# Stalwart Helm Values with OIDC Configuration
image:
  repository: stalwartlabs/stalwart
  tag: latest
  pullPolicy: Always

replicaCount: 1

# Recovery admin for initial setup
recoveryAdmin:
  enabled: true
  username: admin
  password: FreshSetup2026!

# Persistent storage with encrypted volumes
persistence:
  enabled: true
  storageClass: hcloud-volumes-encrypted
  accessMode: ReadWriteOnce
  size: 20Gi

# Service configuration
service:
  type: LoadBalancer
  ports:
    smtp: 25
    submission: 587
    smtps: 465
    imap: 143
    imaps: 993
    pop3: 110
    pop3s: 995
    sieve: 4190
    mgmt: 8080

# Ingress for web UI
ingress:
  enabled: true
  className: traefik
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
  hosts:
    - host: mail.basicstack.de
      paths:
        - path: /
          pathType: Prefix
          portName: mgmt
  tls:
    - secretName: stalwart-tls
      hosts:
        - mail.basicstack.de

# RocksDB configuration
config:
  "@type": "RocksDb"
  path: "/var/lib/stalwart"

# Pod security context
podSecurityContext:
  fsGroup: 2000
  runAsUser: 2000
  runAsGroup: 2000

# Container security context
containerSecurityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
    add: [NET_BIND_SERVICE]
  seccompProfile:
    type: RuntimeDefault

# Resources
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "2Gi"
    cpu: "2000m"

# OIDC Configuration via environment variables
env:
  - name: STALWART_OAUTH_ENABLE
    value: "true"
  - name: STALWART_OAUTH_ISSUER
    value: "https://auth.basicstack.de"
  - name: STALWART_OAUTH_CLIENT_ID
    value: "stalwart-webui"
  - name: STALWART_OAUTH_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: stalwart-oidc
        key: oidc-client-secret
  - name: STALWART_OAUTH_REDIRECT_URI
    value: "https://mail.basicstack.de/admin/oauth/callback"
  - name: STALWART_OAUTH_SCOPES
    value: "openid profile email"