fix(stalwart): pin stalwart-external LoadBalancer to 198.18.199.2

- Replace PostgreSQL in-memory store with Valkey (Redis-compatible) for
  better performance on rate limiting, distributed locks, and OAuth codes
- Add single-replica Valkey deployment with no persistence (data is transient)
- Switch liveness/readiness probes to HTTP GET /healthz/live and
  /healthz/ready on port 8080 per official Kubernetes probe documentation
- Update webadmin resource URL to use artifactapi proxy instead of direct
  GitHub download

.pre-commit-config.yaml

@@ -40,10 +40,3 @@ repos:
         entry: ci/validate-no-secrets.sh
         language: system
         pass_filenames: false
-      - id: conftest_policies
-        name: OPA policy checks (conftest)
-        entry: conftest test --policy policy/
-        language: system
-        types: [yaml]
-        exclude: ".*/charts/.*|.*/templates/.*|\\.woodpecker/.*"
-        pass_filenames: true

apps/base/artifactapi/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: artifactapi
-      kind: Gateway
-      name: artifactapi
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - artifactapi.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: artifactapi
-      kind: Gateway
-      name: artifactapi
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: artifactapi-api
-          kind: Service
-          name: artifactapi-api
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -6,9 +6,9 @@ remotes:
     immutable_patterns:
       - "^cloudnative-pg/cloudnative-pg"
       - "^emberstack/helm-charts"
+      - "^kanidm/"
       - "^openvoxproject/"
       - "^stakater/reloader"
-      - "^stalwartlabs/stalwart"
       - "^voxpupuli/puppetboard"
       - "^woodpecker-ci/helm"
     cache:
@@ -34,12 +34,8 @@ remotes:
       - "^hashicorp/consul"
       - "^hashicorp/vault"
       - "^jfrog/"
-      - "^kanidm/"
       - "^rancher/"
-      - "^rspamd/rspamd"
-      - "^tozd/postfix"
       - "^traefik/"
-      - "^valkey/valkey"
       - "^ubi9/ubi-minimal"
       - "^victoriametrics/"
       - "^woodpeckerci/"

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -5,7 +5,6 @@ remotes:
     description: "GitHub releases and files"
     mutable_patterns:
       - ".*/archive/refs/heads/.*.tar.gz$"
-      - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
     immutable_patterns:
       - ".*/archive/refs/tags/.*.tar.gz$"
       - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"

apps/base/cattle-system/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - rancher.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: rancher
-      kind: Gateway
-      name: rancher
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - rancher.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: rancher
-      kind: Gateway
-      name: rancher
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: rancher
-          kind: Service
-          name: rancher
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/consul/httproute.yaml

@@ -11,9 +11,7 @@ spec:
   hostnames:
     - consul.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: consul
-      kind: Gateway
-      name: consul
       sectionName: http
   rules:
     - filters:
@@ -38,17 +36,12 @@ spec:
   hostnames:
     - consul.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: consul
-      kind: Gateway
-      name: consul
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: consul-ui
-          kind: Service
-          name: consul-ui
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix
@@ -66,17 +59,12 @@ spec:
   hostnames:
     - consul.service.consul
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: consul
-      kind: Gateway
-      name: consul
       sectionName: consul-svc
   rules:
     - backendRefs:
-        - group: ""
+        - name: consul-ui
-          kind: Service
-          name: consul-ui
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/kanidm/certificate.yaml

@@ -1,26 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kanidm-tls
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  secretName: kanidm-tls
-  issuerRef:
-    kind: ClusterIssuer
-    name: vault-issuer
-  commonName: auth.unkin.net
-  dnsNames:
-    - auth.unkin.net
-    - au.auth.unkin.net
-    - kanidm.k8s.syd1.au.unkin.net
-    - kanidm.kanidm.svc.cluster.local
-    - kanidm-0.kanidm-headless.kanidm.svc.cluster.local
-    - kanidm-1.kanidm-headless.kanidm.svc.cluster.local
-    - kanidm-2.kanidm-headless.kanidm.svc.cluster.local
-  privateKey:
-    algorithm: RSA
-    size: 4096

apps/base/kanidm/configmap.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-config
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-data:
-  server.toml: |
-    version = "2"
-
-    domain = "auth.unkin.net"
-    origin = "https://auth.unkin.net"
-    bindaddress = "[::]:8443"
-    db_path = "/data/kanidm.db"
-    db_arc_size = 2048
-    tls_chain = "/data/tls/tls.crt"
-    tls_key = "/data/tls/tls.key"
-    log_level = "info"
-
-    [online_backup]
-    path = "/data/backups/"
-    schedule = "0 22 * * *"
-    versions = 7
-
-    [replication]
-    origin = "__REPL_ORIGIN__"
-    bindaddress = "[::]:8444"
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-repl-certs
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-data: {}

