From 7fd1ce840451dda768424b5e40ce535c995c78d4 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 12 Oct 2026 00:51:06 +1100
Subject: [PATCH] Restart Stalwart after applying the plan; move mail DNS
 record out

---
 .../unkin-net/a/kustomization.yaml            |  1 -
 .../authoritative/unkin-net/a/mail.yaml       | 14 -------
 apps/base/mail/kustomization.yaml             |  1 +
 apps/base/mail/stalwart-apply-job.yaml        | 29 ++++++---------
 apps/base/mail/stalwart-apply-rbac.yaml       | 37 +++++++++++++++++++
 5 files changed, 49 insertions(+), 33 deletions(-)
 delete mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml
 create mode 100644 apps/base/mail/stalwart-apply-rbac.yaml

diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
index 0b2c906..5f7821d 100644
--- a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
@@ -16,6 +16,5 @@ resources:
   - identity.yaml
   - lb1.yaml
   - logviewer.yaml
-  - mail.yaml
   - vlogs.yaml
   - watchstate.yaml
diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml
deleted file mode 100644
index 142f877..0000000
--- a/apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: mail-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: mail
-  type: A
-  ttl: 600
-  values:
-    # stalwart-lb PureLB VIP (IMAPS, submission, HTTPS).
-    - 198.18.200.11
diff --git a/apps/base/mail/kustomization.yaml b/apps/base/mail/kustomization.yaml
index 58f51fe..e131c9e 100644
--- a/apps/base/mail/kustomization.yaml
+++ b/apps/base/mail/kustomization.yaml
@@ -9,6 +9,7 @@ resources:
   - httproute.yaml
   - namespace.yaml
   - stalwart-apply-job.yaml
+  - stalwart-apply-rbac.yaml
   - stalwart-blobs-bucket.yaml
   - stalwart-configmap.yaml
   - stalwart-deployment.yaml
diff --git a/apps/base/mail/stalwart-apply-job.yaml b/apps/base/mail/stalwart-apply-job.yaml
index 097d47e..e3929ac 100644
--- a/apps/base/mail/stalwart-apply-job.yaml
+++ b/apps/base/mail/stalwart-apply-job.yaml
@@ -1,6 +1,7 @@
 ---
 # Converges Stalwart's database-held settings to plan.ndjson after every sync,
-# then reloads them. Store and listener changes only bind on a pod restart.
+# then restarts the pod: listener and store changes only bind on startup.
+# ponytail: restarts on every sync since neither image has a shell to diff apply output.
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -18,6 +19,7 @@ spec:
         app.kubernetes.io/name: stalwart-apply
     spec:
       restartPolicy: Never
+      serviceAccountName: stalwart-apply
       securityContext:
         runAsNonRoot: true
         seccompProfile:
@@ -60,25 +62,16 @@ spec:
               mountPath: /plan
               readOnly: true
       containers:
-        - name: reload
-          image: docker.io/stalwartlabs/cli:1.0.13
+        - name: restart
+          image: registry.k8s.io/kubectl:v1.33.13
           args:
-            - create
-            - action/ReloadSettings
-          env:
-            - name: STALWART_URL
-              value: http://stalwart.mail.svc:8080
-            - name: STALWART_USER
-              valueFrom:
-                secretKeyRef:
-                  name: stalwart-admin
-                  key: username
-            - name: STALWART_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: stalwart-admin
-                  key: password
+            - rollout
+            - restart
+            - deployment/stalwart
+            - --namespace=mail
           securityContext:
+            runAsUser: 65532
+            runAsGroup: 65532
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             capabilities:
diff --git a/apps/base/mail/stalwart-apply-rbac.yaml b/apps/base/mail/stalwart-apply-rbac.yaml
new file mode 100644
index 0000000..65c642c
--- /dev/null
+++ b/apps/base/mail/stalwart-apply-rbac.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: stalwart-apply
+  namespace: mail
+---
+# Lets the stalwart-apply Job roll the Stalwart pod after applying the plan.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: stalwart-apply
+  namespace: mail
+rules:
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    resourceNames:
+      - stalwart
+    verbs:
+      - get
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: stalwart-apply
+  namespace: mail
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: stalwart-apply
+subjects:
+  - kind: ServiceAccount
+    name: stalwart-apply
+    namespace: mail