# Stalwart Helm Chart Values
# Domain: mail.basicstack.de
# Storage: hcloud-volumes-encrypted

image:
  repository: stalwartlabs/stalwart
  tag: "latest"
  pullPolicy: Always

replicaCount: 1

# Recovery admin for initial setup (disabled)
recoveryAdmin:
  enabled: false

# Persistent storage with encrypted volumes
persistence:
  enabled: true
  storageClassName: hcloud-volumes-encrypted
  accessMode: ReadWriteOnce
  size: 20Gi

# Service configuration
service:
  type: LoadBalancer
  smtp:
    enabled: true
    ports:
      - port: 25
        name: smtp
      - port: 587
        name: submission
      - port: 465
        name: submissions
  imap:
    enabled: true
    ports:
      - port: 143
        name: imap
      - port: 993
        name: imaps
  http:
    enabled: true
    port: 8080

# Ingress for web UI
ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  hosts:
    - host: mail.basicstack.de
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: stalwart-tls
      hosts:
        - mail.basicstack.de

# RocksDB configuration (default)
config:
  "@type": "RocksDb"
  path: "/opt/stalwart"

# Pod security context
podSecurityContext:
  fsGroup: 2000
  runAsUser: 2000
  runAsGroup: 2000

# Container security context
containerSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  seccompProfile:
    type: RuntimeDefault

# Health probes
livenessProbe:
  httpGet:
    path: /healthz/live
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 3

readinessProbe:
  httpGet:
    path: /healthz/ready
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 5
  timeoutSeconds: 3
  failureThreshold: 3

# Resources
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "2Gi"
    cpu: "2000m"