apps/base/kanidm/gateway.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-    traefik.io/instance: internal
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https-passthrough
-      port: 443
-      protocol: TLS
-      tls:
-        mode: Passthrough
-      allowedRoutes:
-        namespaces:
-          from: Same

apps/base/kanidm/httproute.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: kanidm-http-redirect
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  hostnames:
-    - kanidm.k8s.syd1.au.unkin.net
-    - auth.unkin.net
-    - au.auth.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: kanidm
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/kanidm/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - rbac.yaml
-  - certificate.yaml
-  - configmap.yaml
-  - service.yaml
-  - statefulset.yaml
-  - poddisruptionbudget.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - tlsroute.yaml

apps/base/kanidm/poddisruptionbudget.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kanidm
-      app.kubernetes.io/instance: kanidm

apps/base/kanidm/rbac.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kanidm-repl
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["kanidm-repl-certs"]
-    verbs: ["get", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kanidm-repl
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-subjects:
-  - kind: ServiceAccount
-    name: kanidm
-    namespace: kanidm
-roleRef:
-  kind: Role
-  name: kanidm-repl
-  apiGroup: rbac.authorization.k8s.io

apps/base/kanidm/service.yaml

@@ -1,43 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  type: ClusterIP
-  ports:
-    - name: https
-      port: 8443
-      targetPort: https
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm-headless
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  type: ClusterIP
-  clusterIP: None
-  ports:
-    - name: https
-      port: 8443
-      targetPort: https
-      protocol: TCP
-    - name: replication
-      port: 8444
-      targetPort: replication
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm

apps/base/kanidm/serviceaccount.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm

apps/base/kanidm/statefulset.yaml

@@ -1,161 +0,0 @@
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  serviceName: kanidm-headless
-  replicas: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kanidm
-      app.kubernetes.io/instance: kanidm
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: kanidm
-        app.kubernetes.io/instance: kanidm
-    spec:
-      serviceAccountName: kanidm
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: kanidm
-                  app.kubernetes.io/instance: kanidm
-              topologyKey: kubernetes.io/hostname
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        fsGroup: 1000
-      initContainers:
-        - name: config-init
-          image: kanidm/server:1.10.3
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              REPL_ORIGIN="repl://${POD_NAME}.kanidm-headless.kanidm.svc.cluster.local:8444"
-              sed "s|__REPL_ORIGIN__|${REPL_ORIGIN}|g" /config-template/server.toml > /config/server.toml
-              for peer in kanidm-0 kanidm-1 kanidm-2; do
-                if [ "${peer}" = "${POD_NAME}" ]; then
-                  continue
-                fi
-                cert_file="/repl-certs/${peer}"
-                if [ -s "${cert_file}" ]; then
-                  fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
-                  printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
-                    "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
-                fi
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-            - name: config
-              mountPath: /config
-            - name: repl-certs
-              mountPath: /repl-certs
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-        - name: repl-cert-publisher
-          image: bitnami/kubectl:1.33
-          restartPolicy: Always
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              until kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null | grep -q '^# certificate:'; do
-                sleep 30
-              done
-              while true; do
-                cert=$(kubectl exec "${POD_NAME}" -c kanidm -- /sbin/kanidmd renew-replication-certificate 2>/dev/null \
-                  | grep '^# certificate:' | sed 's/^# certificate: "\(.*\)"$/\1/')
-                if [ -n "${cert}" ]; then
-                  kubectl patch configmap kanidm-repl-certs \
-                    --type=merge \
-                    -p "{\"data\":{\"${POD_NAME}\":\"${cert}\"}}"
-                fi
-                sleep 3600
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-      containers:
-        - name: kanidm
-          image: kanidm/server:1.10.3
-          command: ["/sbin/kanidmd"]
-          args: ["server", "-c", "/config/server.toml"]
-          ports:
-            - name: https
-              containerPort: 8443
-              protocol: TCP
-            - name: replication
-              containerPort: 8444
-              protocol: TCP
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: config
-              mountPath: /config
-              readOnly: true
-            - name: tls
-              mountPath: /data/tls
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-          resources:
-            requests:
-              memory: 256Mi
-              cpu: 100m
-            limits:
-              memory: 1Gi
-              cpu: 500m
-          readinessProbe:
-            tcpSocket:
-              port: 8443
-            initialDelaySeconds: 15
-            periodSeconds: 10
-          livenessProbe:
-            tcpSocket:
-              port: 8443
-            initialDelaySeconds: 30
-            periodSeconds: 30
-      volumes:
-        - name: config-template
-          configMap:
-            name: kanidm-config
-        - name: config
-          emptyDir: {}
-        - name: repl-certs
-          configMap:
-            name: kanidm-repl-certs
-        - name: tls
-          secret:
-            secretName: kanidm-tls
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: [ReadWriteOnce]
-        storageClassName: cephrbd-fast-delete
-        resources:
-          requests:
-            storage: 10Gi

