# Stalwart Helm Values - Fresh Deployment
# Domain: mail.basicstack.de
# Storage: hcloud-volumes-encrypted

image:
  repository: stalwartlabs/stalwart
  tag: "latest"
  pullPolicy: Always

replicaCount: 1

# Enable recovery admin for initial setup
recoveryAdmin:
  enabled: true
  username: "admin"
  password: "FreshSetup2026!"

# RocksDB data store
config:
  "@type": RocksDb
  path: /var/lib/stalwart

# LoadBalancer service to expose mail ports
service:
  type: LoadBalancer
  ports:
    smtp: 25
    smtps: 465
    submission: 587
    imap: 143
    imaps: 993
    pop3: 110
    pop3s: 995
    sieve: 4190
    http: 80
    https: 443
    mgmt: 8080

# Ingress for web management interface
ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  hosts:
    - host: mail.basicstack.de
      paths:
        - path: /
          pathType: Prefix
          portName: mgmt
  tls:
    - secretName: stalwart-tls
      hosts:
        - mail.basicstack.de

# Persistent storage with encrypted volumes
persistence:
  enabled: true
  accessMode: ReadWriteOnce
  storageClass: "hcloud-volumes-encrypted"
  size: 20Gi

# Pod security
podSecurityContext:
  fsGroup: 2000
  runAsUser: 2000
  runAsGroup: 2000

containerSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  seccompProfile:
    type: RuntimeDefault

# Resource limits
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "2Gi"
    cpu: "2000m"