From 2b992f771cdc72c1d1f69c5770de44ad9a977dca Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 00:58:35 +1100 Subject: [PATCH] Verify the CNPG CA for Stalwart's Postgres, pin webui, bound the apply Job --- apps/base/mail/stalwart-apply-job.yaml | 3 ++- apps/base/mail/stalwart-configmap.yaml | 4 ++-- apps/base/mail/stalwart-deployment.yaml | 15 ++++++++++++--- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/apps/base/mail/stalwart-apply-job.yaml b/apps/base/mail/stalwart-apply-job.yaml index e3929ac..9483cc9 100644 --- a/apps/base/mail/stalwart-apply-job.yaml +++ b/apps/base/mail/stalwart-apply-job.yaml @@ -11,7 +11,8 @@ metadata: argocd.argoproj.io/hook: PostSync argocd.argoproj.io/hook-delete-policy: BeforeHookCreation spec: - backoffLimit: 3 + activeDeadlineSeconds: 300 + backoffLimit: 2 ttlSecondsAfterFinished: 600 template: metadata: diff --git a/apps/base/mail/stalwart-configmap.yaml b/apps/base/mail/stalwart-configmap.yaml index 9f12fdc..4211da1 100644 --- a/apps/base/mail/stalwart-configmap.yaml +++ b/apps/base/mail/stalwart-configmap.yaml @@ -8,12 +8,12 @@ metadata: namespace: mail data: config.json: | - {"@type":"PostgreSql","host":"stalwart-db-rw.mail.svc","port":5432,"database":"stalwart","authUsername":"stalwart","authSecret":{"@type":"EnvironmentVariable","variableName":"DB_PASSWORD"},"useTls":true,"allowInvalidCerts":true} + {"@type":"PostgreSql","host":"stalwart-db-rw.mail.svc","port":5432,"database":"stalwart","authUsername":"stalwart","authSecret":{"@type":"EnvironmentVariable","variableName":"DB_PASSWORD"},"useTls":true} plan.ndjson: | {"@type":"upsert","object":"Domain","matchOn":["name"],"value":{"unkin":{"name":"unkin.net","certificateManagement":{"@type":"Manual"},"dkimManagement":{"@type":"Manual"},"dnsManagement":{"@type":"Manual"},"subAddressing":{"@type":"Enabled"}}}} {"@type":"upsert","object":"Certificate","matchOn":["certificate"],"value":{"cert":{"certificate":{"@type":"File","filePath":"/etc/stalwart/tls/tls.crt"},"privateKey":{"@type":"File","filePath":"/etc/stalwart/tls/tls.key"}}}} {"@type":"upsert","object":"Directory","matchOn":["description"],"value":{"authentik":{"@type":"Oidc","description":"Authentik","issuerUrl":"https://identity.unkin.net/application/o/stalwart/","requireAudience":"stalwart","requireScopes":{},"claimUsername":"preferred_username","usernameDomain":"unkin.net","claimName":"name"}}} - {"@type":"upsert","object":"Application","matchOn":["description"],"value":{"webui":{"description":"Stalwart Web Interface","resourceUrl":"https://github.com/stalwartlabs/webui/releases/latest/download/webui.zip","urlPrefix":{"/admin":true,"/account":true},"unpackDirectory":"/var/lib/stalwart/webui","oauthClientId":"stalwart"}}} + {"@type":"upsert","object":"Application","matchOn":["description"],"value":{"webui":{"description":"Stalwart Web Interface","resourceUrl":"https://github.com/stalwartlabs/webui/releases/download/v1.0.11/webui.zip","urlPrefix":{"/admin":true,"/account":true},"unpackDirectory":"/var/lib/stalwart/webui","oauthClientId":"stalwart"}}} {"@type":"upsert","object":"NetworkListener","matchOn":["name"],"value":{"lmtp":{"name":"lmtp","bind":{"[::]:24":true},"protocol":"lmtp","useTls":false},"submission":{"name":"submission","bind":{"[::]:587":true},"protocol":"smtp","useTls":true,"tlsImplicit":false},"metrics":{"name":"metrics","bind":{"[::]:9090":true},"protocol":"http","useTls":false}}} {"@type":"upsert","object":"MtaRoute","matchOn":["name"],"value":{"smarthost":{"@type":"Relay","name":"smarthost","address":"smarthost.mail.svc","port":25,"protocol":"smtp","implicitTls":false,"allowInvalidCerts":true,"authSecret":{"@type":"None"}}}} {"@type":"reconcile","object":"Tracer","matchOn":"*","value":{"stdout":{"@type":"Stdout","enable":true,"level":"info","ansi":false,"multiline":false,"buffered":false,"lossy":false,"eventsPolicy":"exclude","events":{}}}} diff --git a/apps/base/mail/stalwart-deployment.yaml b/apps/base/mail/stalwart-deployment.yaml index ce1b664..2675d8d 100644 --- a/apps/base/mail/stalwart-deployment.yaml +++ b/apps/base/mail/stalwart-deployment.yaml @@ -5,7 +5,7 @@ metadata: name: stalwart namespace: mail annotations: - secret.reloader.stakater.com/reload: "stalwart-admin,stalwart-db-app,stalwart-blobs-s3,wildcard-unkin-net-tls,vault-ca-cert" + secret.reloader.stakater.com/reload: "stalwart-admin,stalwart-db-app,stalwart-blobs-s3,wildcard-unkin-net-tls,vault-ca-cert,stalwart-db-ca" spec: # ponytail: single replica, no cluster coordinator; add one before scaling out. replicas: 1 @@ -26,14 +26,14 @@ spec: fsGroup: 2000 seccompProfile: type: RuntimeDefault - # rustls loads SSL_CERT_FILE, so public roots + the internal CA (RGW) go in one bundle. + # rustls loads SSL_CERT_FILE, so public roots, the internal CA (RGW) and the CNPG CA go in one bundle. initContainers: - name: combine-certs image: docker.io/stalwartlabs/stalwart:v0.16.25 command: - sh - -c - - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt + - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt /db-ca/ca.crt > /combined-certs/ca-certificates.crt securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -51,6 +51,9 @@ spec: - name: vault-ca-cert mountPath: /custom-ca readOnly: true + - name: db-ca + mountPath: /db-ca + readOnly: true - name: combined-certs mountPath: /combined-certs containers: @@ -167,6 +170,12 @@ spec: items: - key: ca.crt path: ca.crt + - name: db-ca + secret: + secretName: stalwart-db-ca + items: + - key: ca.crt + path: ca.crt - name: combined-certs emptyDir: {} # Webui unpack dir only; mail data is in Postgres and S3.