basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
48 commits 7 branches 0 tags 2.5 MiB
Commit graph

6 commits

Author SHA1 Message Date
CTO Agent
8054ef4018 Implement automatic TLS certificate renewal for Stalwart 
Added Stakater Reloader to automatically restart Stalwart pods when
TLS certificates are renewed by cert-manager. This ensures seamless
certificate rotation without manual intervention.

Changes:
- Deploy Stakater Reloader in infrastructure/networking/
- Add Reloader annotation to Stalwart StatefulSet to watch stalwart-tls secret
- Document certificate renewal process and troubleshooting

The certificate is managed by cert-manager with Let's Encrypt and will
automatically renew 30 days before expiration (renewal date: 2026-08-20).
Reloader detects secret updates and triggers a rolling restart of the
Stalwart StatefulSet to load the new certificate.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 16:48:48 +00:00
CTO Agent
afe05cc772 Clean up Stalwart deployment - remove all old configs and OIDC attempts 
Removed all experimental files, patches, OIDC configs, and Helm values.
Keeping only the clean v0.16.11 deployment with username/password auth.

Files kept:
- stalwart-fresh-deployment.yaml (main manifest)
- stalwart-admin-credentials-sealed.yaml (admin password)
- stalwart-s3-backup-sealed.yaml (backup credentials)
- README.md (updated documentation)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 13:22:36 +00:00
CTO Agent
3acfa1f5e1 Remove config.toml ConfigMap and add TLS certificate mount 
- Removed stalwart-config ConfigMap (config.toml not used in v0.16.11)
- All configuration is done via Stalwart API and stored in RocksDB
- Added TLS certificate mount from stalwart-tls secret
- Using stalwartlabs/stalwart:v0.16.11

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 12:13:18 +00:00
CTO Agent
0d4d9b9adf fix(stalwart): Add config.json to load web UI configuration 
- Mount /etc/stalwart/config.json pointing to RocksDB
- Allows Stalwart to load configuration from web UI setup
- Resolves bootstrap mode loop

Refs: DEV-206

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 10:34:28 +00:00
CTO Agent
843affde05 fix(stalwart): Correct permissions to 2000:2000 
- Fixed init container to set ownership to 2000:2000
- Stalwart container runs as user 2000 by default
- Resolves permission denied error during web UI setup

Refs: DEV-206

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 10:23:15 +00:00
CTO Agent
509bbebe10 feat(stalwart): Fresh deployment with basic auth 
- Deployed Stalwart v0.16.11 in stalwart namespace
- Configured encrypted hcloud storage (20Gi PVC)
- Set up LoadBalancer services for SMTP/IMAP
- Configured Ingress with TLS for mail.basicstack.de
- Daily backup CronJob with S3/restic
- Bootstrap mode requires web UI setup completion

Refs: DEV-206

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 10:17:39 +00:00