From 426a399f31de768f7883bd2f5f8a7987ff0a9cdc Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 21:25:49 +1000 Subject: [PATCH] Drop stalwart mail proxying from the haproxy edge (#491) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stalwart was only ever a test deployment. The daemon is dead on all three backend VMs and nothing public depends on it — `unkin.net` MX points at Google — so the edge is proxying mail to nowhere and the tcp frontends make `defaults` emit 20 spurious HTTP-mode warnings. - Drop the `fe_smtp`, `fe_submission`, `fe_imap` and `fe_imaps` frontends. - Drop the five `be_stalwart_*` backends and their map entries in `fe_http.map`/`fe_https.map`. - Drop the now-unused 25/143/587/993 Service and container ports. `haproxy -c` on the rendered config: exit 0, 0 warnings (was 20), 0 alerts. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/491 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/haproxy/configmap.yaml | 122 ------------------------------ apps/base/haproxy/deployment.yaml | 14 +--- apps/base/haproxy/service.yaml | 18 +---- 3 files changed, 2 insertions(+), 152 deletions(-) diff --git a/apps/base/haproxy/configmap.yaml b/apps/base/haproxy/configmap.yaml index e1ad1eb..9f3e1c4 100644 --- a/apps/base/haproxy/configmap.yaml +++ b/apps/base/haproxy/configmap.yaml @@ -23,9 +23,6 @@ data: git.unkin.net be_gitea grafana.unkin.net be_grafana dashboard.ceph.unkin.net be_ceph_dashboard - mail-webadmin.main.unkin.net be_stalwart_webadmin - autoconfig.main.unkin.net be_stalwart_webadmin - autodiscovery.main.unkin.net be_stalwart_webadmin auth.unkin.net be_k8s_kanidm fe_https.map: | @@ -40,9 +37,6 @@ data: git.unkin.net be_gitea grafana.unkin.net be_grafana dashboard.ceph.unkin.net be_ceph_dashboard - mail-webadmin.main.unkin.net be_stalwart_webadmin - autoconfig.main.unkin.net be_stalwart_webadmin - autodiscovery.main.unkin.net be_stalwart_webadmin auth.unkin.net be_k8s_kanidm haproxy.cfg: | @@ -101,26 +95,6 @@ data: use_backend be_letsencrypt if acl-letsencrypt use_backend %[req.hdr(host),lower,map(/usr/local/etc/haproxy/fe_https.map,be_default)] - frontend fe_imap - bind 0.0.0.0:143 - mode tcp - description Frontend for Stalwart IMAP (STARTTLS) - default_backend be_stalwart_imap - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - - frontend fe_imaps - bind 0.0.0.0:993 - mode tcp - description Frontend for Stalwart IMAPS (implicit TLS) - default_backend be_stalwart_imaps - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - frontend fe_metrics bind 0.0.0.0:8405 mode http @@ -129,26 +103,6 @@ data: http-request set-header X-Real-IP %[src] http-request use-service prometheus-exporter if { path /metrics } - frontend fe_smtp - bind 0.0.0.0:25 - mode tcp - description Frontend for Stalwart SMTP - default_backend be_stalwart_smtp - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - - frontend fe_submission - bind 0.0.0.0:587 - mode tcp - description Frontend for Stalwart SMTP Submission - default_backend be_stalwart_submission - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - backend be_ceph_dashboard description Backend for Ceph Dashboard from Mgr instances balance roundrobin @@ -332,82 +286,6 @@ data: redirect scheme https if !{ ssl_fc } server ausyd1nxvm2046 198.18.26.161:443 check cookie ausyd1nxvm2046 fall 2 inter 2s rise 3 ssl verify none - backend be_stalwart_imap - description Backend for Stalwart IMAP (STARTTLS) - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect port 143 send-proxy - tcp-check expect string "* OK" - tcp-check send "A001 STARTTLS\r\n" - tcp-check expect rstring "A001 (OK|2.0.0)" - server ausyd1nxvm2124 198.18.28.76:143 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2125 198.18.29.44:143 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2126 198.18.25.160:143 check fall 3 inter 3s rise 2 send-proxy-v2 - - backend be_stalwart_imaps - description Backend for Stalwart IMAPS (implicit