From 3019291e5cb83e208ff32d086728c2444b8a3bf9 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 12 Oct 2026 22:15:11 +1100
Subject: [PATCH] Name the smarthost mail-in.main.unkin.net and serve the
 *.main.unkin.net wildcard

---
 .../cert-manager/certificate_wildcard-main-unkin-net.yaml   | 6 +++---
 apps/base/mail/smarthost-statefulset.yaml                   | 2 +-
 apps/base/mail/smarthost/main.cf                            | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
index bc34a2b..8bed1a2 100644
--- a/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml
@@ -1,6 +1,6 @@
 ---
 # Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack,
-# jellyfin, stalwart webadmin/autoconfig). DNS-01 needs the delegated
+# jellyfin, stalwart webadmin/autoconfig) and the mail smarthost. DNS-01 needs the delegated
 # _acme-challenge.main.unkin.net CNAME in the public unkin.net zone.
 # _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net.
 apiVersion: cert-manager.io/v1
@@ -13,9 +13,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy,mail"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy,mail"
   privateKey:
     size: 4096
   dnsNames:
diff --git a/apps/base/mail/smarthost-statefulset.yaml b/apps/base/mail/smarthost-statefulset.yaml
index 9a401c5..2bd4527 100644
--- a/apps/base/mail/smarthost-statefulset.yaml
+++ b/apps/base/mail/smarthost-statefulset.yaml
@@ -105,7 +105,7 @@ spec:
             name: smarthost-config
         - name: tls
           secret:
-            secretName: wildcard-unkin-net-tls
+            secretName: wildcard-main-unkin-net-tls
   volumeClaimTemplates:
     - metadata:
         name: spool
diff --git a/apps/base/mail/smarthost/main.cf b/apps/base/mail/smarthost/main.cf
index 7c4ca46..5f85dd2 100644
--- a/apps/base/mail/smarthost/main.cf
+++ b/apps/base/mail/smarthost/main.cf
@@ -1,5 +1,5 @@
 compatibility_level = 3.5
-myhostname = smarthost.unkin.net
+myhostname = mail-in.main.unkin.net
 myorigin = unkin.net
 mydestination =
 alias_maps =