basicstack/stack.basicstack.de

History

CTO Agent ff1e31941a Add Stalwart security fix Job (manual trigger required) Created Job that demonstrates how to access Stalwart admin API via kubectl exec to modify security settings. This Job shows the pattern for automated fixes but requires knowing the exact API endpoints for Stalwart v0.16.11's security configuration. The Job must be manually triggered after determining the correct API structure. Related: DEV-422 Co-Authored-By: Paperclip <noreply@paperclip.ing>		2026-08-01 08:55:45 +00:00
..
CERTIFICATE-RENEWAL.md	Implement automatic TLS certificate renewal for Stalwart	2026-07-04 16:48:48 +00:00
ISSUE-2026-07-13-smtp-imap-external-access.md	docs(stalwart): Clarify LoadBalancer was working all along via hostPort	2026-07-13 20:12:11 +00:00
manual_config_steps.md	apps/stalwart/manual_config_steps.md aktualisiert	2026-07-04 16:39:11 +00:00
README.md	apps/stalwart/README.md aktualisiert	2026-07-04 17:19:55 +00:00
SETUP_COMPLETE.md	Move Application manifests to apps root for proper self-management	2026-07-12 09:27:28 +00:00
STABILITY-CHECK.md	Update Stalwart stability check window	2026-07-13 21:08:11 +00:00
STABLE-ROUTING-SOLUTION.md	Document stable routing solution for Stalwart Mail	2026-07-22 18:07:38 +00:00
stalwart-admin-credentials-sealed.yaml	Fix Stalwart ArgoCD degraded status by ignoring unsealed secrets	2026-07-25 15:15:42 +00:00
stalwart-allow-cluster-ips-job.yaml	Add Stalwart security fix Job (manual trigger required)	2026-08-01 08:55:45 +00:00
stalwart-bootstrap-config.yaml	Restore Stalwart bootstrap ConfigMap (non-destructive recovery)	2026-07-26 13:09:20 +00:00
stalwart-config.yaml	Fix Stalwart accessibility by adding stalwart.toml ConfigMap	2026-08-01 08:55:07 +00:00
stalwart-fresh-deployment.yaml	Fix Stalwart accessibility by adding stalwart.toml ConfigMap	2026-08-01 08:55:07 +00:00
stalwart-monitoring.yaml	Stalwart reliability hardening: fix k3s service networking issues	2026-07-11 11:06:36 +00:00
stalwart-s3-backup-sealed.yaml	Fix Stalwart ArgoCD degraded status by ignoring unsealed secrets	2026-07-25 15:15:42 +00:00

README.md

Stalwart Mail Server v0.16.11

Clean deployment of Stalwart mail server with username/password authentication only.

Architecture

Version: v0.16.11
Authentication: Username/password only (NO OAuth/OIDC)
Configuration: API-based (stored in RocksDB)
Storage: Encrypted hcloud-volumes (20Gi)
Backup: Daily restic backup to S3 at 3 AM
Web UI: https://mail.basicstack.de

Files

stalwart-fresh-deployment.yaml - Main deployment manifest
stalwart-admin-credentials-sealed.yaml - Sealed secret for admin password
stalwart-s3-backup-sealed.yaml - Sealed secret for S3 backup credentials

Deployment

# Apply sealed secrets first
kubectl apply -f stalwart-admin-credentials-sealed.yaml
kubectl apply -f stalwart-s3-backup-sealed.yaml

# Create bootstrap config
kubectl create configmap stalwart-bootstrap-config \
  --from-literal=config.json='{"@type":"RocksDb","path":"/var/lib/stalwart"}' \
  -n stalwart

# Deploy Stalwart
kubectl apply -f stalwart-fresh-deployment.yaml

After deployment, log in at https://mail.basicstack.de with:

Username: admin
Password: (from stalwart-admin-credentials secret)

Configuration

All configuration is done via the web UI or API. The bootstrap config only points to the RocksDB database location. NO config.toml files are used.

Check https://stalw.art/docs/ref/ for configuration possibilities. The API access via /jmap seems to be too complex for the agent and the configruation has been done manually.

Refer to manual configuration steps

Ports

SMTP: 25, 587, 465
IMAP: 143, 993
HTTP: 8080 (web UI)

Storage

Data is stored in /var/lib/stalwart using the RocksDB database format. This includes:

Email messages
User accounts
Server configuration
TLS certificates configuration

Certificate Renewal

Refer to Automatic Renewal TLS Certificate