fix(postfix): use hash: transport_maps with postmap init container

- Splits hash-type map files into a separate postfix-maps ConfigMap
- Adds postmap init container that builds .db files from all maps into
  a postfix-db emptyDir, which is then subPath-mounted per map in the
  main container
- Updates transport_maps in main.cf to hash:/etc/postfix/transport

apps/base/artifactapi/gateway.yaml

@@ -31,6 +31,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: artifactapi-tls
         mode: Terminate

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,6 +6,7 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
+      - "^kanidm/"
       - "^openvoxproject/"
       - "^stakater/reloader"
       - "^voxpupuli/puppetboard"

apps/base/cattle-system/gateway.yaml

@@ -31,6 +31,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: rancher-tls
         mode: Terminate

apps/base/consul/gateway.yaml

@@ -35,7 +35,8 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: consul-tls
     - name: consul-svc
       port: 443
@@ -47,5 +48,6 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: consul-tls

apps/base/kanidm/certificate.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kanidm-tls
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  secretName: kanidm-tls
-  issuerRef:
-    kind: ClusterIssuer
-    name: vault-issuer
-  commonName: auth.unkin.net
-  dnsNames:
-    - auth.unkin.net
-    - au.auth.unkin.net
-    - kanidm.k8s.syd1.au.unkin.net
-    - kanidm.kanidm.svc.cluster.local
-    - kanidm-0.kanidm-headless.kanidm.svc.cluster.local
-    - kanidm-1.kanidm-headless.kanidm.svc.cluster.local
-    - kanidm-2.kanidm-headless.kanidm.svc.cluster.local
-  privateKey:
-    algorithm: RSA
-    size: 4096

apps/base/kanidm/configmap.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-config
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-data:
-  server.toml: |
-    version = "2"
-
-    domain = "auth.unkin.net"
-    origin = "https://auth.unkin.net"
-    bindaddress = "[::]:8443"
-    db_path = "/data/kanidm.db"
-    db_arc_size = 2048
-    tls_chain = "/data/tls/tls.crt"
-    tls_key = "/data/tls/tls.key"
-    log_level = "info"
-
-    [online_backup]
-    path = "/data/backups/"
-    schedule = "0 22 * * *"
-    versions = 7
-
-    [replication]
-    origin = "__REPL_ORIGIN__"
-    bindaddress = "[::]:8444"
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-repl-certs
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-data: {}

apps/base/kanidm/gateway.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-    traefik.io/instance: internal
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https-passthrough
-      port: 443
-      protocol: TLS
-      tls:
-        mode: Passthrough
-      allowedRoutes:
-        namespaces:
-          from: Same

apps/base/kanidm/httproute.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: kanidm-http-redirect
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  hostnames:
-    - kanidm.k8s.syd1.au.unkin.net
-    - auth.unkin.net
-    - au.auth.unkin.net
-  parentRefs:
-    - name: kanidm
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/kanidm/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - rbac.yaml
-  - certificate.yaml
-  - configmap.yaml
-  - service.yaml
-  - statefulset.yaml
-  - poddisruptionbudget.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - tlsroute.yaml

apps/base/kanidm/poddisruptionbudget.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kanidm
-      app.kubernetes.io/instance: kanidm

apps/base/kanidm/rbac.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kanidm-repl
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["kanidm-repl-certs"]
-    verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kanidm-repl
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-subjects:
-  - kind: ServiceAccount
-    name: kanidm
-    namespace: kanidm
-roleRef:
-  kind: Role
-  name: kanidm-repl
-  apiGroup: rbac.authorization.k8s.io

apps/base/kanidm/service.yaml

@@ -1,43 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  type: ClusterIP
-  ports:
-    - name: https
-      port: 8443
-      targetPort: https
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm-headless
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - name: https
-      port: 8443
-      targetPort: https
-      protocol: TCP
-    - name: replication
-      port: 8444
-      targetPort: replication
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm

