fix(postfix): use hash: transport_maps with postmap init container

- Splits hash-type map files into a separate postfix-maps ConfigMap - Adds postmap init container that builds .db files from all maps into a postfix-db emptyDir, which is then subPath-mounted per map in the main container - Updates transport_maps in main.cf to hash:/etc/postfix/transport
fix(postfix): use .unkin.net subdomain pattern in transport map
2026-05-24 20:38:27 +10:00 · 2026-05-24 20:35:19 +10:00 · 2026-05-24 19:54:08 +10:00 · 2026-05-24 19:52:16 +10:00 · 2026-05-24 12:46:28 +10:00 · 2026-05-23 23:47:24 +10:00
64 changed files with 1481 additions and 180 deletions
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: artifactapi-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi-http-redirect
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: artifactapi-api
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,32 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/proxy-body-size: 10g
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-  name: artifactapi-ingress
-  namespace: artifactapi
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: artifactapi.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: artifactapi-api
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - artifactapi.k8s.syd1.au.unkin.net
-      secretName: artifactapi-tls
@@ -6,7 +6,8 @@ resources:
  - artifactapi-deployment.yaml
  - artifactapi-hpa.yaml
  - configmap.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - postgres-deployment.yaml
  - pvc.yaml
@@ -6,6 +6,7 @@ remotes:
    immutable_patterns:
      - "^cloudnative-pg/cloudnative-pg"
      - "^emberstack/helm-charts"
+      - "^kanidm/"
      - "^openvoxproject/"
      - "^stakater/reloader"
      - "^voxpupuli/puppetboard"
@@ -30,7 +31,8 @@ remotes:
      - "^bitnami/"
      - "^curlimages/curl"
      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/vault-secrets-operator"
+      - "^hashicorp/consul"
+      - "^hashicorp/vault"
      - "^jfrog/"
      - "^rancher/"
      - "^traefik/"
@@ -15,6 +15,13 @@ metadata:
 spec:
  gatewayClassName: traefik-internal
  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
@@ -24,6 +31,7 @@ spec:
      protocol: HTTPS
      tls:
        certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
            name: rancher-tls
        mode: Terminate
@@ -1,6 +1,28 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: rancher-http-redirect
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
  name: rancher
  namespace: cattle-system
@@ -0,0 +1,53 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    cert-manager.io/alt-names: consul.service.consul
+    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
+    - name: consul-svc
+      port: 443
+      protocol: HTTPS
+      hostname: consul.service.consul
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
@@ -0,0 +1,71 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-http-redirect
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: consul
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: consul
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: consul-ui
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-svc
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.service.consul
+  parentRefs:
+    - name: consul
+      sectionName: consul-svc
+  rules:
+    - backendRefs:
+        - name: consul-ui
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: consul
@@ -76,11 +76,11 @@ spec:
    updateInterval: 30
  resources:
    limits:
-      cpu: 500m
-      memory: 512Mi
+      cpu: 1
+      memory: 1024Mi
    requests:
      cpu: 250m
-      memory: 256Mi
+      memory: 512Mi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
@@ -56,10 +56,10 @@ spec:
          resources:
            limits:
              cpu: "2"
-              memory: 6Gi
+              memory: 8Gi
            requests:
              cpu: 250m
-              memory: 2Gi
+              memory: 6Gi
          volumeMounts:
            - mountPath: /app/config.yaml
              name: config
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: litellm
+  namespace: litellm
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: litellm-tls
+        mode: Terminate
@@ -10,14 +10,14 @@ spec:
    kind: Deployment
    name: litellm
  minReplicas: 2
-  maxReplicas: 10
+  maxReplicas: 4
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
-          averageUtilization: 60
+          averageUtilization: 80
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0
@@ -25,7 +25,7 @@ spec:
      policies:
        - type: Percent
          value: 100
