# Stalwart Helm Values - Fixed Port Configuration
# Domain: mail.basicstack.de
# Storage: hcloud-volumes-encrypted

image:
  repository: stalwartlabs/stalwart
  tag: "latest"
  pullPolicy: Always

replicaCount: 1

# Enable recovery admin for initial setup
recoveryAdmin:
  enabled: true
  username: "admin"
  password: "***REMOVED***"

# RocksDB data store
config:
  "@type": RocksDb
  path: /var/lib/stalwart

# LoadBalancer service - ONLY mail ports, NO HTTP ports (80, 443, 8080)
# HTTP access is handled by Ingress/Traefik
service:
  type: LoadBalancer
  ports:
    # SMTP ports
    smtp: 25
    smtps: 465
    submission: 587
    # IMAP ports
    imap: 143
    imaps: 993
    # POP3 ports (optional, can be disabled)
    pop3: 110
    pop3s: 995
    # Sieve port
    sieve: 4190
    # Management port - exposed internally only, NOT on LoadBalancer
    mgmt: 8080

# Ingress for web management interface via Traefik
ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  hosts:
    - host: mail.basicstack.de
      paths:
        - path: /
          pathType: Prefix
          portName: mgmt
  tls:
    - secretName: stalwart-tls
      hosts:
        - mail.basicstack.de

# Persistent storage with encrypted volumes
persistence:
  enabled: true
  accessMode: ReadWriteOnce
  storageClass: "hcloud-volumes-encrypted"
  size: 20Gi

# Pod security
podSecurityContext:
  fsGroup: 2000
  runAsUser: 2000
  runAsGroup: 2000

containerSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  seccompProfile:
    type: RuntimeDefault

# Resource limits
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "2Gi"
    cpu: "2000m"