apps/base/kanidm/serviceaccount.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm

apps/base/kanidm/statefulset.yaml

@@ -1,161 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  serviceName: kanidm-headless
-  replicas: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kanidm
-      app.kubernetes.io/instance: kanidm
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: kanidm
-        app.kubernetes.io/instance: kanidm
-    spec:
-      serviceAccountName: kanidm
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: kanidm
-                  app.kubernetes.io/instance: kanidm
-              topologyKey: kubernetes.io/hostname
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        fsGroup: 1000
-      initContainers:
-        - name: config-init
-          image: ghcr.io/kanidm/server:1.10.3
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              REPL_ORIGIN="repl://${POD_NAME}.kanidm-headless.kanidm.svc.cluster.local:8444"
-              sed "s|__REPL_ORIGIN__|${REPL_ORIGIN}|g" /config-template/server.toml > /config/server.toml
-              for peer in kanidm-0 kanidm-1 kanidm-2; do
-                if [ "${peer}" = "${POD_NAME}" ]; then
-                  continue
-                fi
-                cert_file="/repl-certs/${peer}"
-                if [ -s "${cert_file}" ]; then
-                  fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
-                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
-                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
-                fi
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-            - name: config
-              mountPath: /config
-            - name: repl-certs
-              mountPath: /repl-certs
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-        - name: repl-cert-publisher
-          image: bitnami/kubectl:1.33
-          restartPolicy: Always
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              until kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null | grep -q '^# certificate:'; do
-                sleep 30
-              done
-              while true; do
-                cert=$(kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null \
-                  | grep '^# certificate:' | sed 's/^# certificate: "\(.*\)"$/\1/')
-                if [ -n "${cert}" ]; then
-                  kubectl patch configmap kanidm-repl-certs \
-                    --type=merge \
-                    -p "{\"data\":{\"${POD_NAME}\":\"${cert}\"}}"
-                fi
-                sleep 3600
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-      containers:
-        - name: kanidm
-          image: ghcr.io/kanidm/server:1.10.3
-          command: ["/sbin/kanidmd"]
-          args: ["server", "-c", "/config/server.toml"]
-          ports:
-            - name: https
-              containerPort: 8443
-              protocol: TCP
-            - name: replication
-              containerPort: 8444
-              protocol: TCP
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: config
-              mountPath: /config
-              readOnly: true
-            - name: tls
-              mountPath: /data/tls
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          resources:
-            requests:
-              memory: 256Mi
-              cpu: 100m
-            limits:
-              memory: 1Gi
-              cpu: 500m
-          readinessProbe:
-            tcpSocket:
-              port: 8443
-            initialDelaySeconds: 15
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              port: 8443
-            initialDelaySeconds: 30
-            periodSeconds: 30
-      volumes:
-        - name: config-template
-          configMap:
-            name: kanidm-config
-        - name: config
-          emptyDir: {}
-        - name: repl-certs
-          configMap:
-            name: kanidm-repl-certs
-        - name: tls
-          secret:
-            secretName: kanidm-tls
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: [ReadWriteOnce]
-        storageClassName: cephrbd-fast-delete
-        resources:
-          requests:
-            storage: 10Gi

apps/base/kanidm/tlsroute.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TLSRoute
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  hostnames:
-    - kanidm.k8s.syd1.au.unkin.net
-    - auth.unkin.net
-    - au.auth.unkin.net
-  parentRefs:
-    - name: kanidm
-      sectionName: https-passthrough
-  rules:
-    - backendRefs:
-        - name: kanidm
-          port: 8443

apps/base/litellm/gateway.yaml

@@ -31,6 +31,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: litellm-tls
         mode: Terminate

apps/base/mailgateway/certificate.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postfix-smtp-tls
+  namespace: mailgateway
+spec:
+  secretName: postfix-smtp-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.main.unkin.net
+  dnsNames:
+    - mail.main.unkin.net
+    - smtp-in.main.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA

