stack.basicstack.de/apps/stalwart

Stalwart Mail Server v0.16.11

Clean deployment of Stalwart mail server with username/password authentication only.

Architecture

• Version: v0.16.11
• Authentication: Username/password only (NO OAuth/OIDC)
• Configuration: API-based (stored in RocksDB)
• Storage: Encrypted hcloud-volumes (20Gi)
• Backup: Daily restic backup to S3 at 3 AM
• Web UI: https://mail.basicstack.de

Files

• stalwart-fresh-deployment.yaml - Main deployment manifest
• stalwart-admin-credentials-sealed.yaml - Sealed secret for admin password
• stalwart-s3-backup-sealed.yaml - Sealed secret for S3 backup credentials

Deployment

# Apply sealed secrets first
kubectl apply -f stalwart-admin-credentials-sealed.yaml
kubectl apply -f stalwart-s3-backup-sealed.yaml

# Create bootstrap config
kubectl create configmap stalwart-bootstrap-config \
  --from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
  -n stalwart

# Deploy Stalwart
kubectl apply -f stalwart-fresh-deployment.yaml

Initial Admin Login

After deployment, log in at https://mail.basicstack.de with:

• Username: admin
• Password: (from stalwart-admin-credentials secret)

Configuration

All configuration is done via the web UI or API. The bootstrap config only points to the RocksDB database location. NO config.toml files are used.

Check https://stalw.art/docs/ref/ for configuration possibilities. The API access via /jmap seems to be too complex for the agent and the configruation has been done manually.

Refer to manual configuration steps

Ports

• SMTP: 25, 587, 465
• IMAP: 143, 993
• HTTP: 8080 (web UI)

Storage

Data is stored in /var/lib/stalwart using the RocksDB database format. This includes:

• Email messages
• User accounts
• Server configuration
• TLS certificates configuration