-          periodSeconds: 30
+          periodSeconds: 60
        - type: Pods
          value: 4
          periodSeconds: 30
@@ -34,7 +34,7 @@ spec:
      selectPolicy: Min
      policies:
        - type: Percent
-          value: 10
+          value: 30
          periodSeconds: 60
        - type: Pods
          value: 2
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm-http-redirect
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: litellm
+          port: 4000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: litellm
-  namespace: litellm
-spec:
-  rules:
-    - host: litellm.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: litellm
-                port:
-                  number: 4000
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - litellm.k8s.syd1.au.unkin.net
-      secretName: litellm-tls
@@ -7,7 +7,8 @@ resources:
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postfix-smtp-tls
+  namespace: mailgateway
+spec:
+  secretName: postfix-smtp-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.main.unkin.net
+  dnsNames:
+    - mail.main.unkin.net
+    - smtp-in.main.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: rspamd
+  namespace: mailgateway
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rspamd-tls
+        mode: Terminate
@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  parentRefs:
+    - name: rspamd
+      namespace: mailgateway
+  hostnames:
+    - rspamd.k8s.syd1.au.unkin.net
+  rules:
+    - backendRefs:
+        - name: rspamd
+          port: 11334
@@ -0,0 +1,36 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - certificate.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - postfix-deployment.yaml
+  - postfix-hpa.yaml
+  - rspamd-deployment.yaml
+  - rspamd-hpa.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: postfix-config
+    files:
+      - main.cf=resources/postfix/main.cf
+      - master.cf=resources/postfix/master.cf
+    options:
+      disableNameSuffixHash: true
+  - name: postfix-maps
+    files:
+      - transport=resources/postfix/transport
+    options:
+      disableNameSuffixHash: true
+  - name: rspamd-config
+    files:
+      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
+      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
+      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
+    options:
+      disableNameSuffixHash: true
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mailgateway
@@ -0,0 +1,105 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postfix
+  namespace: mailgateway
+spec:
+  selector:
+    matchLabels:
+      app: postfix
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: postfix
+    spec:
+      initContainers:
+        - name: postmap
+          image: tozd/postfix:alpine-322
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              for f in /etc/postfix/maps/*; do
+                base=$(basename "$f")
+                cp "$f" /tmp/"$base"
+                postmap hash:/tmp/"$base"
+                cp /tmp/"${base}.db" /etc/postfix/db/
+              done
+          volumeMounts:
+            - name: postfix-maps
+              mountPath: /etc/postfix/maps
+              readOnly: true
+            - name: postfix-db
+              mountPath: /etc/postfix/db
+      containers:
+        - name: postfix
+          image: tozd/postfix:alpine-322
+          ports:
+            - containerPort: 25
+              name: smtp
+              protocol: TCP
+            - containerPort: 587
+              name: submission
+              protocol: TCP
+          env:
+            # Keep these in sync with main.cf so the tozd startup postconf calls are no-ops
+            - name: MAILNAME
+              value: "mail.main.unkin.net"
+            - name: MY_NETWORKS
+              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
+            - name: MY_DESTINATION
+              value: "localhost.localdomain, localhost"
+            - name: LOG_TO_STDOUT
+              value: "1"
+          livenessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: postfix-config
+              mountPath: /etc/postfix/main.cf
+              subPath: main.cf
+            - name: postfix-config
+              mountPath: /etc/postfix/master.cf
+              subPath: master.cf
+            - name: postfix-db
+              mountPath: /etc/postfix/transport.db
+              subPath: transport.db
+            - name: postfix-tls
+              mountPath: /etc/postfix/tls
+              readOnly: true
+            - name: spool
+              mountPath: /var/spool/postfix
+      volumes:
+        - name: postfix-config