apps/base/mailgateway/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: rspamd
+  namespace: mailgateway
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rspamd-tls
+        mode: Terminate

apps/base/mailgateway/httproute.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  parentRefs:
+    - name: rspamd
+      namespace: mailgateway
+  hostnames:
+    - rspamd.k8s.syd1.au.unkin.net
+  rules:
+    - backendRefs:
+        - name: rspamd
+          port: 11334

apps/base/mailgateway/kustomization.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - certificate.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - postfix-deployment.yaml
+  - postfix-hpa.yaml
+  - rspamd-deployment.yaml
+  - rspamd-hpa.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: postfix-config
+    files:
+      - main.cf=resources/postfix/main.cf
+      - master.cf=resources/postfix/master.cf
+    options:
+      disableNameSuffixHash: true
+  - name: postfix-maps
+    files:
+      - transport=resources/postfix/transport
+    options:
+      disableNameSuffixHash: true
+  - name: rspamd-config
+    files:
+      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
+      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
+      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
+    options:
+      disableNameSuffixHash: true

apps/base/mailgateway/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: kanidm
+  name: mailgateway

apps/base/mailgateway/postfix-deployment.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postfix
+  namespace: mailgateway
+spec:
+  selector:
+    matchLabels:
+      app: postfix
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: postfix
+    spec:
+      initContainers:
+        - name: postmap
+          image: tozd/postfix:alpine-322
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              for f in /etc/postfix/maps/*; do
+                base=$(basename "$f")
+                cp "$f" /tmp/"$base"
+                postmap hash:/tmp/"$base"
+                cp /tmp/"${base}.db" /etc/postfix/db/
+              done
+          volumeMounts:
+            - name: postfix-maps
+              mountPath: /etc/postfix/maps
+              readOnly: true
+            - name: postfix-db
+              mountPath: /etc/postfix/db
+      containers:
+        - name: postfix
+          image: tozd/postfix:alpine-322
+          ports:
+            - containerPort: 25
+              name: smtp
+              protocol: TCP
+            - containerPort: 587
+              name: submission
+              protocol: TCP
+          env:
+            # Keep these in sync with main.cf so the tozd startup postconf calls are no-ops
+            - name: MAILNAME
+              value: "mail.main.unkin.net"
+            - name: MY_NETWORKS
+              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
+            - name: MY_DESTINATION
+              value: "localhost.localdomain, localhost"
+            - name: LOG_TO_STDOUT
+              value: "1"
+          livenessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: postfix-config
+              mountPath: /etc/postfix/main.cf
+              subPath: main.cf
+            - name: postfix-config
+              mountPath: /etc/postfix/master.cf
+              subPath: master.cf
+            - name: postfix-db
+              mountPath: /etc/postfix/transport.db
+              subPath: transport.db
+            - name: postfix-tls
+              mountPath: /etc/postfix/tls
+              readOnly: true
+            - name: spool
+              mountPath: /var/spool/postfix
+      volumes:
+        - name: postfix-config
+          configMap:
+            name: postfix-config
+        - name: postfix-maps
+          configMap:
+            name: postfix-maps
+        - name: postfix-db
+          emptyDir: {}
+        - name: postfix-tls
+          secret:
+            secretName: postfix-smtp-tls
+        - name: spool
+          emptyDir: {}

apps/base/mailgateway/postfix-hpa.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: postfix-hpa
+  namespace: mailgateway
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: postfix
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60

