Issue: Stalwart was blocking Traefik ingress controller's IP (10.244.2.227)
with "Blocked IP address" errors, causing 502 Bad Gateway responses.
Root cause: The allowed-ips security restriction on the HTTP listener was
blocking legitimate internal cluster traffic from Traefik.
Fix: Remove the [server.listener.http.security] section entirely. The HTTP
listener is already protected by:
- Running as ClusterIP service (not exposed externally)
- Traefik ingress with TLS termination
- Kubernetes NetworkPolicies (when enabled)
Internal cluster traffic should not be IP-restricted.
Related to DEV-422 (Stalwart not accessible).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Issue: Stalwart pod was crashing with "expected value at line 1 column 1"
when trying to parse /etc/stalwart/stalwart.toml because the file was not
being mounted.
Root cause: The StatefulSet was only mounting bootstrap-config (config.json)
but Stalwart v0.16.11 expects stalwart.toml for runtime configuration.
Changes:
- Add stalwart-config.yaml ConfigMap with complete stalwart.toml
- Update StatefulSet to mount stalwart-config at /etc/stalwart/stalwart.toml
- Keep bootstrap-config mount for backward compatibility
This resolves DEV-422 (Stalwart not accessible).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
This reverts commit c060c83. The TOML configuration approach caused
Stalwart to fail to start due to configuration parsing errors.
Will implement a different approach that doesn't require a full
configuration file rewrite.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Stalwart was blocking the HTTP port (8080) from Traefik's internal IP
(10.244.2.227), causing 502 errors when accessing mail.basicstack.de.
Changes:
- Added complete Stalwart TOML configuration (stalwart-config.yaml)
- Configured HTTP listener security to allow internal pod network (10.244.0.0/16)
- Updated StatefulSet to use the new configuration file
- This allows Traefik ingress to reach the Stalwart web UI backend
The fix is non-destructive:
- PVC data is preserved
- Rolling update will restart the pod with new config
- Only security setting is changed (adding allowed IPs)
Fixes: DEV-422
Co-Authored-By: Paperclip <noreply@paperclip.ing>