+          configMap:
+            name: postfix-config
+        - name: postfix-maps
+          configMap:
+            name: postfix-maps
+        - name: postfix-db
+          emptyDir: {}
+        - name: postfix-tls
+          secret:
+            secretName: postfix-smtp-tls
+        - name: spool
+          emptyDir: {}
@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: postfix-hpa
+  namespace: mailgateway
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: postfix
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60
@@ -0,0 +1,46 @@
+# Basic identity — kept in sync with MAILNAME/MY_NETWORKS/MY_DESTINATION env vars
+# so the tozd startup script's postconf calls are no-ops
+myhostname = mail.main.unkin.net
+myorigin = main.unkin.net
+mydestination = localhost.localdomain, localhost
+mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+inet_protocols = ipv4
+inet_interfaces = all
+
+# No local delivery — we're a relay-only gateway
+local_transport = error:no local delivery
+alias_maps =
+alias_database =
+
+# Relay inbound mail for these domains to Stalwart
+relay_domains = main.unkin.net unkin.net
+transport_maps = hash:/etc/postfix/transport
+
+# rspamd milter (same namespace — short DNS name resolves)
+smtpd_milters = inet:rspamd:11332
+non_smtpd_milters = inet:rspamd:11332
+milter_default_action = accept
+milter_protocol = 6
+milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
+
+# Inbound TLS (cert from cert-manager Certificate resource)
+smtpd_use_tls = yes
+smtpd_tls_security_level = may
+smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
+smtpd_tls_key_file = /etc/postfix/tls/tls.key
+smtpd_tls_loglevel = 1
+
+# Outbound TLS (opportunistic)
+smtp_tls_security_level = may
+smtp_tls_loglevel = 1
+
+# Message size limit (50 MiB)
+message_size_limit = 52428800
+mailbox_size_limit = 0
+
+# Queue retention
+maximal_queue_lifetime = 5d
+bounce_queue_lifetime = 1d
+
+# Log to stdout for k8s log collection
+maillog_file = /dev/stdout
@@ -0,0 +1,42 @@
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+
+# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
+smtp      inet  n       -       n       -       -       smtpd
+
+# Submission (port 587) — TLS required, relay from trusted mynetworks only
+submission inet n       -       n       -       -       smtpd
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=no
+  -o smtpd_reject_unlisted_recipient=no
+  -o smtpd_relay_restrictions=permit_mynetworks,reject
+  -o milter_macro_daemon_name=ORIGINATING
+
+# Internal postfix processes
+pickup    unix  n       -       n       60      1       pickup
+cleanup   unix  n       -       n       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+tlsmgr    unix  -       -       n       1000?   1       tlsmgr
+rewrite   unix  -       -       n       -       -       trivial-rewrite
+bounce    unix  -       -       n       -       0       bounce
+defer     unix  -       -       n       -       0       bounce
+trace     unix  -       -       n       -       0       bounce
+verify    unix  -       -       n       -       1       verify
+flush     unix  n       -       n       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       n       -       -       smtp
+relay     unix  -       -       n       -       -       smtp
+showq     unix  n       -       n       -       -       showq
+error     unix  -       -       n       -       -       error
+retry     unix  -       -       n       -       -       error
+discard   unix  -       -       n       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       n       -       -       lmtp
+anvil     unix  -       -       n       -       1       anvil
+scache    unix  -       -       n       -       1       scache
+postlog   unix-dgram n  -       n       -       1       postlogd
@@ -0,0 +1,2 @@
+.unkin.net        smtp:[stalwart.stalwart.svc.cluster.local]:25
+unkin.net         smtp:[stalwart.stalwart.svc.cluster.local]:25
@@ -0,0 +1,13 @@
+enabled = true;
+selector = "mail";
+
+domain {
+    main.unkin.net {
+        privkey = "/etc/rspamd/dkim/private_key";
+        selector = "mail";
+    }
+    unkin.net {
+        privkey = "/etc/rspamd/dkim/private_key";
+        selector = "mail";
+    }
+}
@@ -0,0 +1,2 @@
+extended_spam_headers = true;
+use = ["x-spam-status", "x-spam-score", "authentication-results"];
@@ -0,0 +1,7 @@
+milter = yes;
+bind_socket = "*:11332";
+
+upstream "local" {
+    default = yes;
+    self_scan = yes;
+}
@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  selector:
+    matchLabels:
+      app: rspamd
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: rspamd
