basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
127 commits 7 branches 0 tags 2.5 MiB
Commit graph

121 commits

Author SHA1 Message Date
CTO Agent
8054ef4018 Implement automatic TLS certificate renewal for Stalwart 
Added Stakater Reloader to automatically restart Stalwart pods when
TLS certificates are renewed by cert-manager. This ensures seamless
certificate rotation without manual intervention.

Changes:
- Deploy Stakater Reloader in infrastructure/networking/
- Add Reloader annotation to Stalwart StatefulSet to watch stalwart-tls secret
- Document certificate renewal process and troubleshooting

The certificate is managed by cert-manager with Let's Encrypt and will
automatically renew 30 days before expiration (renewal date: 2026-08-20).
Reloader detects secret updates and triggers a rolling restart of the
Stalwart StatefulSet to load the new certificate.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 16:48:48 +00:00
andreas.leinen
a24420ac3e apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:39:11 +00:00
andreas.leinen
453fca6486 apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:37:22 +00:00
andreas.leinen
975a932049 apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:36:59 +00:00
andreas.leinen
d010d9a63f apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:36:36 +00:00
andreas.leinen
712c11fd38 apps/stalwart/README.md aktualisiert 2026-07-04 16:31:09 +00:00
andreas.leinen
72c7a78cc8 apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:30:29 +00:00
andreas.leinen
d7367feead apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:30:01 +00:00
andreas.leinen
fbe131821e apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:27:09 +00:00
andreas.leinen
71eacdb9be apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:26:47 +00:00
andreas.leinen
ddf55d5050 apps/stalwart/manual_config_steps.md hinzugefügt 2026-07-04 16:26:20 +00:00
andreas.leinen
3b97089908 apps/stalwart/README.md aktualisiert 2026-07-04 16:11:57 +00:00
andreas.leinen
c4efccea91 apps/stalwart/README.md aktualisiert 2026-07-04 13:46:20 +00:00
andreas.leinen
cea2c2346e apps/stalwart/README.md aktualisiert 2026-07-04 13:41:06 +00:00
CTO Agent
afe05cc772 Clean up Stalwart deployment - remove all old configs and OIDC attempts 
Removed all experimental files, patches, OIDC configs, and Helm values.
Keeping only the clean v0.16.11 deployment with username/password auth.

Files kept:
- stalwart-fresh-deployment.yaml (main manifest)
- stalwart-admin-credentials-sealed.yaml (admin password)
- stalwart-s3-backup-sealed.yaml (backup credentials)
- README.md (updated documentation)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 13:22:36 +00:00
CTO Agent
3acfa1f5e1 Remove config.toml ConfigMap and add TLS certificate mount 
- Removed stalwart-config ConfigMap (config.toml not used in v0.16.11)
- All configuration is done via Stalwart API and stored in RocksDB
- Added TLS certificate mount from stalwart-tls secret
- Using stalwartlabs/stalwart:v0.16.11

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 12:13:18 +00:00
CTO Agent
0d4d9b9adf fix(stalwart): Add config.json to load web UI configuration 
- Mount /etc/stalwart/config.json pointing to RocksDB
- Allows Stalwart to load configuration from web UI setup
- Resolves bootstrap mode loop

Refs: DEV-206

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 10:34:28 +00:00
CTO Agent
843affde05 fix(stalwart): Correct permissions to 2000:2000 
- Fixed init container to set ownership to 2000:2000
- Stalwart container runs as user 2000 by default
- Resolves permission denied error during web UI setup

Refs: DEV-206

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 10:23:15 +00:00
CTO Agent
509bbebe10 feat(stalwart): Fresh deployment with basic auth 
- Deployed Stalwart v0.16.11 in stalwart namespace
- Configured encrypted hcloud storage (20Gi PVC)
- Set up LoadBalancer services for SMTP/IMAP
- Configured Ingress with TLS for mail.basicstack.de
- Daily backup CronJob with S3/restic
- Bootstrap mode requires web UI setup completion

Refs: DEV-206

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-04 10:17:39 +00:00
CTO Agent
d5e8c28a6a Convert all secrets to SealedSecrets for enhanced security 
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:38:27 +00:00
CTO Agent
c64f9ab0d0 Initialize CD/CI repository structure with Stalwart example 
Set up the repository structure following GitOps principles:
- apps/ for application deployments (Stalwart as example)
- infrastructure/ for cluster-wide configs (networking, monitoring)
- docs/ for general documentation

Migrated complete Stalwart deployment configuration including:
- Multiple deployment variants (basic, OIDC-enabled)
- Helm values files
- Monitoring and dashboard configurations
- Operational documentation (backup/restore, bootstrap)
- Configuration patches and fixes

Added comprehensive README files at each level to guide future use.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 18:08:31 +00:00