apps/base/mailgateway/resources/postfix/main.cf

@@ -0,0 +1,46 @@
+# Basic identity — kept in sync with MAILNAME/MY_NETWORKS/MY_DESTINATION env vars
+# so the tozd startup script's postconf calls are no-ops
+myhostname = mail.main.unkin.net
+myorigin = main.unkin.net
+mydestination = localhost.localdomain, localhost
+mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+inet_protocols = ipv4
+inet_interfaces = all
+
+# No local delivery — we're a relay-only gateway
+local_transport = error:no local delivery
+alias_maps =
+alias_database =
+
+# Relay inbound mail for these domains to Stalwart
+relay_domains = main.unkin.net unkin.net
+transport_maps = hash:/etc/postfix/transport
+
+# rspamd milter (same namespace — short DNS name resolves)
+smtpd_milters = inet:rspamd:11332
+non_smtpd_milters = inet:rspamd:11332
+milter_default_action = accept
+milter_protocol = 6
+milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
+
+# Inbound TLS (cert from cert-manager Certificate resource)
+smtpd_use_tls = yes
+smtpd_tls_security_level = may
+smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
+smtpd_tls_key_file = /etc/postfix/tls/tls.key
+smtpd_tls_loglevel = 1
+
+# Outbound TLS (opportunistic)
+smtp_tls_security_level = may
+smtp_tls_loglevel = 1
+
+# Message size limit (50 MiB)
+message_size_limit = 52428800
+mailbox_size_limit = 0
+
+# Queue retention
+maximal_queue_lifetime = 5d
+bounce_queue_lifetime = 1d
+
+# Log to stdout for k8s log collection
+maillog_file = /dev/stdout

apps/base/mailgateway/resources/postfix/master.cf

@@ -0,0 +1,42 @@
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+
+# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
+smtp      inet  n       -       n       -       -       smtpd
+
+# Submission (port 587) — TLS required, relay from trusted mynetworks only
+submission inet n       -       n       -       -       smtpd
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=no
+  -o smtpd_reject_unlisted_recipient=no
+  -o smtpd_relay_restrictions=permit_mynetworks,reject
+  -o milter_macro_daemon_name=ORIGINATING
+
+# Internal postfix processes
+pickup    unix  n       -       n       60      1       pickup
+cleanup   unix  n       -       n       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+tlsmgr    unix  -       -       n       1000?   1       tlsmgr
+rewrite   unix  -       -       n       -       -       trivial-rewrite
+bounce    unix  -       -       n       -       0       bounce
+defer     unix  -       -       n       -       0       bounce
+trace     unix  -       -       n       -       0       bounce
+verify    unix  -       -       n       -       1       verify
+flush     unix  n       -       n       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       n       -       -       smtp
+relay     unix  -       -       n       -       -       smtp
+showq     unix  n       -       n       -       -       showq
+error     unix  -       -       n       -       -       error
+retry     unix  -       -       n       -       -       error
+discard   unix  -       -       n       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       n       -       -       lmtp
+anvil     unix  -       -       n       -       1       anvil
+scache    unix  -       -       n       -       1       scache
+postlog   unix-dgram n  -       n       -       1       postlogd

apps/base/mailgateway/resources/postfix/transport

@@ -0,0 +1,2 @@
+.unkin.net        smtp:[stalwart.stalwart.svc.cluster.local]:25
+unkin.net         smtp:[stalwart.stalwart.svc.cluster.local]:25

apps/base/mailgateway/resources/rspamd/local.d/dkim_signing.conf

@@ -0,0 +1,13 @@
+enabled = true;
+selector = "mail";
+
+domain {
+    main.unkin.net {
+        privkey = "/etc/rspamd/dkim/private_key";
+        selector = "mail";
+    }
+    unkin.net {
+        privkey = "/etc/rspamd/dkim/private_key";
+        selector = "mail";
+    }
+}

apps/base/mailgateway/resources/rspamd/local.d/milter_headers.conf

@@ -0,0 +1,2 @@
+extended_spam_headers = true;
+use = ["x-spam-status", "x-spam-score", "authentication-results"];

apps/base/mailgateway/resources/rspamd/local.d/worker-proxy.inc

@@ -0,0 +1,7 @@
+milter = yes;
+bind_socket = "*:11332";
+
+upstream "local" {
+    default = yes;
+    self_scan = yes;
+}