apps/base/kanidm/tlsroute.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TLSRoute
-metadata:
-  name: kanidm
-  namespace: kanidm
-  labels:
-    app.kubernetes.io/name: kanidm
-    app.kubernetes.io/instance: kanidm
-spec:
-  hostnames:
-    - kanidm.k8s.syd1.au.unkin.net
-    - auth.unkin.net
-    - au.auth.unkin.net
-  parentRefs:
-    - name: kanidm
-      sectionName: https-passthrough
-  rules:
-    - backendRefs:
-        - name: kanidm
-          port: 8443

apps/base/litellm/cnpg_cluster.yaml

@@ -76,8 +76,8 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: "1"
+      cpu: 1
-      memory: 1Gi
+      memory: 1024Mi
     requests:
       cpu: 250m
       memory: 512Mi

apps/base/litellm/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - litellm.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: litellm
-      kind: Gateway
-      name: litellm
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - litellm.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: litellm
-      kind: Gateway
-      name: litellm
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: litellm
-          kind: Service
-          name: litellm
           port: 4000
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/paperclip/httproute.yaml

@@ -8,9 +8,7 @@ spec:
   hostnames:
     - paperclip.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: paperclip
-      kind: Gateway
-      name: paperclip
       sectionName: http
   rules:
     - filters:
@@ -32,17 +30,12 @@ spec:
   hostnames:
     - paperclip.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: paperclip
-      kind: Gateway
-      name: paperclip
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: paperclip
-          kind: Service
-          name: paperclip
           port: 3100
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/puppet/deployment_puppetboard.yaml

@@ -150,7 +150,7 @@ spec:
               memory: 350Mi
               cpu: 100m
             limits:
-              memory: 1Gi
+              memory: 1024Mi
               cpu: 500m
           securityContext:
             runAsNonRoot: true

apps/base/puppet/deployment_puppetdb.yaml

@@ -35,7 +35,7 @@ spec:
           imagePullPolicy: IfNotPresent
           resources:
             limits:
-              cpu: "1"
+              cpu: 1
               memory: 1536Mi
             requests:
               cpu: 250m

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -31,11 +31,11 @@ spec:
         imagePullPolicy: IfNotPresent
         resources:
           limits:
-            cpu: "2"
+            cpu: 2
-            memory: 3Gi
+            memory: 3072Mi
           requests:
             cpu: 500m
-            memory: 1Gi
+            memory: 1024Mi
         ports:
         - containerPort: 8140
           name: puppetserver

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -35,11 +35,11 @@ spec:
           imagePullPolicy: IfNotPresent
           resources:
             limits:
-              cpu: "2"
+              cpu: 2
               memory: 3500Mi
             requests:
               cpu: 250m
-              memory: 1Gi
+              memory: 1024Mi
           ports:
             - containerPort: 8140
               name: puppetserver

apps/base/puppet/httproute_puppetboard.yaml

@@ -13,9 +13,7 @@ spec:
   hostnames:
     - puppetboard.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: puppetboard
-      kind: Gateway
-      name: puppetboard
       sectionName: http
   rules:
     - filters:
@@ -42,17 +40,12 @@ spec:
   hostnames:
     - puppetboard.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: puppetboard
-      kind: Gateway
-      name: puppetboard
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: puppetboard
-          kind: Service
-          name: puppetboard
           port: 80
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/puppet/httproute_puppetdb.yaml

@@ -13,17 +13,12 @@ spec:
   hostnames:
     - puppetdb.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: puppetdb
-      kind: Gateway
-      name: puppetdb
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: puppetdb
-          kind: Service
-          name: puppetdb
           port: 8080
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/base/reposync/cronjob_reposync-almalinux9-appstream.yaml

@@ -53,7 +53,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: "2"
+                  cpu: 2000m
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/reposync/cronjob_reposync-almalinux9-baseos.yaml

@@ -56,7 +56,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: "2"
+                  cpu: 2000m
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/reposync/cronjob_reposync-epel9.yaml

@@ -53,7 +53,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: "2"
+                  cpu: 2000m
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/reposync/cronjob_reposync-openvox7.yaml

