c64f9ab0d0
Set up the repository structure following GitOps principles: - apps/ for application deployments (Stalwart as example) - infrastructure/ for cluster-wide configs (networking, monitoring) - docs/ for general documentation Migrated complete Stalwart deployment configuration including: - Multiple deployment variants (basic, OIDC-enabled) - Helm values files - Monitoring and dashboard configurations - Operational documentation (backup/restore, bootstrap) - Configuration patches and fixes Added comprehensive README files at each level to guide future use. Co-Authored-By: Paperclip <noreply@paperclip.ing>
100 lines
2 KiB
YAML
Executable file
100 lines
2 KiB
YAML
Executable file
# Stalwart Helm Values with OIDC Configuration
|
|
image:
|
|
repository: stalwartlabs/stalwart
|
|
tag: latest
|
|
pullPolicy: Always
|
|
|
|
replicaCount: 1
|
|
|
|
# Recovery admin for initial setup
|
|
recoveryAdmin:
|
|
enabled: true
|
|
username: admin
|
|
password: ***REMOVED***
|
|
|
|
# Persistent storage with encrypted volumes
|
|
persistence:
|
|
enabled: true
|
|
storageClass: hcloud-volumes-encrypted
|
|
accessMode: ReadWriteOnce
|
|
size: 20Gi
|
|
|
|
# Service configuration
|
|
service:
|
|
type: LoadBalancer
|
|
ports:
|
|
smtp: 25
|
|
submission: 587
|
|
smtps: 465
|
|
imap: 143
|
|
imaps: 993
|
|
pop3: 110
|
|
pop3s: 995
|
|
sieve: 4190
|
|
mgmt: 8080
|
|
|
|
# Ingress for web UI
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
hosts:
|
|
- host: mail.basicstack.de
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
portName: mgmt
|
|
tls:
|
|
- secretName: stalwart-tls
|
|
hosts:
|
|
- mail.basicstack.de
|
|
|
|
# RocksDB configuration
|
|
config:
|
|
"@type": "RocksDb"
|
|
path: "/var/lib/stalwart"
|
|
|
|
# Pod security context
|
|
podSecurityContext:
|
|
fsGroup: 2000
|
|
runAsUser: 2000
|
|
runAsGroup: 2000
|
|
|
|
# Container security context
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
add: [NET_BIND_SERVICE]
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
# Resources
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "250m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "2000m"
|
|
|
|
# OIDC Configuration via environment variables
|
|
env:
|
|
- name: STALWART_OAUTH_ENABLE
|
|
value: "true"
|
|
- name: STALWART_OAUTH_ISSUER
|
|
value: "https://auth.basicstack.de"
|
|
- name: STALWART_OAUTH_CLIENT_ID
|
|
value: "stalwart-webui"
|
|
- name: STALWART_OAUTH_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: stalwart-oidc
|
|
key: oidc-client-secret
|
|
- name: STALWART_OAUTH_REDIRECT_URI
|
|
value: "https://mail.basicstack.de/admin/oauth/callback"
|
|
- name: STALWART_OAUTH_SCOPES
|
|
value: "openid profile email"
|