---
# Stalwart Mail Server Configuration
# This ConfigMap provides a complete configuration with security settings
# that allow internal cluster IPs to access the HTTP listener.
#
# The HTTP listener is only accessible via ClusterIP service and Traefik ingress,
# so allowing the internal pod network (10.244.0.0/16) is safe and necessary.
apiVersion: v1
kind: ConfigMap
metadata:
  name: stalwart-config
  namespace: stalwart
data:
  stalwart.toml: |
    #
    # Stalwart Mail Server Configuration
    #

    [store]
    data = "rocksdb"

    [store.rocksdb]
    type = "rocksdb"
    path = "/var/lib/stalwart"

    #
    # Server Configuration
    #

    [server]
    hostname = "mail.basicstack.de"

    # HTTP Listener (Web UI and API)
    [server.listener.http]
    bind = ["0.0.0.0:8080"]
    protocol = "http"

    # Security: Allow internal cluster IPs for Traefik ingress
    # Pod network CIDR: 10.244.0.0/16
    [server.listener.http.security]
    allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]

    # SMTP Listener (Port 25)
    [server.listener.smtp]
    bind = ["0.0.0.0:25"]
    protocol = "smtp"

    # Submission Listener (Port 587 with STARTTLS)
    [server.listener.submission]
    bind = ["0.0.0.0:587"]
    protocol = "smtp"

    # IMAPS Listener (Port 993 with TLS)
    [server.listener.imaps]
    bind = ["0.0.0.0:993"]
    protocol = "imap"
    tls.implicit = true

    #
    # TLS Configuration
    #

    [server.tls]
    certificate = "file:///etc/stalwart/certs/tls.crt"
    private-key = "file:///etc/stalwart/certs/tls.key"

    #
    # Logging
    #

    [tracing.level]
    default = "info"