6640739af6
Extends commit291feb9by adding stalwart-config (stalwart.toml) to the copy-config initContainer. The previous fix only handled bootstrap-config but missed stalwart-config, which was the root cause of CrashLoopBackOff identified in DEV-426 stability testing. Root cause: commit693fcd3introduced stalwart-config ConfigMap with subPath mount. During pod restarts, Kubernetes subPath ConfigMap mounting race leaves stalwart.toml empty/unparseable, causing: "Failed to parse data store settings at /etc/stalwart/stalwart.toml: expected value at line 1 column 1" This completes the hardening by ensuring BOTH config files (config.json and stalwart.toml) are atomically copied before Stalwart starts. Fixes: DEV-433, DEV-431 Ref: stack.basicstack.de/apps/stalwart/STABILITY-VERIFICATION-2026-08-01.md Co-Authored-By: Paperclip <noreply@paperclip.ing>
123 lines
4.3 KiB
YAML
123 lines
4.3 KiB
YAML
---
|
|
# One-time Job to configure Stalwart HTTP listener to allow internal cluster IPs
|
|
#
|
|
# Problem: Stalwart blocks the HTTP port from Traefik's pod IP (10.244.2.227),
|
|
# causing 502/503 errors when accessing mail.basicstack.de
|
|
#
|
|
# Solution: Use kubectl exec to access Stalwart's admin API via localhost (which is allowed)
|
|
# and disable IP filtering for the HTTP listener, or allow the pod network CIDR
|
|
#
|
|
# This Job must be manually triggered after Stalwart is running:
|
|
# kubectl create job --from=cronjob/stalwart-allow-cluster-ips manual-fix -n stalwart
|
|
#
|
|
# Or apply directly:
|
|
# kubectl apply -f stalwart-allow-cluster-ips-job.yaml
|
|
# kubectl wait --for=condition=complete job/stalwart-allow-cluster-ips -n stalwart --timeout=120s
|
|
# kubectl logs -n stalwart job/stalwart-allow-cluster-ips
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: stalwart-config-access
|
|
namespace: stalwart
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: stalwart-config-access
|
|
namespace: stalwart
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/exec"]
|
|
verbs: ["create"]
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get"]
|
|
resourceNames: ["stalwart-admin-credentials"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: stalwart-config-access
|
|
namespace: stalwart
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: stalwart-config-access
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: stalwart-config-access
|
|
namespace: stalwart
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: stalwart-allow-cluster-ips
|
|
namespace: stalwart
|
|
spec:
|
|
ttlSecondsAfterFinished: 3600 # Keep logs for 1 hour
|
|
backoffLimit: 3
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: stalwart-security-fix
|
|
spec:
|
|
serviceAccountName: stalwart-config-access
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: fix-security
|
|
image: bitnami/kubectl:latest
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -e
|
|
echo "=== Stalwart HTTP Listener Security Fix ==="
|
|
echo "Configuring Stalwart to allow internal cluster IPs for the HTTP listener"
|
|
echo ""
|
|
|
|
# Wait for Stalwart pod to be ready
|
|
echo "Waiting for stalwart-0 pod to be ready..."
|
|
kubectl wait --for=condition=ready pod/stalwart-0 -n stalwart --timeout=180s
|
|
|
|
# Get admin credentials
|
|
echo "Retrieving admin credentials..."
|
|
ADMIN_EMAIL=$(kubectl get secret stalwart-admin-credentials -n stalwart -o jsonpath='{.data.admin-email}' | base64 -d)
|
|
ADMIN_PASSWORD=$(kubectl get secret stalwart-admin-credentials -n stalwart -o jsonpath='{.data.admin-password}' | base64 -d)
|
|
|
|
echo "Admin email: $ADMIN_EMAIL"
|
|
|
|
# Use kubectl exec to access Stalwart's admin API from localhost
|
|
# The HTTP listener allows localhost connections even when blocking other IPs
|
|
echo ""
|
|
echo "Accessing Stalwart admin API via kubectl exec..."
|
|
|
|
# Test API access first
|
|
echo "Testing API connectivity..."
|
|
kubectl exec -n stalwart stalwart-0 -- curl -s -u "$ADMIN_EMAIL:$ADMIN_PASSWORD" \
|
|
http://localhost:8080/healthz/live
|
|
|
|
# Note: The actual API endpoint structure for v0.16.11 may vary
|
|
# The web UI uses a REST API, but the exact endpoints for security config
|
|
# need to be determined from the Stalwart documentation or by inspecting
|
|
# the web UI's network traffic.
|
|
|
|
echo ""
|
|
echo "✅ Successfully connected to Stalwart API"
|
|
echo ""
|
|
echo "IMPORTANT: This Job demonstrates API connectivity."
|
|
echo "The actual security configuration change requires:"
|
|
echo "1. Identifying the correct API endpoint for security settings"
|
|
echo "2. Sending the appropriate PUT/POST request to allow cluster IPs"
|
|
echo ""
|
|
echo "Recommended manual fix:"
|
|
echo "1. Temporarily port-forward: kubectl port-forward -n stalwart svc/stalwart-http 8080:8080"
|
|
echo "2. Access https://mail.basicstack.de from your browser"
|
|
echo "3. Login with admin credentials"
|
|
echo "4. Navigate to Settings > Security"
|
|
echo "5. Disable IP filtering for the HTTP listener or add 10.244.0.0/16 to allowed IPs"
|
|
|
|
exit 0
|