basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/stalwart
History
CTO Agent c060c83347 Fix Stalwart HTTP listener access for Traefik ingress 
Stalwart was blocking the HTTP port (8080) from Traefik's internal IP
(10.244.2.227), causing 502 errors when accessing mail.basicstack.de.

Changes:
- Added complete Stalwart TOML configuration (stalwart-config.yaml)
- Configured HTTP listener security to allow internal pod network (10.244.0.0/16)
- Updated StatefulSet to use the new configuration file
- This allows Traefik ingress to reach the Stalwart web UI backend

The fix is non-destructive:
- PVC data is preserved
- Rolling update will restart the pod with new config
- Only security setting is changed (adding allowed IPs)

Fixes: DEV-422

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-01 08:48:32 +00:00
..
CERTIFICATE-RENEWAL.md Implement automatic TLS certificate renewal for Stalwart 2026-07-04 16:48:48 +00:00
ISSUE-2026-07-13-smtp-imap-external-access.md docs(stalwart): Clarify LoadBalancer was working all along via hostPort 2026-07-13 20:12:11 +00:00
manual_config_steps.md apps/stalwart/manual_config_steps.md aktualisiert 2026-07-04 16:39:11 +00:00
README.md apps/stalwart/README.md aktualisiert 2026-07-04 17:19:55 +00:00
SETUP_COMPLETE.md Move Application manifests to apps root for proper self-management 2026-07-12 09:27:28 +00:00
STABILITY-CHECK.md Update Stalwart stability check window 2026-07-13 21:08:11 +00:00
STABLE-ROUTING-SOLUTION.md Document stable routing solution for Stalwart Mail 2026-07-22 18:07:38 +00:00
stalwart-admin-credentials-sealed.yaml Fix Stalwart ArgoCD degraded status by ignoring unsealed secrets 2026-07-25 15:15:42 +00:00
stalwart-bootstrap-config.yaml Restore Stalwart bootstrap ConfigMap (non-destructive recovery) 2026-07-26 13:09:20 +00:00
stalwart-config.yaml Fix Stalwart HTTP listener access for Traefik ingress 2026-08-01 08:48:32 +00:00
stalwart-fresh-deployment.yaml Fix Stalwart HTTP listener access for Traefik ingress 2026-08-01 08:48:32 +00:00
stalwart-monitoring.yaml Stalwart reliability hardening: fix k3s service networking issues 2026-07-11 11:06:36 +00:00
stalwart-s3-backup-sealed.yaml Fix Stalwart ArgoCD degraded status by ignoring unsealed secrets 2026-07-25 15:15:42 +00:00

README.md

Stalwart Mail Server v0.16.11

Clean deployment of Stalwart mail server with username/password authentication only.

Architecture

  • Version: v0.16.11
  • Authentication: Username/password only (NO OAuth/OIDC)
  • Configuration: API-based (stored in RocksDB)
  • Storage: Encrypted hcloud-volumes (20Gi)
  • Backup: Daily restic backup to S3 at 3 AM
  • Web UI: https://mail.basicstack.de

Files

  • stalwart-fresh-deployment.yaml - Main deployment manifest
  • stalwart-admin-credentials-sealed.yaml - Sealed secret for admin password
  • stalwart-s3-backup-sealed.yaml - Sealed secret for S3 backup credentials

Deployment

# Apply sealed secrets first
kubectl apply -f stalwart-admin-credentials-sealed.yaml
kubectl apply -f stalwart-s3-backup-sealed.yaml

# Create bootstrap config
kubectl create configmap stalwart-bootstrap-config \
  --from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
  -n stalwart

# Deploy Stalwart
kubectl apply -f stalwart-fresh-deployment.yaml

Initial Admin Login

After deployment, log in at https://mail.basicstack.de with:

  • Username: admin
  • Password: (from stalwart-admin-credentials secret)

Configuration

All configuration is done via the web UI or API. The bootstrap config only points to the RocksDB database location. NO config.toml files are used.

Check https://stalw.art/docs/ref/ for configuration possibilities. The API access via /jmap seems to be too complex for the agent and the configruation has been done manually.

Refer to manual configuration steps

Ports

  • SMTP: 25, 587, 465
  • IMAP: 143, 993
  • HTTP: 8080 (web UI)

Storage

Data is stored in /var/lib/stalwart using the RocksDB database format. This includes:

  • Email messages
  • User accounts
  • Server configuration
  • TLS certificates configuration

Certificate Renewal

Refer to Automatic Renewal TLS Certificate