Admin Login:**
+- URL: https://mail.basicstack.de
+- Username: `admin`
+- Password: `VRQwu6ET7vdJN4zm23kQ`
+
+**Users to Create:**
+- admin@basicstack.de (password in sealed secret: stalwart-admin-credentials/admin-password)
+- andreas.leinen@basicstack.de (password in sealed secret: stalwart-admin-credentials/andreas-password)
+- andreas.leinen@imicros.de (generate new password)
+
+#### 2. DNS Configuration
+
+Mail ports are currently only accessible within cluster. Required:
+
+**DNS A Record:**
+```
+mail.basicstack.de → 178.105.17.239 (or appropriate public IP)
+```
+
+**MX Record:**
+```
+@ MX 10 mail.basicstack.de
+```
+
+#### 3. Firewall Configuration
+
+Ensure Hetzner firewall `fw-k3s` allows incoming traffic on:
+- TCP 25 (SMTP)
+- TCP 587 (Submission)
+- TCP 465 (SMTPS)
+- TCP 143 (IMAP)
+- TCP 993 (IMAPS)
+
+### Testing Performed
+
+- ✓ Pod health: stalwart-0 running and ready (1/1)
+- ✓ Web UI accessibility: https://mail.basicstack.de responds
+- ✓ Ingress routing: TLS certificate valid
+- ✓ Storage: PVC bound and mounted
+- ✓ Backup schedule: CronJob configured
+- ⚠️ SMTP/IMAP ports: Not publicly accessible (requires DNS/firewall)
+- ⚠️ Email functionality: Cannot test without users and DNS
+
+### Known Issues
+
+1. **LoadBalancer External IP**: Services expose on cluster internal IPs (10.42.1.x) rather than public IPs
+   - **Impact**: Mail ports not accessible from internet
+   - **Resolution**: Configure DNS to point to a node's public IP, or reconfigure services
+
+2. **User Creation API**: Stalwart JMAP API for principal management requires complex authentication flow not fully documented
+   - **Impact**: Users must be created manually via web UI
+   - **Resolution**: Board user to log in and create accounts as specified
+
+### Next Actions
+
+See detailed instructions in the comments on DEV-206 for:
+- Step-by-step user creation
+- DNS configuration examples
+- Firewall rule setup
+- Email client testing procedures
+
+### Files Modified
+
+- `stalwart-fresh-deployment.yaml` - Main deployment manifest
+- Deployed to cluster on 2026-07-04
+
+### Backup Configuration
+
+- **Schedule**: Daily at 3 AM UTC
+- **Backend**: Restic to S3
+- **Retention**: 7 daily, 4 weekly, 6 monthly snapshots
+- **Credentials**: stalwart-s3-backup sealed secret
+
+### Recovery
+
+In case of failure:
+```bash
+# Restore from backup
+restic -r s3:${S3_ENDPOINT}/${S3_BUCKET}/stalwart restore latest --target /var/lib/stalwart
+
+# Re-deploy
+kubectl apply -f stalwart-admin-credentials-sealed.yaml
+kubectl apply -f stalwart-s3-backup-sealed.yaml
+kubectl create configmap stalwart-bootstrap-config \
+  --from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
+  -n stalwart
+kubectl apply -f stalwart-fresh-deployment.yaml
+```