@@ -52,7 +52,7 @@ spec:
                   cpu: 500m
                   memory: 1Gi
                 limits:
-                  cpu: "2"
+                  cpu: 2000m
                   memory: 4Gi
               volumeMounts:
                 - name: repodata

apps/base/stalwart/certificate.yaml

@@ -0,0 +1,36 @@
+---
+# TLS cert for stalwart's own HTTPS/IMAPS/STARTTLS listeners (mail.main.unkin.net)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: stalwart-tls
+  namespace: stalwart
+spec:
+  secretName: stalwart-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.main.unkin.net
+  dnsNames:
+    - mail.main.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA
+---
+# TLS cert for Traefik Gateway (internal k8s admin URL)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: stalwart-gateway-tls
+  namespace: stalwart
+spec:
+  secretName: stalwart-gateway-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.k8s.syd1.au.unkin.net
+  dnsNames:
+    - mail.k8s.syd1.au.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA

apps/base/stalwart/cnpg_cluster.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: stalwart-postgres
+  namespace: stalwart
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: stalwart
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: stalwart
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: "2"
+      memory: 2Gi
+    requests:
+      cpu: 500m
+      memory: 1Gi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/stalwart/cnpg_pooler.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: stalwart-postgres-pooler
+  namespace: stalwart
+spec:
+  cluster:
+    name: stalwart-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "50"
+      max_client_conn: "200"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw

apps/base/stalwart/gateway.yaml

@@ -0,0 +1,38 @@
+---
+# Traefik gateway for stalwart web admin UI (separate from the LoadBalancer HTTPS port)
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: mail.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: mail.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: stalwart
+  namespace: stalwart
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: mail.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: mail.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: stalwart-gateway-tls
+        mode: Terminate

apps/base/stalwart/httproute.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  parentRefs:
+    - name: stalwart
+      namespace: stalwart
+  hostnames:
+    - mail.k8s.syd1.au.unkin.net
+  rules:
+    - backendRefs:
+        - name: stalwart
+          port: 8080

apps/base/stalwart/kustomization.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - certificate.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - services.yaml
+  - stalwart-deployment.yaml
+  - stalwart-hpa.yaml
+  - valkey.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: stalwart-config
+    files:
+      - config.toml=resources/config.toml
+    options:
+      disableNameSuffixHash: true

apps/base/stalwart/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: kanidm
+  name: stalwart