TLS) - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect ssl send-proxy - tcp-check expect string "* OK" - server ausyd1nxvm2124 198.18.28.76:993 check fall 3 inter 3s rise 2 send-proxy-v2 ssl verify none - server ausyd1nxvm2125 198.18.29.44:993 check fall 3 inter 3s rise 2 send-proxy-v2 ssl verify none - server ausyd1nxvm2126 198.18.25.160:993 check fall 3 inter 3s rise 2 send-proxy-v2 ssl verify none - - backend be_stalwart_smtp - description Backend for Stalwart SMTP - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect port 25 send-proxy - tcp-check expect string "220 " - server ausyd1nxvm2124 198.18.28.76:25 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2125 198.18.29.44:25 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2126 198.18.25.160:25 check fall 3 inter 3s rise 2 send-proxy-v2 - - backend be_stalwart_submission - description Backend for Stalwart SMTP Submission - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect port 587 send-proxy - tcp-check expect string "220 " - server ausyd1nxvm2124 198.18.28.76:587 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2125 198.18.29.44:587 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2126 198.18.25.160:587 check fall 3 inter 3s rise 2 send-proxy-v2 - - backend be_stalwart_webadmin - description Backend for Stalwart Webadmin - balance roundrobin - cookie SRVNAME insert indirect nocache - http-check expect status 200 - http-request set-header X-Forwarded-Port %[dst_port] - http-request add-header X-Forwarded-Proto https if { dst_port 9443 } - http-reuse always - option httpchk GET / - option forwardfor - option http-keep-alive - option prefer-last-server - redirect scheme https if !{ ssl_fc } - stick-table type ip size 200k expire 30m - server ausyd1nxvm2124 198.18.28.76:443 check cookie ausyd1nxvm2124 fall 2 inter 2s rise 3 send-proxy-v2 ssl verify none - server ausyd1nxvm2125 198.18.29.44:443 check cookie ausyd1nxvm2125 fall 2 inter 2s rise 3 send-proxy-v2 ssl verify none - server ausyd1nxvm2126 198.18.25.160:443 check cookie ausyd1nxvm2126 fall 2 inter 2s rise 3 send-proxy-v2 ssl verify none - # The `peers au-syd1-prod` section is dropped: peer names must be static and a # Deployment cannot provide them. Service sessionAffinity: ClientIP pins a # client to one replica so the per-replica stick-tables behave as before. diff --git a/apps/base/haproxy/deployment.yaml b/apps/base/haproxy/deployment.yaml index 4a1f11e..a44724a 100644 --- a/apps/base/haproxy/deployment.yaml +++ b/apps/base/haproxy/deployment.yaml @@ -50,7 +50,7 @@ spec: readOnlyRootFilesystem: true capabilities: drop: [ALL] - # Frontends bind 25/80/143/443/587; the dst_port ACLs need the real ports. + # Frontends bind 80 and 443; the dst_port ACLs need the real ports. add: [NET_BIND_SERVICE] ports: - name: http @@ -59,18 +59,6 @@ spec: - name: https containerPort: 443 protocol: TCP - - name: smtp - containerPort: 25 - protocol: TCP - - name: imap - containerPort: 143 - protocol: TCP - - name: submission - containerPort: 587 - protocol: TCP - - name: imaps - containerPort: 993 - protocol: TCP - name: health containerPort: 8404 protocol: TCP diff --git a/apps/base/haproxy/service.yaml b/apps/base/haproxy/service.yaml index 388401c..a1f7d54 100644 --- a/apps/base/haproxy/service.yaml +++ b/apps/base/haproxy/service.yaml @@ -10,7 +10,7 @@ metadata: spec: type: LoadBalancer loadBalancerIP: "198.18.199.1" - # Source IP must survive for acl_internalsubnets, X-Real-IP and SMTP. + # Source IP must survive for X-Real-IP. externalTrafficPolicy: Local # Pins a client to one replica, standing in for the dropped stick-table peers. sessionAffinity: ClientIP @@ -25,19 +25,3 @@ spec: port: 443 protocol: TCP targetPort: https - - name: smtp - port: 25 - protocol: TCP - targetPort: smtp - - name: imap - port: 143 - protocol: TCP - targetPort: imap - - name: submission - port: 587 - protocol: TCP - targetPort: submission - - name: imaps - port: 993 - protocol: TCP - targetPort: imaps