basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/stalwart
History
CTO Agent 7b57524263 Fix Stalwart startup to use stalwart.toml config 
Stalwart was starting with --config config.json (RocksDB-only pointer)
instead of the full stalwart.toml configuration. This caused the HTTP
listener on port 8080 to not start, failing readiness probes.

Override container command to use stalwart.toml, which contains:
- HTTP listener on 0.0.0.0:8080 for web UI and healthz endpoints
- All email protocol listeners (SMTP 25, submission 587, IMAPS 993)
- TLS configuration

Fixes DEV-428 (503 no-available-server)
Related to DEV-422 (Stalwart not accessible)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-01 09:32:00 +00:00
..
CERTIFICATE-RENEWAL.md Implement automatic TLS certificate renewal for Stalwart 2026-07-04 16:48:48 +00:00
ISSUE-2026-07-13-smtp-imap-external-access.md docs(stalwart): Clarify LoadBalancer was working all along via hostPort 2026-07-13 20:12:11 +00:00
manual_config_steps.md apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:39:11 +00:00
README.md apps/stalwart/README.md aktualisiert 2026-07-04 17:19:55 +00:00
SETUP_COMPLETE.md Move Application manifests to apps root for proper self-management 2026-07-12 09:27:28 +00:00
STABILITY-CHECK.md Update Stalwart stability check window 2026-07-13 21:08:11 +00:00
STABLE-ROUTING-SOLUTION.md Document stable routing solution for Stalwart Mail 2026-07-22 18:07:38 +00:00
stalwart-admin-credentials-sealed.yaml Fix Stalwart ArgoCD degraded status by ignoring unsealed secrets 2026-07-25 15:15:42 +00:00
stalwart-allow-cluster-ips-job.yaml Add Stalwart security fix Job (manual trigger required) 2026-08-01 08:55:45 +00:00
stalwart-bootstrap-config.yaml Restore Stalwart bootstrap ConfigMap (non-destructive recovery) 2026-07-26 13:09:20 +00:00
stalwart-config.yaml Remove HTTP listener IP restrictions from Stalwart config 2026-08-01 08:58:06 +00:00
stalwart-fresh-deployment.yaml Fix Stalwart startup to use stalwart.toml config 2026-08-01 09:32:00 +00:00
stalwart-monitoring.yaml Stalwart reliability hardening: fix k3s service networking issues 2026-07-11 11:06:36 +00:00
stalwart-s3-backup-sealed.yaml Fix Stalwart ArgoCD degraded status by ignoring unsealed secrets 2026-07-25 15:15:42 +00:00

README.md

Stalwart Mail Server v0.16.11

Clean deployment of Stalwart mail server with username/password authentication only.

Architecture

  • Version: v0.16.11
  • Authentication: Username/password only (NO OAuth/OIDC)
  • Configuration: API-based (stored in RocksDB)
  • Storage: Encrypted hcloud-volumes (20Gi)
  • Backup: Daily restic backup to S3 at 3 AM
  • Web UI: https://mail.basicstack.de

Files

  • stalwart-fresh-deployment.yaml - Main deployment manifest
  • stalwart-admin-credentials-sealed.yaml - Sealed secret for admin password
  • stalwart-s3-backup-sealed.yaml - Sealed secret for S3 backup credentials

Deployment

# Apply sealed secrets first
kubectl apply -f stalwart-admin-credentials-sealed.yaml
kubectl apply -f stalwart-s3-backup-sealed.yaml

# Create bootstrap config
kubectl create configmap stalwart-bootstrap-config \
  --from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
  -n stalwart

# Deploy Stalwart
kubectl apply -f stalwart-fresh-deployment.yaml

Initial Admin Login

After deployment, log in at https://mail.basicstack.de with:

  • Username: admin
  • Password: (from stalwart-admin-credentials secret)

Configuration

All configuration is done via the web UI or API. The bootstrap config only points to the RocksDB database location. NO config.toml files are used.

Check https://stalw.art/docs/ref/ for configuration possibilities. The API access via /jmap seems to be too complex for the agent and the configruation has been done manually.

Refer to manual configuration steps

Ports

  • SMTP: 25, 587, 465
  • IMAP: 143, 993
  • HTTP: 8080 (web UI)

Storage

Data is stored in /var/lib/stalwart using the RocksDB database format. This includes:

  • Email messages
  • User accounts
  • Server configuration
  • TLS certificates configuration

Certificate Renewal

Refer to Automatic Renewal TLS Certificate