+    spec:
+      securityContext:
+        runAsUser: 11333
+        runAsGroup: 11333
+        fsGroup: 11333
+      containers:
+        - name: rspamd
+          image: rspamd/rspamd:4.0.1
+          ports:
+            - containerPort: 11332
+              name: milter
+              protocol: TCP
+            - containerPort: 11333
+              name: worker
+              protocol: TCP
+            - containerPort: 11334
+              name: controller
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 11334
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 11334
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: rspamd-config
+              mountPath: /etc/rspamd/local.d
+              readOnly: true
+            - name: dkim-keys
+              mountPath: /etc/rspamd/dkim
+              readOnly: true
+            - name: rspamd-data
+              mountPath: /var/lib/rspamd
+      volumes:
+        - name: rspamd-config
+          configMap:
+            name: rspamd-config
+        - name: dkim-keys
+          secret:
+            secretName: dkim-keys
+        - name: rspamd-data
+          emptyDir: {}
@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: rspamd-hpa
+  namespace: mailgateway
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: rspamd
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 30
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60
@@ -0,0 +1,64 @@
+---
+# Internal service for rspamd - used by postfix pods in the same namespace
+apiVersion: v1
+kind: Service
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  selector:
+    app: rspamd
+  ports:
+    - name: milter
+      port: 11332
+      targetPort: 11332
+      protocol: TCP
+    - name: worker
+      port: 11333
+      targetPort: 11333
+      protocol: TCP
+    - name: controller
+      port: 11334
+      targetPort: 11334
+      protocol: TCP
+---
+# Internal ClusterIP for postfix - used by stalwart for outbound relay
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix
+  namespace: mailgateway
+spec:
+  selector:
+    app: postfix
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP
+    - name: submission
+      port: 587
+      targetPort: 587
+      protocol: TCP
+---
+# External LoadBalancer for inbound MX (internet → postfix)
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix-external
+  namespace: mailgateway
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: smtp-in.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.199.1
+    purelb.io/service-group: dmz
+    purelb.io/addresses: 198.18.199.1
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: postfix
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: mailgateway
+spec:
+  allowedNamespaces:
+    - mailgateway
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,17 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: dkim-keys
+  namespace: mailgateway
+spec:
+  destination:
+    create: true
+    name: dkim-keys
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/mailgateway/default/dkim-keys
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: paperclip
+  namespace: paperclip
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: paperclip-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip-http-redirect
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: paperclip
+          port: 3100
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: paperclip
-  namespace: paperclip
-spec:
-  rules:
-    - host: paperclip.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: paperclip
-                port:
-                  number: 3100
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - paperclip.k8s.syd1.au.unkin.net
-      secretName: paperclip-tls
@@ -6,7 +6,8 @@ resources:
  - cnpg_cluster.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - services.yaml
  - vaultauth.yaml
@@ -0,0 +1,41 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: puppetboard-tls
+        mode: Terminate
@@ -0,0 +1,34 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetdb.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: puppetdb-tls
+        mode: Terminate
@@ -0,0 +1,52 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard-http-redirect
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetboard
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetdb.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetdb
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetdb
+          port: 8080
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetboard.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetboard
