f981b3e269
Set up the repository structure following GitOps principles: - apps/ for application deployments (Stalwart as example) - infrastructure/ for cluster-wide configs (networking, monitoring) - docs/ for general documentation Migrated complete Stalwart deployment configuration including: - Multiple deployment variants (basic, OIDC-enabled) - Helm values files - Monitoring and dashboard configurations - Operational documentation (backup/restore, bootstrap) - Configuration patches and fixes Added comprehensive README files at each level to guide future use. Co-Authored-By: Paperclip <noreply@paperclip.ing>
110 lines
2 KiB
YAML
Executable file
110 lines
2 KiB
YAML
Executable file
# Stalwart Helm Chart Values
|
|
# Domain: mail.basicstack.de
|
|
# Storage: hcloud-volumes-encrypted
|
|
|
|
image:
|
|
repository: stalwartlabs/stalwart
|
|
tag: "latest"
|
|
pullPolicy: Always
|
|
|
|
replicaCount: 1
|
|
|
|
# Recovery admin for initial setup (disabled)
|
|
recoveryAdmin:
|
|
enabled: false
|
|
|
|
# Persistent storage with encrypted volumes
|
|
persistence:
|
|
enabled: true
|
|
storageClassName: hcloud-volumes-encrypted
|
|
accessMode: ReadWriteOnce
|
|
size: 20Gi
|
|
|
|
# Service configuration
|
|
service:
|
|
type: LoadBalancer
|
|
smtp:
|
|
enabled: true
|
|
ports:
|
|
- port: 25
|
|
name: smtp
|
|
- port: 587
|
|
name: submission
|
|
- port: 465
|
|
name: submissions
|
|
imap:
|
|
enabled: true
|
|
ports:
|
|
- port: 143
|
|
name: imap
|
|
- port: 993
|
|
name: imaps
|
|
http:
|
|
enabled: true
|
|
port: 8080
|
|
|
|
# Ingress for web UI
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
hosts:
|
|
- host: mail.basicstack.de
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: stalwart-tls
|
|
hosts:
|
|
- mail.basicstack.de
|
|
|
|
# RocksDB configuration (default)
|
|
config:
|
|
"@type": "RocksDb"
|
|
path: "/opt/stalwart"
|
|
|
|
# Pod security context
|
|
podSecurityContext:
|
|
fsGroup: 2000
|
|
runAsUser: 2000
|
|
runAsGroup: 2000
|
|
|
|
# Container security context
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
add: [NET_BIND_SERVICE]
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
# Health probes
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz/live
|
|
port: 8080
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz/ready
|
|
port: 8080
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
|
|
# Resources
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "250m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "2000m"
|