apps/base/stalwart/resources/config.toml

@@ -0,0 +1,228 @@
+[server]
+hostname = "mail.main.unkin.net"
+greeting = "Stalwart ESMTP"
+
+# SMTP relay listener (receives from postfix for local delivery)
+[server.listener."smtp-relay"]
+bind = ["0.0.0.0:25"]
+protocol = "smtp"
+greeting = "Stalwart SMTP Relay"
+
+[server.listener."smtp-relay".proxy]
+trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+# SMTP submission listener (user-facing, TLS required)
+[server.listener."submission"]
+bind = ["0.0.0.0:587"]
+protocol = "smtp"
+greeting = "Stalwart SMTP Submission"
+tls.require = true
+
+[server.listener."submission".proxy]
+trusted-networks = ["127.0.0.0/8", "::1"]
+
+# IMAP listener
+[server.listener."imap"]
+bind = ["0.0.0.0:143"]
+protocol = "imap"
+
+[server.listener."imap".proxy]
+trusted-networks = ["127.0.0.0/8", "::1"]
+
+# IMAPS listener (implicit TLS)
+[server.listener."imaps"]
+bind = ["0.0.0.0:993"]
+protocol = "imap"
+tls.implicit = true
+
+[server.listener."imaps".proxy]
+trusted-networks = ["127.0.0.0/8", "::1"]
+
+# HTTPS (web admin + JMAP) for external LoadBalancer
+[server.listener."https"]
+bind = ["0.0.0.0:443"]
+protocol = "http"
+tls.implicit = true
+
+[server.listener."https".proxy]
+trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+# Plain HTTP for Traefik reverse proxy (TLS terminated at Traefik)
+[server.listener."http-internal"]
+bind = ["0.0.0.0:8080"]
+protocol = "http"
+
+[server.listener."http-internal".proxy]
+trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+[server.tls]
+enable = true
+implicit = false
+certificate = "default"
+
+[server.http]
+use-x-forwarded = true
+permissive-cors = false
+
+[webadmin]
+path = "/var/lib/stalwart/webadmin"
+auto-update = true
+resource = "https://artifactapi.k8s.syd1.au.unkin.net/generic/github/stalwartlabs/webadmin/releases/latest/download/webadmin.zip"
+
+# PostgreSQL store (via CNPG pooler)
+[store."postgresql"]
+type = "postgresql"
+host = "stalwart-postgres-pooler.stalwart.svc.cluster.local"
+port = 5432
+database = "stalwart"
+user = "stalwart"
+password = "%{env:POSTGRES_PASSWORD}%"
+timeout = "15s"
+
+[store."postgresql".tls]
+enable = true
+allow-invalid-certs = false
+
+[store."postgresql".pool]
+max-connections = 10
+
+[store."postgresql".purge]
+frequency = "0 3 *"
+
+# S3/Ceph-RGW store for blobs
+[store."s3"]
+type = "s3"
+bucket = "stalwart-maildata"
+region = "syd1"
+access-key = "%{env:S3_ACCESS_KEY}%"
+secret-key = "%{env:S3_SECRET_KEY}%"
+endpoint = "https://radosgw.service.consul"
+timeout = "30s"
+key-prefix = "stalwart/"
+compression = "lz4"
+
+[store."s3".purge]
+frequency = "30 5 *"
+
+# Valkey in-memory store (rate limiting, locks, OAuth codes, greylisting)
+[store."valkey"]
+type = "redis"
+urls = ["redis://stalwart-valkey.stalwart.svc.cluster.local:6379"]
+
+# Storage assignment
+[storage]
+data = "postgresql"
+fts = "postgresql"
+blob = "s3"
+lookup = "postgresql"
+directory = "internal"
+in-memory = "valkey"
+
+# Directory configuration
+[directory.internal]
+type = "internal"
+store = "postgresql"
+
+# Fallback admin (password hash from Vault)
+[authentication.fallback-admin]
+user = "admin"
+secret = "%{env:ADMIN_PASSWORD_HASH}%"
+
+[authentication]
+[authentication.directory]
+directories = ["internal"]
+
+[authorization]
+directory = "internal"
+
+# JMAP configuration
+[jmap]
+directory = "internal"
+
+[jmap.protocol]
+request-max-size = 10485760
+get.max-objects = 500
+query.max-results = 5000
+changes.max-results = 5000
+upload.max-size = 50000000
+upload.ttl = "1h"
+
+# IMAP configuration
+[imap]
+directory = "internal"
+
+[imap.protocol]
+max-requests = 64
+
+# Inbound rate limiting
+[[queue.limiter.inbound]]
+key = ["remote_ip"]
+rate = "500/1s"
+enable = true
+
+# Outbound routing through postfix relay
+[queue]
+path = "/var/lib/stalwart/queue"
+
+[queue.schedule]
+retry = ["2s", "5s", "1m", "5m", "15m", "30m", "1h", "2h"]
+notify = ["1d", "3d"]
+expire = "5d"
+
+[session.extensions]
+future-release = "7d"
+
+# Route local domain mail locally, everything else through postfix relay
+[queue.strategy]
+route = [
+    { if = "is_local_domain('', rcpt_domain)", then = "'local'" },
+    { else = "'relay'" }
+]
+
+[queue.route."local"]
+type = "local"
+
+[queue.route."relay"]
+type = "relay"
+address = "postfix.mailgateway.svc.cluster.local"
+port = 25
+protocol = "smtp"
+
+[queue.route."relay".tls]
+implicit = false
+allow-invalid-certs = false
+
+# Session configuration
+[session.ehlo]
+reject-non-fqdn = false
+
+[session.rcpt]
+type = "internal"
+store = "postgresql"
+max-recipients = 25
+
+[session.data]
+max-messages = 10
+max-message-size = 52428800
+
+# Spam filtering offloaded to postfix/rspamd — disable internal spam filter
+[spam-filter]
+enable = false
+
+# TLS certificate (cert-manager issues to /etc/stalwart/tls/)
+[certificate."default"]
+cert = "%{file:/etc/stalwart/tls/tls.crt}%"
+private-key = "%{file:/etc/stalwart/tls/tls.key}%"
+default = true
+
+# Logging
+[tracer]
+type = "log"
+level = "info"
+ansi = false
+multiline = true
+
+# Metrics
+[metrics]
+prometheus.enable = true
+prometheus.port = 9090

apps/base/stalwart/services.yaml

@@ -0,0 +1,57 @@
+---
+# Internal service - postfix connects here to deliver inbound mail
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  selector:
+    app: stalwart
+  ports:
+    - name: smtp-relay
+      port: 25
+      targetPort: 25
+      protocol: TCP
+    - name: http-internal
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+    - name: metrics
+      port: 9090
+      targetPort: 9090
+      protocol: TCP
+---
+# External LoadBalancer for user-facing mail services
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-external
+  namespace: stalwart
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: mail.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.199.2
+    purelb.io/service-group: dmz
+    purelb.io/addresses: 198.18.199.2
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: stalwart
+  ports:
+    - name: submission
+      port: 587
+      targetPort: 587
+      protocol: TCP
+    - name: imap
+      port: 143
+      targetPort: 143
+      protocol: TCP
+    - name: imaps
+      port: 993
+      targetPort: 993
+      protocol: TCP
+    - name: https
+      port: 443
+      targetPort: 443
+      protocol: TCP

