fix(stalwart): pin stalwart-external LoadBalancer to 198.18.199.2

- Replace PostgreSQL in-memory store with Valkey (Redis-compatible) for
  better performance on rate limiting, distributed locks, and OAuth codes
- Add single-replica Valkey deployment with no persistence (data is transient)
- Switch liveness/readiness probes to HTTP GET /healthz/live and
  /healthz/ready on port 8080 per official Kubernetes probe documentation
- Update webadmin resource URL to use artifactapi proxy instead of direct
  GitHub download

apps/base/mailgateway/certificate.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: postfix-smtp-tls
-  namespace: mailgateway
-spec:
-  secretName: postfix-smtp-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: mail.main.unkin.net
-  dnsNames:
-    - mail.main.unkin.net
-    - smtp-in.main.unkin.net
-  privateKey:
-    size: 4096
-    algorithm: RSA

apps/base/mailgateway/httproute.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  parentRefs:
-    - name: rspamd
-      namespace: mailgateway
-  hostnames:
-    - rspamd.k8s.syd1.au.unkin.net
-  rules:
-    - backendRefs:
-        - name: rspamd
-          port: 11334

apps/base/mailgateway/kustomization.yaml

@@ -1,36 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - certificate.yaml
-  - gateway.yaml
-  - httproute.yaml
-  - namespace.yaml
-  - postfix-deployment.yaml
-  - postfix-hpa.yaml
-  - rspamd-deployment.yaml
-  - rspamd-hpa.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: postfix-config
-    files:
-      - main.cf=resources/postfix/main.cf
-      - master.cf=resources/postfix/master.cf
-    options:
-      disableNameSuffixHash: true
-  - name: postfix-maps
-    files:
-      - transport=resources/postfix/transport
-    options:
-      disableNameSuffixHash: true
-  - name: rspamd-config
-    files:
-      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
-      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
-      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
-    options:
-      disableNameSuffixHash: true

apps/base/mailgateway/postfix-deployment.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: postfix
-  namespace: mailgateway
-spec:
-  selector:
-    matchLabels:
-      app: postfix
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: postfix
-    spec:
-      initContainers:
-        - name: postmap
-          image: tozd/postfix:alpine-322
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              for f in /etc/postfix/maps/*; do
-                base=$(basename "$f")
-                cp "$f" /tmp/"$base"
-                postmap hash:/tmp/"$base"
-                cp /tmp/"${base}.db" /etc/postfix/db/
-              done
-          volumeMounts:
-            - name: postfix-maps
-              mountPath: /etc/postfix/maps
-              readOnly: true
-            - name: postfix-db
-              mountPath: /etc/postfix/db
-      containers:
-        - name: postfix
-          image: tozd/postfix:alpine-322
-          ports:
-            - containerPort: 25
-              name: smtp
-              protocol: TCP
-            - containerPort: 587
-              name: submission
-              protocol: TCP
-          env:
-            # Keep these in sync with main.cf so the tozd startup postconf calls are no-ops
-            - name: MAILNAME
-              value: "mail.main.unkin.net"
-            - name: MY_NETWORKS
-              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
-            - name: MY_DESTINATION
-              value: "localhost.localdomain, localhost"
-            - name: LOG_TO_STDOUT
-              value: "1"
-          livenessProbe:
-            tcpSocket:
-              port: 25
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            tcpSocket:
-              port: 25
-            initialDelaySeconds: 15
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: postfix-config
-              mountPath: /etc/postfix/main.cf
-              subPath: main.cf
-            - name: postfix-config
-              mountPath: /etc/postfix/master.cf
-              subPath: master.cf
-            - name: postfix-db
-              mountPath: /etc/postfix/transport.db
-              subPath: transport.db
-            - name: postfix-tls
-              mountPath: /etc/postfix/tls
-              readOnly: true
-            - name: spool
-              mountPath: /var/spool/postfix
-      volumes:
-        - name: postfix-config
-          configMap:
-            name: postfix-config
-        - name: postfix-maps
-          configMap:
-            name: postfix-maps
-        - name: postfix-db
-          emptyDir: {}
-        - name: postfix-tls
-          secret:
-            secretName: postfix-smtp-tls
-        - name: spool
-          emptyDir: {}

apps/base/mailgateway/resources/postfix/main.cf

@@ -1,46 +0,0 @@
-# Basic identity — kept in sync with MAILNAME/MY_NETWORKS/MY_DESTINATION env vars
-# so the tozd startup script's postconf calls are no-ops
-myhostname = mail.main.unkin.net
-myorigin = main.unkin.net
-mydestination = localhost.localdomain, localhost
-mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
-inet_protocols = ipv4
-inet_interfaces = all
-
-# No local delivery — we're a relay-only gateway
-local_transport = error:no local delivery
-alias_maps =
-alias_database =
-
-# Relay inbound mail for these domains to Stalwart
-relay_domains = main.unkin.net unkin.net
-transport_maps = hash:/etc/postfix/transport
-
-# rspamd milter (same namespace — short DNS name resolves)
-smtpd_milters = inet:rspamd:11332
-non_smtpd_milters = inet:rspamd:11332
-milter_default_action = accept
-milter_protocol = 6
-milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
-
-# Inbound TLS (cert from cert-manager Certificate resource)
-smtpd_use_tls = yes
-smtpd_tls_security_level = may
-smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
-smtpd_tls_key_file = /etc/postfix/tls/tls.key
-smtpd_tls_loglevel = 1
-
-# Outbound TLS (opportunistic)
-smtp_tls_security_level = may
-smtp_tls_loglevel = 1
-
-# Message size limit (50 MiB)
-message_size_limit = 52428800
-mailbox_size_limit = 0
-
-# Queue retention
-maximal_queue_lifetime = 5d
-bounce_queue_lifetime = 1d
-
-# Log to stdout for k8s log collection
-maillog_file = /dev/stdout

