# Stalwart Helm Fix - Proper Environment Configuration
image:
  repository: stalwartlabs/stalwart
  tag: "v0.16.9"
  pullPolicy: Always

# IMPORTANT: Remove args to let Stalwart use environment variables
# The Helm chart should not pass --config if we want env-based config
extraArgs: []

# Enable recovery admin
recoveryAdmin:
  enabled: true
  username: admin
  password: FreshSetup2026!

# Persistence
persistence:
  enabled: true
  storageClass: hcloud-volumes-encrypted
  accessMode: ReadWriteOnce
  size: 20Gi

# Service configuration
service:
  type: LoadBalancer
  ports:
    smtp: 25
    submission: 587
    smtps: 465
    imap: 143
    imaps: 993
    pop3: 110
    pop3s: 995
    sieve: 4190
    mgmt: 8080

# Ingress
ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  hosts:
    - host: mail.basicstack.de
      paths:
        - path: /
          pathType: Prefix
          portName: mgmt
  tls:
    - secretName: stalwart-tls
      hosts:
        - mail.basicstack.de

# Minimal config - just database location
config:
  "@type": "RocksDb"
  path: "/var/lib/stalwart"

# Security contexts
podSecurityContext:
  fsGroup: 2000
  runAsUser: 2000
  runAsGroup: 2000

containerSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  seccompProfile:
    type: RuntimeDefault

# Resources
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "2Gi"
    cpu: "2"

# Environment variables for proper configuration
env:
  - name: RUST_LOG
    value: "debug"
  - name: STALWART_LOG_LEVEL
    value: "debug"

# OIDC Configuration
envFrom:
  - secretRef:
      name: stalwart-stalwart-env

# Additional OIDC env vars
extraEnv:
  - name: STALWART_OAUTH_ENABLE
    value: "true"
  - name: STALWART_OAUTH_ISSUER
    value: "https://auth.basicstack.de"
  - name: STALWART_OAUTH_REDIRECT_URI
    value: "https://mail.basicstack.de/admin/oauth/callback"
  - name: STALWART_OAUTH_SCOPES
    value: "openid profile email"
  - name: STALWART_OAUTH_CLIENT_ID
    valueFrom:
      secretKeyRef:
        name: stalwart-oidc
        key: oidc-client-id
  - name: STALWART_OAUTH_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: stalwart-oidc
        key: oidc-client-secret