apps/base/stalwart/stalwart-deployment.yaml

@@ -0,0 +1,109 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  selector:
+    matchLabels:
+      app: stalwart
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: stalwart
+    spec:
+      securityContext:
+        runAsUser: 2000
+        runAsGroup: 2000
+        fsGroup: 2000
+      containers:
+        - name: stalwart
+          image: ghcr.io/stalwartlabs/stalwart:v0.16.6
+          ports:
+            - containerPort: 25
+              name: smtp-relay
+              protocol: TCP
+            - containerPort: 587
+              name: submission
+              protocol: TCP
+            - containerPort: 143
+              name: imap
+              protocol: TCP
+            - containerPort: 993
+              name: imaps
+              protocol: TCP
+            - containerPort: 443
+              name: https
+              protocol: TCP
+            - containerPort: 8080
+              name: http-internal
+              protocol: TCP
+            - containerPort: 9090
+              name: metrics
+              protocol: TCP
+          env:
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-credentials
+                  key: password
+            - name: S3_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: access_key
+            - name: S3_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: secret_key
+            - name: ADMIN_PASSWORD_HASH
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-admin
+                  key: password_hash
+          livenessProbe:
+            httpGet:
+              path: /healthz/live
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz/ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          volumeMounts:
+            - name: config
+              mountPath: /etc/stalwart/config.toml
+              subPath: config.toml
+              readOnly: true
+            - name: tls
+              mountPath: /etc/stalwart/tls
+              readOnly: true
+            - name: data
+              mountPath: /var/lib/stalwart
+      volumes:
+        - name: config
+          configMap:
+            name: stalwart-config
+        - name: tls
+          secret:
+            secretName: stalwart-tls
+        - name: data
+          emptyDir: {}

apps/base/stalwart/stalwart-hpa.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: stalwart-hpa
+  namespace: stalwart
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: stalwart
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+        - type: Pods
+          value: 2
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60

apps/base/stalwart/valkey.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart-valkey
+  namespace: stalwart
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: stalwart-valkey
+  template:
+    metadata:
+      labels:
+        app: stalwart-valkey
+    spec:
+      containers:
+        - name: valkey
+          image: valkey/valkey:8-alpine
+          args:
+            - "--save"
+            - ""
+            - "--appendonly"
+            - "no"
+          ports:
+            - containerPort: 6379
+              name: valkey
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          livenessProbe:
+            tcpSocket:
+              port: 6379
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command: ["valkey-cli", "ping"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-valkey
+  namespace: stalwart
+spec:
+  selector:
+    app: stalwart-valkey
+  ports:
+    - port: 6379
+      targetPort: 6379
+      name: valkey

apps/base/stalwart/vaultauth.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: stalwart
+spec:
+  allowedNamespaces:
+    - stalwart
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default

apps/base/stalwart/vaultstaticsecret.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: stalwart
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/stalwart/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: s3-credentials
+  namespace: stalwart
+spec:
+  destination:
+    create: true
+    name: s3-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/stalwart/default/s3-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-admin
+  namespace: stalwart
+spec:
+  destination:
+    create: true
+    name: stalwart-admin
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/stalwart/default/stalwart-admin
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/vault/httproute.yaml

@@ -11,9 +11,7 @@ spec:
   hostnames:
     - vault.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: vault
-      kind: Gateway
-      name: vault
       sectionName: http
   rules:
     - filters:
@@ -38,17 +36,12 @@ spec:
   hostnames:
     - vault.k8s.syd1.au.unkin.net
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: vault
-      kind: Gateway
-      name: vault
       sectionName: https
   rules:
     - backendRefs:
-        - group: ""
+        - name: vault
-          kind: Service
-          name: vault
           port: 8200
-          weight: 1
       matches:
         - path:
             type: PathPrefix
@@ -67,17 +60,12 @@ spec:
     - vault.service.consul
     - vault.query.consul
   parentRefs:
-    - group: gateway.networking.k8s.io
+    - name: vault
-      kind: Gateway
-      name: vault
       sectionName: vault-direct
   rules:
     - backendRefs:
-        - group: ""
+        - name: vault
-          kind: Service
-          name: vault
           port: 8200
-          weight: 1
       matches:
         - path:
             type: PathPrefix