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetboard.k8s.syd1.au.unkin.net
-      secretName: puppetboard-tls
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetdb.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetdb
-                port:
-                  number: 8080
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetdb.k8s.syd1.au.unkin.net
-      secretName: puppetdb-tls
@@ -25,8 +25,10 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
-  - ingress_puppetdb.yaml
+  - gateway_puppetboard.yaml
+  - httproute_puppetboard.yaml
+  - gateway_puppetdb.yaml
+  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -0,0 +1,52 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: vault
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    cert-manager.io/alt-names: vault.service.consul,vault.query.consul
+    external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: vault.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: vault.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vault-tls
+    - name: vault-direct
+      port: 8200
+      protocol: HTTPS
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vault-tls
@@ -0,0 +1,72 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault-http-redirect
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+spec:
+  hostnames:
+    - vault.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: vault
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+spec:
+  hostnames:
+    - vault.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: vault
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: vault
+          port: 8200
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault-consul
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+spec:
+  hostnames:
+    - vault.service.consul
+    - vault.query.consul
+  parentRefs:
+    - name: vault
+      sectionName: vault-direct
+  rules:
+    - backendRefs:
+        - name: vault
+          port: 8200
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "v1.19.2"
+    version: "v1.20.2"
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
@@ -1,6 +1,11 @@
 crds:
  enabled: true

+config:
+  apiVersion: controller.config.cert-manager.io/v1alpha1
+  kind: ControllerConfiguration
+  enableGatewayAPI: true
+
 replicaCount: 2

 resources:
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/consul
+
+helmCharts:
+  - name: consul
+    repo: https://helm.releases.hashicorp.com
+    version: "1.9.7"
+    releaseName: consul
+    namespace: consul
+    valuesFile: values.yaml
+    apiVersions:
+      - policy/v1/PodDisruptionBudget
@@ -0,0 +1,58 @@
+global:
+  name: consul
+  datacenter: au-syd1
+  domain: consul
+
+server:
+  image: hashicorp/consul:1.22.7
+  replicas: 5
+  bootstrapExpect: 5
+  storage: 10Gi
+  storageClass: cephrbd-fast-delete
+
+  connect: true
+
+  disruptionBudget:
+    maxUnavailable: 1
+
+  extraConfig: |
+    {
+      "disable_remote_exec": true,
+      "disable_update_check": true,
+      "performance": {
+        "raft_multiplier": 10
+      },
+      "ports": {
+        "dns": 8600,
+        "grpc": 8502,
+        "http": 8500,
+        "https": -1
+      },
+      "primary_datacenter": "au-syd1"
+    }
+
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 2Gi
+      cpu: 1000m
+
+client:
+  enabled: false
+
+ui:
+  enabled: true
+  service:
+    type: ClusterIP
+
+connectInject:
+  enabled: false
+
+dns:
+  enabled: true
+  type: LoadBalancer
+  annotations: |
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.5
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: external-dns
    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "1.19.0"
+    version: "1.21.1"
    releaseName: externaldns
    namespace: externaldns
    valuesFile: values.yaml
@@ -25,10 +25,7 @@ sources:
  - service
  - ingress
  - gateway-httproute
-  - gateway-tlsroute
  - gateway-grpcroute
-  - gateway-tcproute
-  - gateway-udproute

 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -54,3 +51,5 @@ extraArgs:
  - --rfc2136-tsig-axfr
  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
  - --ingress-class=nginx
+
+logLevel: debug
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/mailgateway
@@ -94,5 +94,7 @@ ports:
    port: 80
  websecure:
    port: 443
+  vault-direct:
+    port: 8200

 enabled: true
@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/vault
+
+helmCharts:
+  - name: vault
+    repo: https://helm.releases.hashicorp.com
+    version: "0.32.0"
+    releaseName: vault
+    namespace: vault
+    valuesFile: values.yaml
@@ -0,0 +1,73 @@
+server:
+  image:
+    repository: hashicorp/vault
+    tag: "2.0.1"
+