apps/base/mailgateway/rspamd-deployment.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  selector:
+    matchLabels:
+      app: rspamd
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: rspamd
+    spec:
+      securityContext:
+        runAsUser: 11333
+        runAsGroup: 11333
+        fsGroup: 11333
+      containers:
+        - name: rspamd
+          image: rspamd/rspamd:4.0.1
+          ports:
+            - containerPort: 11332
+              name: milter
+              protocol: TCP
+            - containerPort: 11333
+              name: worker
+              protocol: TCP
+            - containerPort: 11334
+              name: controller
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 11334
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 11334
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: rspamd-config
+              mountPath: /etc/rspamd/local.d
+              readOnly: true
+            - name: dkim-keys
+              mountPath: /etc/rspamd/dkim
+              readOnly: true
+            - name: rspamd-data
+              mountPath: /var/lib/rspamd
+      volumes:
+        - name: rspamd-config
+          configMap:
+            name: rspamd-config
+        - name: dkim-keys
+          secret:
+            secretName: dkim-keys
+        - name: rspamd-data
+          emptyDir: {}

apps/base/mailgateway/rspamd-hpa.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: rspamd-hpa
+  namespace: mailgateway
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: rspamd
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 30
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60

apps/base/mailgateway/services.yaml

@@ -0,0 +1,64 @@
+---
+# Internal service for rspamd - used by postfix pods in the same namespace
+apiVersion: v1
+kind: Service
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  selector:
+    app: rspamd
+  ports:
+    - name: milter
+      port: 11332
+      targetPort: 11332
+      protocol: TCP
+    - name: worker
+      port: 11333
+      targetPort: 11333
+      protocol: TCP
+    - name: controller
+      port: 11334
+      targetPort: 11334
+      protocol: TCP
+---
+# Internal ClusterIP for postfix - used by stalwart for outbound relay
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix
+  namespace: mailgateway
+spec:
+  selector:
+    app: postfix
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP
+    - name: submission
+      port: 587
+      targetPort: 587
+      protocol: TCP
+---
+# External LoadBalancer for inbound MX (internet → postfix)
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix-external
+  namespace: mailgateway
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: smtp-in.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.199.1
+    purelb.io/service-group: dmz
+    purelb.io/addresses: 198.18.199.1
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: postfix
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP

apps/base/mailgateway/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: mailgateway
+spec:
+  allowedNamespaces:
+    - mailgateway
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/mailgateway/vaultstaticsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: dkim-keys
+  namespace: mailgateway
+spec:
+  destination:
+    create: true
+    name: dkim-keys
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/mailgateway/default/dkim-keys
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/paperclip/gateway.yaml

@@ -31,6 +31,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: paperclip-tls
         mode: Terminate

apps/base/puppet/gateway_puppetboard.yaml

@@ -35,6 +35,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: puppetboard-tls
         mode: Terminate

apps/base/puppet/gateway_puppetdb.yaml

@@ -28,6 +28,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: puppetdb-tls
         mode: Terminate

apps/base/vault/gateway.yaml

@@ -35,7 +35,8 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: vault-tls
     - name: vault-direct
       port: 8200
@@ -46,5 +47,6 @@ spec:
       tls:
         mode: Terminate
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: vault-tls

apps/overlays/au-syd1/mailgateway/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/kanidm
+  - ../../../base/mailgateway

argocd/applicationsets/platform.yaml

@@ -20,8 +20,8 @@ spec:
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
-      - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/node-feature-discovery
+      - path: apps/overlays/*/mailgateway
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
@@ -44,12 +44,6 @@ spec:
       destination:
         server: https://kubernetes.default.svc
         namespace: '{{path[3]}}'  # Use directory name as namespace
-      ignoreDifferences:
-      - group: ""
-        kind: ConfigMap
-        name: kanidm-repl-certs
-        jsonPointers:
-        - /data
       syncPolicy:
         automated:
           prune: true

argocd/projects/platform.yaml

@@ -27,8 +27,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
-    - namespace: 'kanidm'
-      server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
     - namespace: 'purelb'