apps/overlays/au-syd1/stalwart/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/kanidm
+  - ../../../base/stalwart

argocd/applicationsets/platform.yaml

@@ -20,13 +20,13 @@ spec:
       - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
-      - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/node-feature-discovery
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/stalwart
       - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vault
@@ -44,12 +44,6 @@ spec:
       destination:
         server: https://kubernetes.default.svc
         namespace: '{{path[3]}}'  # Use directory name as namespace
-      ignoreDifferences:
-      - group: ""
-        kind: ConfigMap
-        name: kanidm-repl-certs
-        jsonPointers:
-        - /data
       syncPolicy:
         automated:
           prune: true

argocd/projects/platform.yaml

@@ -27,8 +27,6 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
-    - namespace: 'kanidm'
-      server: https://kubernetes.default.svc
     - namespace: 'node-feature-discovery'
       server: https://kubernetes.default.svc
     - namespace: 'purelb'

policy/gateway_api.rego

@@ -1,94 +0,0 @@
-package main
-
-# Gateway API resources require several fields to be set explicitly even though
-# the Gateway API controller defaults them. ArgoCD diffs desired vs live by
-# string comparison, so any field the controller defaults that is absent from
-# the git manifest causes a permanent OutOfSync.
-#
-# Affected resources:
-#   HTTPRoute / TLSRoute — parentRefs and backendRefs (see PR #162, #165)
-#   Gateway              — listeners[*].tls.certificateRefs (see PR #153)
-
-_route_kinds := {"HTTPRoute", "TLSRoute"}
-
-# ---- parentRefs: group must be "gateway.networking.k8s.io" ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    ref := input.spec.parentRefs[i]
-    object.get(ref, "group", null) != "gateway.networking.k8s.io"
-    msg := sprintf(
-        "%s %s/%s parentRefs[%d]: add 'group: gateway.networking.k8s.io' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, i],
-    )
-}
-
-# ---- parentRefs: kind must be "Gateway" ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    ref := input.spec.parentRefs[i]
-    object.get(ref, "kind", null) != "Gateway"
-    msg := sprintf(
-        "%s %s/%s parentRefs[%d]: add 'kind: Gateway' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, i],
-    )
-}
-
-# ---- backendRefs: group must be present (may be empty string "") ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    rule := input.spec.rules[ri]
-    ref := rule.backendRefs[bi]
-    not _has_key(ref, "group")
-    msg := sprintf(
-        "%s %s/%s rules[%d].backendRefs[%d]: add 'group: \"\"' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
-    )
-}
-
-# ---- backendRefs: kind must be "Service" ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    rule := input.spec.rules[ri]
-    ref := rule.backendRefs[bi]
-    object.get(ref, "kind", null) != "Service"
-    msg := sprintf(
-        "%s %s/%s rules[%d].backendRefs[%d]: add 'kind: Service' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
-    )
-}
-
-# ---- backendRefs: weight must be present ----
-
-deny contains msg if {
-    _route_kinds[input.kind]
-    rule := input.spec.rules[ri]
-    ref := rule.backendRefs[bi]
-    not _has_key(ref, "weight")
-    msg := sprintf(
-        "%s %s/%s rules[%d].backendRefs[%d]: add 'weight: 1' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
-    )
-}
-
-# ---- Gateway certificateRefs: group must be present (may be empty string "") ----
-
-deny contains msg if {
-    input.kind == "Gateway"
-    listener := input.spec.listeners[li]
-    ref := listener.tls.certificateRefs[ci]
-    not _has_key(ref, "group")
-    msg := sprintf(
-        "Gateway %s/%s listeners[%d].tls.certificateRefs[%d]: add 'group: \"\"' — admission webhook defaults this field, causing ArgoCD OutOfSync when omitted",
-        [input.metadata.namespace, input.metadata.name, li, ci],
-    )
-}
-
-# ---- Helper: key presence check (works for null, "", and any defined value) ----
-
-_has_key(obj, key) if {
-    _ = obj[key]
-}

policy/no_ingress.rego

@@ -1,13 +0,0 @@
-package main
-
-# Deny all Kubernetes Ingress resources.
-# This cluster uses Gateway API (HTTPRoute + Gateway) for ingress routing.
-# Ingress is the legacy API and must not be added.
-
-deny contains msg if {
-    input.kind == "Ingress"
-    msg := sprintf(
-        "%s/%s: Ingress resources are forbidden — use Gateway API HTTPRoute instead",
-        [input.metadata.namespace, input.metadata.name],
-    )
-}