+  ha:
+    enabled: true
+    replicas: 5
+
+    raft:
+      enabled: true
+      setNodeId: true
+      config: |
+        ui            = true
+        disable_mlock = true
+
+        listener "tcp" {
+          address         = "[::]:8200"
+          cluster_address = "[::]:8201"
+          tls_disable     = "true"
+        }
+
+        storage "raft" {
+          path = "/vault/data"
+
+          retry_join {
+            leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
+          }
+          retry_join {
+            leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
+          }
+        }
+
+        service_registration "consul" {
+          address = "consul-server.consul.svc.cluster.local:8500"
+        }
+
+  dataStorage:
+    enabled: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+    accessMode: ReadWriteOnce
+
+  statefulSet:
+    securityContext:
+      container:
+        capabilities:
+          add:
+            - IPC_LOCK
+
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 100m
+    limits:
+      memory: 2Gi
+      cpu: 1000m
+
+injector:
+  enabled: false
+
+ui:
+  enabled: true
+  serviceType: ClusterIP
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: woodpecker
    repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.5.1"
+    version: "3.6.3"
    releaseName: woodpecker
    namespace: woodpecker
    valuesFile: values.yaml
@@ -15,11 +15,13 @@ spec:
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
      - path: apps/overlays/*/cnpg-system
+      - path: apps/overlays/*/consul
      - path: apps/overlays/*/elastic-system
      - path: apps/overlays/*/externaldns
      - path: apps/overlays/*/inteldeviceplugins-system
      - path: apps/overlays/*/jfrog
      - path: apps/overlays/*/node-feature-discovery
+      - path: apps/overlays/*/mailgateway
      - path: apps/overlays/*/puppet
      - path: apps/overlays/*/purelb
      - path: apps/overlays/*/reflector-system
@@ -27,6 +29,7 @@ spec:
      - path: apps/overlays/*/reposync
      - path: apps/overlays/*/traefik-system
      - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vault
      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
  template:
@@ -21,6 +21,8 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'certificates'
      server: https://kubernetes.default.svc
+    - namespace: 'consul'
+      server: https://kubernetes.default.svc
    - namespace: 'externaldns'
      server: https://kubernetes.default.svc
    - namespace: 'jfrog'
@@ -33,6 +35,8 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'reposync'
      server: https://kubernetes.default.svc
+    - namespace: 'vault'
+      server: https://kubernetes.default.svc
    - namespace: 'woodpecker'
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
Author	SHA1	Message	Date
unkinben	5b3058e75e	fix(postfix): use hash: transport_maps with postmap init container - Splits hash-type map files into a separate postfix-maps ConfigMap - Adds postmap init container that builds .db files from all maps into a postfix-db emptyDir, which is then subPath-mounted per map in the main container - Updates transport_maps in main.cf to hash:/etc/postfix/transport	2026-05-24 20:38:27 +10:00
unkinben	ebc21b9fa1	fix(postfix): use .unkin.net subdomain pattern in transport map per transport(5), .domain matches all subdomains. main.unkin.net was an exact-match entry; .unkin.net covers it and any future subdomains.	2026-05-24 20:35:19 +10:00
unkinben	d57c1db5f8	fix(mailgateway): pin postfix-external LoadBalancer to 198.18.199.1	2026-05-24 19:54:08 +10:00
unkinben	942e23c146	fix(mailgateway): add purelb dmz service-group annotation to LoadBalancer	2026-05-24 19:52:16 +10:00
unkinben	b09cd1628d	feat(postfix): deploy postfix MTA and rspamd spam filter - mailgateway namespace with Deployment + HPA (2-6 replicas) - rspamd Deployment + HPA (2-6 replicas) with milter interface - postfix configured to relay inbound mail to stalwart via transport maps - rspamd milter on port 11332 for spam scanning and DKIM signing - DKIM keys stored in Vault at kubernetes/namespace/mailgateway/default/dkim-keys - TLS cert via cert-manager (vault-issuer) for mail.main.unkin.net - rspamd web UI exposed via Traefik Gateway at rspamd.k8s.syd1.au.unkin.net - postfix external LoadBalancer service for inbound MX on port 25 - Add full main.cf and master.cf as ConfigMap resources mounted via subPath - main.cf: relay-only gateway config, texthash: transport maps, rspamd milter - master.cf: standard smtp + submission (587, TLS required) + internal processes - MAILNAME/MY_NETWORKS/MY_DESTINATION env vars kept in sync with main.cf - LOG_TO_STDOUT=1 for k8s log collection	2026-05-24 12:46:28 +10:00
