4 Commits

Author	SHA1	Message	Date
unkinben	5d6d6a9441	fix(stalwart): pin stalwart-external LoadBalancer to 198.18.199.2	2026-05-24 19:54:29 +10:00
unkinben	572b6bfd9f	fix(stalwart): add purelb dmz service-group annotation to LoadBalancer	2026-05-24 19:52:03 +10:00
unkinben	b465763302	feat(stalwart): use Valkey for in-memory store, improve health probes ... - Replace PostgreSQL in-memory store with Valkey (Redis-compatible) for better performance on rate limiting, distributed locks, and OAuth codes - Add single-replica Valkey deployment with no persistence (data is transient) - Switch liveness/readiness probes to HTTP GET /healthz/live and /healthz/ready on port 8080 per official Kubernetes probe documentation - Update webadmin resource URL to use artifactapi proxy instead of direct GitHub download	2026-05-24 12:56:32 +10:00
unkinben	0d89a69c18	feat(stalwart): deploy Stalwart mail server with CNPG and S3 ... - stalwart namespace with Deployment + HPA (2-6 replicas) - CNPG PostgreSQL cluster (3 instances, 20Gi cephrbd-fast-delete) with PgBouncer pooler - S3/Ceph-RGW for blob storage (stalwart-maildata bucket, lz4 compressed) - Secrets from Vault: postgres-credentials, s3-credentials, stalwart-admin - TLS cert via cert-manager (vault-issuer) for mail.main.unkin.net - SMTP relay on port 25 (internal ClusterIP, trusted pod CIDRs) - Submission on port 587, IMAP 143/993, HTTPS 443 via LoadBalancer - HTTP port 8080 for Traefik reverse proxy (web admin at mail.k8s.syd1.au.unkin.net) - Outbound mail routed through postfix.mailgateway.svc.cluster.local:25 - Spam filtering offloaded to postfix/rspamd (disabled internally)	2026-05-24 12:44:46 +10:00