From a551ee523588f561708d578b1810c2f810f4e276 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Wed, 22 Jul 2026 18:04:05 +0000
Subject: [PATCH] Remove insecure mail ports 143 (IMAP) and 465 (SMTPS)

Drop legacy insecure mail ports per DEV-359 approval:
- Remove port 465 (SMTPS) from SMTP service - enforce STARTTLS on 587
- Remove port 143 (IMAP) from IMAP service - enforce TLS on 993

This reduces attack surface and enforces secure mail protocols.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/stalwart/stalwart-fresh-deployment.yaml | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index 8f9dc6f..fdc7f0b 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -36,10 +36,7 @@ spec:
       port: 587
       targetPort: 587
       protocol: TCP
-    - name: submissions
-      port: 465
-      targetPort: 465
-      protocol: TCP
+    # Port 465 (SMTPS) removed per DEV-359 approval - enforce secure protocols
 ---
 apiVersion: v1
 kind: Service
@@ -52,10 +49,7 @@ spec:
   selector:
     app: stalwart
   ports:
-    - name: imap
-      port: 143
-      targetPort: 143
-      protocol: TCP
+    # Port 143 (IMAP) removed per DEV-359 approval - enforce secure protocols
     - name: imaps
       port: 993
       targetPort: 993
@@ -111,10 +105,8 @@ spec:
           name: smtp
         - containerPort: 587
           name: submission
-        - containerPort: 465
-          name: submissions
-        - containerPort: 143
-          name: imap
+        # Port 465 (SMTPS) removed - enforce STARTTLS on 587
+        # Port 143 (IMAP) removed - enforce TLS on 993
         - containerPort: 993
           name: imaps
         - containerPort: 8080