From b06c994c9d2e4c80205eb224958c4ce5f0f5f4e4 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sat, 1 Aug 2026 08:14:41 +0000
Subject: [PATCH] Fix Stalwart pod crash-loop by changing health probes to exec

The pod was crash-looping because Stalwart's security configuration
blocks the kubelet's IP (10.244.4.1) from accessing the HTTP health
endpoints. The kubelet's health checks were failing, causing the
startup probe to fail after 6 attempts, leading to pod restarts.

Changed all three health probes (startup, liveness, readiness) from
httpGet to exec with curl localhost. This bypasses the IP blocking
since the health check runs from inside the container using localhost,
which is not subject to Stalwart's external IP blocking rules.

This fix is non-destructive to Stalwart's configuration and state.
The pod will restart once with the new probe configuration, but no
data or configuration will be lost.

Root cause: Stalwart logs showed "Blocked IP address (security.ip-blocked)
listenerId=http, remoteIp=10.244.4.1" followed by "Shutting down Stalwart
Server (server.shutdown) causedBy=SIGTERM" in a repeating pattern.

Fixes: DEV-420

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/stalwart/stalwart-fresh-deployment.yaml | 30 ++++++++++++++------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/apps/stalwart/stalwart-fresh-deployment.yaml b/apps/stalwart/stalwart-fresh-deployment.yaml
index 3461717..85326f8 100644
--- a/apps/stalwart/stalwart-fresh-deployment.yaml
+++ b/apps/stalwart/stalwart-fresh-deployment.yaml
@@ -139,25 +139,37 @@ spec:
             memory: "2Gi"
             cpu: "2000m"
         startupProbe:
-          httpGet:
-            path: /healthz/live
-            port: 8080
+          exec:
+            command:
+            - curl
+            - -f
+            - --max-time
+            - "3"
+            - http://localhost:8080/healthz/live
           initialDelaySeconds: 60
           periodSeconds: 10
           timeoutSeconds: 5
           failureThreshold: 6
         livenessProbe:
-          httpGet:
-            path: /healthz/live
-            port: 8080
+          exec:
+            command:
+            - curl
+            - -f
+            - --max-time
+            - "3"
+            - http://localhost:8080/healthz/live
           initialDelaySeconds: 30
           periodSeconds: 10
           timeoutSeconds: 5
           failureThreshold: 3
         readinessProbe:
-          httpGet:
-            path: /healthz/ready
-            port: 8080
+          exec:
+            command:
+            - curl
+            - -f
+            - --max-time
+            - "3"
+            - http://localhost:8080/healthz/ready
           initialDelaySeconds: 10
           periodSeconds: 5
           timeoutSeconds: 3