policy/resource_normalization.rego

@@ -1,173 +0,0 @@
-package main
-
-# Kubernetes normalizes resource quantity values on write. ArgoCD diffs by
-# string comparison, so a non-canonical value in git will always differ from
-# the live object, causing permanent OutOfSync.
-#
-# Rules enforced here:
-#   CPU integers  — k8s converts integer 1 to string "1" (see PR #163)
-#   CPU milliCPU  — k8s converts 1000m → "1", 2000m → "2", etc. (PR #164)
-#   Memory Mi→Gi  — k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc. (PR #163)
-#   clusterIP null — k8s assigns a real IP; null in git always differs
-#                    from the live assigned value (see PR #166)
-
-# ---- Container helpers ----
-# Extracts containers from Deployment/StatefulSet/DaemonSet/Job/CronJob/Pod
-
-_containers contains c if { c := input.spec.template.spec.containers[_] }
-_containers contains c if { c := input.spec.template.spec.initContainers[_] }
-_containers contains c if { c := input.spec.containers[_] }
-_containers contains c if { c := input.spec.initContainers[_] }
-_containers contains c if { c := input.spec.jobTemplate.spec.template.spec.containers[_] }
-
-# ---- CPU: must not be an integer ----
-# YAML `cpu: 1` (unquoted) parses as JSON integer; k8s stores as string "1".
-
-deny contains msg if {
-    c := _containers[_]
-    cpu := c.resources.limits.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "%s container %q: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, cpu, cpu],
-    )
-}
-
-deny contains msg if {
-    c := _containers[_]
-    cpu := c.resources.requests.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "%s container %q: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, cpu, cpu],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    cpu := input.spec.resources.limits.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, cpu, cpu],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    cpu := input.spec.resources.requests.cpu
-    is_number(cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, cpu, cpu],
-    )
-}
-
-# ---- CPU: milliCPU divisible by 1000 normalizes to a whole number ----
-# k8s converts 1000m → "1", 2000m → "2". Use the canonical whole-number form.
-
-_milli_whole(cpu) := n if {
-    is_string(cpu)
-    endswith(cpu, "m")
-    val := to_number(substring(cpu, 0, count(cpu) - 1))
-    val % 1000 == 0
-    val > 0
-    n := val / 1000
-}
-
-deny contains msg if {
-    c := _containers[_]
-    n := _milli_whole(c.resources.limits.cpu)
-    msg := sprintf(
-        "%s container %q: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.limits.cpu, n],
-    )
-}
-
-deny contains msg if {
-    c := _containers[_]
-    n := _milli_whole(c.resources.requests.cpu)
-    msg := sprintf(
-        "%s container %q: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.requests.cpu, n],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    n := _milli_whole(input.spec.resources.limits.cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.limits.cpu, n],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    n := _milli_whole(input.spec.resources.requests.cpu)
-    msg := sprintf(
-        "Cluster %s/%s: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.requests.cpu, n],
-    )
-}
-
-# ---- Memory: Mi values divisible by 1024 normalize to Gi ----
-# k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc.
-
-_mi_canonical(mem) := canonical if {
-    endswith(mem, "Mi")
-    val := to_number(substring(mem, 0, count(mem) - 2))
-    val % 1024 == 0
-    val > 0
-    canonical := sprintf("%vGi", [val / 1024])
-}
-
-deny contains msg if {
-    c := _containers[_]
-    canonical := _mi_canonical(c.resources.limits.memory)
-    msg := sprintf(
-        "%s container %q: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.limits.memory, canonical],
-    )
-}
-
-deny contains msg if {
-    c := _containers[_]
-    canonical := _mi_canonical(c.resources.requests.memory)
-    msg := sprintf(
-        "%s container %q: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.kind, c.name, c.resources.requests.memory, canonical],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    canonical := _mi_canonical(input.spec.resources.limits.memory)
-    msg := sprintf(
-        "Cluster %s/%s: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.limits.memory, canonical],
-    )
-}
-
-deny contains msg if {
-    input.kind == "Cluster"
-    canonical := _mi_canonical(input.spec.resources.requests.memory)
-    msg := sprintf(
-        "Cluster %s/%s: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name, input.spec.resources.requests.memory, canonical],
-    )
-}
-
-# ---- Service: clusterIP must not be null ----
-# k8s assigns a real IP on creation; clusterIP is immutable afterward.
-# Setting null in git means desired=null vs live=10.x.x.x → permanent OutOfSync.
-# Remove the field and let k8s own it.
-
-deny contains msg if {
-    input.kind == "Service"
-    input.spec.clusterIP == null
-    msg := sprintf(
-        "Service %s/%s has 'clusterIP: null' — remove this field; Kubernetes assigns the IP on creation and it causes ArgoCD OutOfSync",
-        [input.metadata.namespace, input.metadata.name],
-    )
-}