unkinben	cbc2c1cb9f	fix(gateways): add explicit group: "" to all certificateRefs entries (#153 ) The Gateway API admission server defaults certificateRefs[].group to "" when it is omitted. ArgoCD diffed the desired state (no group field) against the live state (group: "") and flagged every gateway as out of sync. Fix: explicitly set group: "" in all certificateRefs entries so the rendered manifest matches the API server's canonical form exactly. Affected: artifactapi, cattle-system, consul, litellm, paperclip, puppet (puppetboard + puppetdb), vault. Reviewed-on: #153	2026-05-23 23:47:24 +10:00
unkinben	c6f9893804	fix(argocd): add vault and consul to platform project destinations (#152 ) Vault and consul namespaces were missing from the platform AppProject allowed destinations, causing ArgoCD sync failures with: destination server 'https://kubernetes.default.svc' and namespace 'vault' do not match any of the allowed destinations in project 'platform' Reviewed-on: #152	2026-05-23 23:27:24 +10:00
unkinben	e43fb742ad	feat(artifactapi): add kanidm to ghcr docker immutable patterns (#151 ) Prerequisite for kanidm deployment (PR benvin/kanidm). Reviewed-on: #151	2026-05-23 23:09:38 +10:00
unkinben	11ac2ae91e	feat(consul): deploy HashiCorp Consul 1.22.7 via Helm chart (5-replica cluster) (#149 ) ## Summary - Deploys HashiCorp Consul 1.22.7 using Helm chart 1.9.7 with 5 server replicas - Configuration modelled on production consul: \`datacenter=au-syd1\`, \`connect=true\`, \`raft_multiplier=10\`, HTTP on 8500, GRPC on 8502, HTTPS disabled - 5-replica server cluster with \`bootstrapExpect=5\` - 10Gi cephrbd-fast-delete PVC per server pod - Gateway API: HTTPS gateway + HTTPRoute (443→consul-consul-ui:80→8500) at \`consul.k8s.syd1.au.unkin.net\` - PodDisruptionBudget patched from \`policy/v1beta1\` to \`policy/v1\` (k8s 1.25+ compatibility) - ArgoCD platform ApplicationSet updated to include consul overlay path - Clients disabled (server-only deployment) - ConnectInject disabled (can be enabled later for service mesh) ## Requires - PR #147 (artifactapi: add hashicorp/consul to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-consul\`: all 5 server pods 1/1 Running, cluster formed - [ ] After merge: ArgoCD syncs consul namespace - [ ] Verify \`consul.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #149	2026-05-23 22:40:49 +10:00
unkinben	d2be521878	feat(vault): deploy HashiCorp Vault 2.0.1 via Helm chart (5-replica HA raft) (#148 ) ## Summary - Deploys HashiCorp Vault 2.0.1 using Helm chart 0.32.0 in HA raft mode (5 replicas) - Configuration modelled on production vault: \`disable_mlock=true\`, headless-DNS retry_join for all 5 pods - IPC_LOCK capability added via \`server.statefulSet.securityContext.container\` - 10Gi cephrbd-fast-delete PVC per pod via \`dataStorage\` - Gateway API: HTTPS gateway + HTTPRoute (443→vault service port 8200) at \`vault.k8s.syd1.au.unkin.net\` - ArgoCD platform ApplicationSet updated to include vault overlay path - Injector disabled (no agent sidecar injection needed) ## Requires - PR #147 (artifactapi: add hashicorp/vault to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-vault\`: all 5 pods Running, raft cluster forming - [ ] After merge: ArgoCD syncs vault namespace - [ ] Operator runs \`vault operator init\` to initialize, then unseals all 5 nodes - [ ] Verify \`vault.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #148	2026-05-23 22:39:41 +10:00
unkinben	bcd4c1a722	feat(cert-manager): upgrade to v1.20.2 and enable Gateway API support (#150 ) ## Summary - Upgrades cert-manager from v1.19.2 to v1.20.2 - Enables `enableGatewayAPI: true` via the `ControllerConfiguration` config block ## Why cert-manager's Gateway API integration was not enabled. Without it, `cert-manager.io/*` annotations on Gateway resources are ignored and no certificates are issued. This is required for the consul and vault PRs (#148, #149) to have their TLS certs automatically provisioned from their Gateway annotations. In v1.20.2, `ExperimentalGatewayAPISupport` is BETA and defaults to true — enabling `enableGatewayAPI` in the controller config activates the gateway-shim controller. ## Test plan - [ ] cert-manager rolls out cleanly (v1.20.2 pods become Ready) - [ ] After rollout, existing Gateway-annotated services (artifactapi, puppet, litellm) retain valid certs - [ ] New Gateway resources with `cert-manager.io/cluster-issuer` annotations trigger Certificate creation Reviewed-on: #150	2026-05-23 22:38:39 +10:00
