From 8cd2829cd899adf129c9001f2be7f32542da28bf Mon Sep 17 00:00:00 2001
From: paperclip <noreply@paperclip.ing>
Date: Sat, 15 Aug 2026 14:46:29 +0000
Subject: [PATCH] feat(stalwart): switch config/data store from RocksDB to
 PostgreSQL (DEV-476)

Following the DEV-473 rocksdb-to-postgres migration, point Stalwart's bootstrap
config at the PostgreSQL store and expose PGPASSWORD to the container so the
`authSecret: EnvironmentVariable` lookup resolves.

- stalwart-bootstrap-config.yaml: config.json switches @type RocksDb -> PostgreSql
  (host=stalwart-postgres, db=stalwart, authUsername=stalwart,
  authSecret=EnvironmentVariable/PGPASSWORD, useTls=false).
- stalwart-fresh-deployment.yaml: adds PGPASSWORD env from
  secret/stalwart-postgres-credentials.POSTGRES_PASSWORD on the stalwart container.
- stalwart-config.yaml: mirrors the switch in stalwart.toml as documentation
  (the running pod uses `--config /etc/stalwart/config.json`, not the toml).

Board (DEV-476) explicitly asked for the manifest-level switch after the web UI
save failed with a `Permission denied` on the read-only bootstrap emptyDir.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/stalwart/stalwart-bootstrap-config.yaml |  5 ++++-
 apps/stalwart/stalwart-config.yaml           | 18 ++++++++++++++----
 apps/stalwart/stalwart-fresh-deployment.yaml |  6 ++++++
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/apps/stalwart/stalwart-bootstrap-config.yaml b/apps/stalwart/stalwart-bootstrap-config.yaml
index 7fb9b18..17e5ee2 100644
--- a/apps/stalwart/stalwart-bootstrap-config.yaml
+++ b/apps/stalwart/stalwart-bootstrap-config.yaml
@@ -5,4 +5,7 @@ metadata:
   name: stalwart-bootstrap-config
   namespace: stalwart
 data:
-  config.json: '{"@type":"RocksDb","path":"/var/lib/stalwart"}'
+  # DEV-476: Bootstrap now points at the PostgreSQL config/data store.
+  # PGPASSWORD is injected into the stalwart container from
+  # secret/stalwart-postgres-credentials (see stalwart-fresh-deployment.yaml).
+  config.json: '{"@type":"PostgreSql","host":"stalwart-postgres","port":5432,"database":"stalwart","authUsername":"stalwart","authSecret":{"@type":"EnvironmentVariable","variableName":"PGPASSWORD"},"useTls":false}'
diff --git a/apps/stalwart/stalwart-config.yaml b/apps/stalwart/stalwart-config.yaml
index cc43958..c9da9bc 100644
--- a/apps/stalwart/stalwart-config.yaml
+++ b/apps/stalwart/stalwart-config.yaml
@@ -10,12 +10,22 @@ data:
     # Stalwart Mail Server Configuration
     #
 
+    # DEV-476: primary store is PostgreSQL (see stalwart-bootstrap-config.yaml).
+    # Note: the container starts with `--config /etc/stalwart/config.json`, so
+    # this stalwart.toml is not read at runtime for a live pod — the bootstrap
+    # JSON is authoritative. Kept in sync here as documentation and for any
+    # one-shot tooling that references the toml.
     [store]
-    data = "rocksdb"
+    data = "postgres"
 
-    [store.rocksdb]
-    type = "rocksdb"
-    path = "/var/lib/stalwart"
+    [store.postgres]
+    type = "postgresql"
+    host = "stalwart-postgres"
+    port = 5432
+    database = "stalwart"
+    user = "stalwart"
+    password = "%{env:PGPASSWORD}%"
+    tls.enable = false
 
     #
     # Server Configuration
diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index 5201c47..e974c9d 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -145,6 +145,12 @@ spec:
           value: "/etc/stalwart/certs/tls.crt"
         - name: TLS_PRIVATE_KEY
           value: "/etc/stalwart/certs/tls.key"
+        # DEV-476: bootstrap config.json resolves authSecret via this env var.
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: stalwart-postgres-credentials
+              key: POSTGRES_PASSWORD
         volumeMounts:
         - name: data
           mountPath: /var/lib/stalwart