8cd2829cd8
Following the DEV-473 rocksdb-to-postgres migration, point Stalwart's bootstrap config at the PostgreSQL store and expose PGPASSWORD to the container so the `authSecret: EnvironmentVariable` lookup resolves. - stalwart-bootstrap-config.yaml: config.json switches @type RocksDb -> PostgreSql (host=stalwart-postgres, db=stalwart, authUsername=stalwart, authSecret=EnvironmentVariable/PGPASSWORD, useTls=false). - stalwart-fresh-deployment.yaml: adds PGPASSWORD env from secret/stalwart-postgres-credentials.POSTGRES_PASSWORD on the stalwart container. - stalwart-config.yaml: mirrors the switch in stalwart.toml as documentation (the running pod uses `--config /etc/stalwart/config.json`, not the toml). Board (DEV-476) explicitly asked for the manifest-level switch after the web UI save failed with a `Permission denied` on the read-only bootstrap emptyDir. Co-Authored-By: Paperclip <noreply@paperclip.ing>
88 lines
2.2 KiB
YAML
88 lines
2.2 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: stalwart-config
|
|
namespace: stalwart
|
|
data:
|
|
stalwart.toml: |
|
|
#
|
|
# Stalwart Mail Server Configuration
|
|
#
|
|
|
|
# DEV-476: primary store is PostgreSQL (see stalwart-bootstrap-config.yaml).
|
|
# Note: the container starts with `--config /etc/stalwart/config.json`, so
|
|
# this stalwart.toml is not read at runtime for a live pod — the bootstrap
|
|
# JSON is authoritative. Kept in sync here as documentation and for any
|
|
# one-shot tooling that references the toml.
|
|
[store]
|
|
data = "postgres"
|
|
|
|
[store.postgres]
|
|
type = "postgresql"
|
|
host = "stalwart-postgres"
|
|
port = 5432
|
|
database = "stalwart"
|
|
user = "stalwart"
|
|
password = "%{env:PGPASSWORD}%"
|
|
tls.enable = false
|
|
|
|
#
|
|
# Server Configuration
|
|
#
|
|
|
|
[server]
|
|
hostname = "mail.basicstack.de"
|
|
|
|
# HTTP Listener (Web UI and API)
|
|
[server.listener.http]
|
|
bind = ["0.0.0.0:8080"]
|
|
protocol = "http"
|
|
|
|
# Security: Allow internal cluster IPs for Traefik ingress
|
|
# Pod network CIDR: 10.244.0.0/16
|
|
[server.listener.http.security]
|
|
allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
|
|
|
|
# SMTP Listener (Port 25)
|
|
[server.listener.smtp]
|
|
bind = ["0.0.0.0:25"]
|
|
protocol = "smtp"
|
|
|
|
# Security: Allow internal cluster IPs for Traefik ingress
|
|
[server.listener.smtp.security]
|
|
allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
|
|
|
|
# Submission Listener (Port 587 with STARTTLS)
|
|
[server.listener.submission]
|
|
bind = ["0.0.0.0:587"]
|
|
protocol = "smtp"
|
|
|
|
# Security: Allow internal cluster IPs for Traefik ingress
|
|
[server.listener.submission.security]
|
|
allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
|
|
|
|
# IMAPS Listener (Port 993 with TLS)
|
|
[server.listener.imaps]
|
|
bind = ["0.0.0.0:993"]
|
|
protocol = "imap"
|
|
tls.implicit = true
|
|
|
|
# Security: Allow internal cluster IPs for Traefik ingress
|
|
[server.listener.imaps.security]
|
|
allowed-ips = ["10.244.0.0/16", "127.0.0.1/32"]
|
|
|
|
#
|
|
# TLS Configuration
|
|
#
|
|
|
|
[server.tls]
|
|
certificate = "file:///etc/stalwart/certs/tls.crt"
|
|
private-key = "file:///etc/stalwart/certs/tls.key"
|
|
|
|
#
|
|
# Logging
|
|
#
|
|
|
|
[tracing.level]
|
|
default = "info"
|