unkinben	6d9530b1ee	feat(artifactapi): add hashicorp/consul and hashicorp/vault to docker immutable patterns (#147 ) ## Summary - Adds \`^hashicorp/consul\` and \`^hashicorp/vault\` to the dockerhub immutable_patterns in artifactapi's remote-docker.yaml - Replaces the more specific \`^hashicorp/vault-secrets-operator\` pattern since \`^hashicorp/vault\` subsumes it - Required for the benvin/vault and benvin/consul branches (vault:2.0.1 and consul:1.22.7) ## Test plan - [ ] Verify artifactapi accepts requests for hashicorp/vault and hashicorp/consul images after merge Reviewed-on: #147	2026-05-23 18:21:25 +10:00
unkinben	dcea768c15	feat(woodpecker): upgrade to v3.14.1 (chart 3.6.3) (#146 ) Reviewed-on: #146	2026-05-23 18:00:55 +10:00
unkinben	e05f9bfd83	feat: increase litellm resources (#144 ) finding litellm performance has dropped, crashed in multiple cases, and then it had scaled to the maximum level using the majority of memory in cluster. - reduce the rate at which litellm autoscales - increase the requests/limits to match usage Reviewed-on: #144	2026-05-23 17:59:43 +10:00
unkinben	445d8b6e7e	feat: add HTTP→HTTPS redirect to Gateway API services (#145 ) Add port 80 HTTP listener and redirect HTTPRoute to artifactapi, cattle-system (rancher), litellm, paperclip, and puppetboard — restoring the redirect behaviour that existed on the previous nginx/traefik Ingress resources. Reviewed-on: #145	2026-05-23 17:34:07 +10:00
unkinben	c2637da068	feat(artifactapi): migrate Ingress to Gateway API (#129 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Notes The original Ingress had nginx-specific annotations (`proxy-body-size: 10g`, `proxy-read-timeout: 600`) which are not portable to Gateway API. These can be re-introduced via a Traefik `Middleware` CRD if needed. ## Test plan - [ ] ArgoCD syncs the app cleanly - [ ] cert-manager issues the `artifactapi-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://artifactapi.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #129	2026-05-23 16:06:33 +10:00
unkinben	90ddd932fe	feat(puppet): migrate puppetdb Ingress to Gateway API (#131 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetboard.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetdb-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetdb.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #131	2026-05-23 16:05:26 +10:00
unkinben	2c6d88aa6b	feat(puppet): migrate puppetboard Ingress to Gateway API (#130 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway - `ingress_puppetdb.yaml` is unchanged in this PR (separate PR) ## Test plan - [ ] ArgoCD syncs the puppet app cleanly - [ ] cert-manager issues the `puppetboard-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #130	2026-05-23 01:31:28 +10:00
unkinben	58368948d9	feat(paperclip): migrate Ingress to Gateway API (#133 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the paperclip app cleanly - [ ] cert-manager issues the `paperclip-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://paperclip.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #133	2026-05-23 01:31:03 +10:00
unkinben	4f5c3f7ea0	feat(litellm): migrate Ingress to Gateway API (#134 ) ## Summary - Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass - TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer` - external-dns annotations moved to the Gateway ## Test plan - [ ] ArgoCD syncs the litellm app cleanly - [ ] cert-manager issues the `litellm-tls` certificate - [ ] external-dns creates the DNS record - [ ] `https://litellm.k8s.syd1.au.unkin.net` is reachable Reviewed-on: #134	2026-05-23 01:29:54 +10:00
unkinben	fd87cb96b5	feat(externaldns): upgrade to 1.21.1, fix sources for installed CRDs (#143 ) ## Changes - Upgrade external-dns chart from 1.19.0 → 1.21.1 (app v0.19.0 → v0.21.0) - Remove `gateway-tcproute` source — `TCPRoute` CRD is not installed, causing crash-loop - Add `gateway-tlsroute` source — `TLSRoute` CRD is installed (Gateway API 1.5.1) ## Why The pod was crash-looping every minute with `failed to list *v1alpha2.TCPRoute: the server could not find the requested resource` because the TCPRoute CRD doesn't exist in this cluster. TLSRoute was previously removed but its CRD does exist. Reviewed-on: #143	2026-05-23 01:28:20 +10:00
unkinben	d619f9195e	benvin/externaldns_compatability (#142 ) Reviewed-on: #142	2026-05-23 01:17:20 +10:00
unkinben	1944dbbfcd	temp: enable debug logging on externaldns to diagnose TLSRoute sync timeout (#140 ) Temporary: enable --log-level=debug to understand why the TLSRoute informer never reports HasSynced within the 1m interval. To be closed/reverted after root cause is found. Reviewed-on: #140	2026-05-23 01:07:45 +10:00