---
apiVersion: v1
kind: ConfigMap
metadata:
  name: stalwart-config
  namespace: stalwart
data:
  stalwart.toml: |
    #
    # Stalwart Mail Server Configuration
    #

    # DEV-476: primary store is PostgreSQL (see stalwart-bootstrap-config.yaml).
    # Note: the container starts with `--config /etc/stalwart/config.json`, so
    # this stalwart.toml is not read at runtime for a live pod — the bootstrap
    # JSON is authoritative. Kept in sync here as documentation and for any
    # one-shot tooling that references the toml.
    [store]
    data = "postgres"

    [store.postgres]
    type = "postgresql"
    host = "stalwart-postgres"
    port = 5432
    database = "stalwart"
    user = "stalwart"
    password = "%{env:PGPASSWORD}%"
    tls.enable = false

    #
    # Server Configuration
    #

    [server]
    hostname = "mail.basicstack.de"

    # HTTP Listener (Web UI and API)
    [server.listener.http]
    bind = ["0.0.0.0:8080"]
    protocol = "http"

    # Security: Allow internal cluster IPs for Traefik ingress
    # Pod network CIDR: 10.244.0.0/16
    [server.listener.http.security]
    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]

    # SMTP Listener (Port 25)
    [server.listener.smtp]
    bind = ["0.0.0.0:25"]
    protocol = "smtp"

    # Security: Allow internal cluster IPs for Traefik ingress
    [server.listener.smtp.security]
    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]

    # Submission Listener (Port 587 with STARTTLS)
    [server.listener.submission]
    bind = ["0.0.0.0:587"]
    protocol = "smtp"

    # Security: Allow internal cluster IPs for Traefik ingress
    [server.listener.submission.security]
    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]

    # IMAPS Listener (Port 993 with TLS)
    [server.listener.imaps]
    bind = ["0.0.0.0:993"]
    protocol = "imap"
    tls.implicit = true

    # Security: Allow internal cluster IPs for Traefik ingress
    [server.listener.imaps.security]
    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]

    #
    # TLS Configuration
    #

    [server.tls]
    certificate = "file:///etc/stalwart/certs/tls.crt"
    private-key = "file:///etc/stalwart/certs/tls.key"

    #
    # Logging
    #

    [tracing.level]
    default = "info"