apps/base/mailgateway/resources/postfix/master.cf

@@ -1,42 +0,0 @@
-# ==========================================================================
-# service type  private unpriv  chroot  wakeup  maxproc command + args
-#               (yes)   (yes)   (yes)   (never) (100)
-# ==========================================================================
-
-# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
-smtp      inet  n       -       n       -       -       smtpd
-
-# Submission (port 587) — TLS required, relay from trusted mynetworks only
-submission inet n       -       n       -       -       smtpd
-  -o syslog_name=postfix/submission
-  -o smtpd_tls_security_level=encrypt
-  -o smtpd_sasl_auth_enable=no
-  -o smtpd_reject_unlisted_recipient=no
-  -o smtpd_relay_restrictions=permit_mynetworks,reject
-  -o milter_macro_daemon_name=ORIGINATING
-
-# Internal postfix processes
-pickup    unix  n       -       n       60      1       pickup
-cleanup   unix  n       -       n       -       0       cleanup
-qmgr      unix  n       -       n       300     1       qmgr
-tlsmgr    unix  -       -       n       1000?   1       tlsmgr
-rewrite   unix  -       -       n       -       -       trivial-rewrite
-bounce    unix  -       -       n       -       0       bounce
-defer     unix  -       -       n       -       0       bounce
-trace     unix  -       -       n       -       0       bounce
-verify    unix  -       -       n       -       1       verify
-flush     unix  n       -       n       1000?   0       flush
-proxymap  unix  -       -       n       -       -       proxymap
-proxywrite unix -       -       n       -       1       proxymap
-smtp      unix  -       -       n       -       -       smtp
-relay     unix  -       -       n       -       -       smtp
-showq     unix  n       -       n       -       -       showq
-error     unix  -       -       n       -       -       error
-retry     unix  -       -       n       -       -       error
-discard   unix  -       -       n       -       -       discard
-local     unix  -       n       n       -       -       local
-virtual   unix  -       n       n       -       -       virtual
-lmtp      unix  -       -       n       -       -       lmtp
-anvil     unix  -       -       n       -       1       anvil
-scache    unix  -       -       n       -       1       scache
-postlog   unix-dgram n  -       n       -       1       postlogd

apps/base/mailgateway/resources/postfix/transport

@@ -1,2 +0,0 @@
-.unkin.net        smtp:[stalwart.stalwart.svc.cluster.local]:25
-unkin.net         smtp:[stalwart.stalwart.svc.cluster.local]:25

apps/base/mailgateway/resources/rspamd/local.d/dkim_signing.conf

@@ -1,13 +0,0 @@
-enabled = true;
-selector = "mail";
-
-domain {
-    main.unkin.net {
-        privkey = "/etc/rspamd/dkim/private_key";
-        selector = "mail";
-    }
-    unkin.net {
-        privkey = "/etc/rspamd/dkim/private_key";
-        selector = "mail";
-    }
-}

apps/base/mailgateway/resources/rspamd/local.d/milter_headers.conf

@@ -1,2 +0,0 @@
-extended_spam_headers = true;
-use = ["x-spam-status", "x-spam-score", "authentication-results"];

apps/base/mailgateway/resources/rspamd/local.d/worker-proxy.inc

@@ -1,7 +0,0 @@
-milter = yes;
-bind_socket = "*:11332";
-
-upstream "local" {
-    default = yes;
-    self_scan = yes;
-}

apps/base/mailgateway/rspamd-deployment.yaml

@@ -1,75 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  selector:
-    matchLabels:
-      app: rspamd
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: rspamd
-    spec:
-      securityContext:
-        runAsUser: 11333
-        runAsGroup: 11333
-        fsGroup: 11333
-      containers:
-        - name: rspamd
-          image: rspamd/rspamd:4.0.1
-          ports:
-            - containerPort: 11332
-              name: milter
-              protocol: TCP
-            - containerPort: 11333
-              name: worker
-              protocol: TCP
-            - containerPort: 11334
-              name: controller
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 11334
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 11334
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "1"
-              memory: 512Mi
-          volumeMounts:
-            - name: rspamd-config
-              mountPath: /etc/rspamd/local.d
-              readOnly: true
-            - name: dkim-keys
-              mountPath: /etc/rspamd/dkim
-              readOnly: true
-            - name: rspamd-data
-              mountPath: /var/lib/rspamd
-      volumes:
-        - name: rspamd-config
-          configMap:
-            name: rspamd-config
-        - name: dkim-keys
-          secret:
-            secretName: dkim-keys
-        - name: rspamd-data
-          emptyDir: {}

apps/base/mailgateway/rspamd-hpa.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: rspamd-hpa
-  namespace: mailgateway
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: rspamd
-  minReplicas: 2
-  maxReplicas: 6
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 70
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 30
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 30
-          periodSeconds: 60

apps/base/mailgateway/services.yaml

@@ -1,64 +0,0 @@
----
-# Internal service for rspamd - used by postfix pods in the same namespace
-apiVersion: v1
-kind: Service
-metadata:
-  name: rspamd
-  namespace: mailgateway
-spec:
-  selector:
-    app: rspamd
-  ports:
-    - name: milter
-      port: 11332
-      targetPort: 11332
-      protocol: TCP
-    - name: worker
-      port: 11333
-      targetPort: 11333
-      protocol: TCP
-    - name: controller
-      port: 11334
-      targetPort: 11334
-      protocol: TCP
----
-# Internal ClusterIP for postfix - used by stalwart for outbound relay
-apiVersion: v1
-kind: Service
-metadata:
-  name: postfix
-  namespace: mailgateway
-spec:
-  selector:
-    app: postfix
-  ports:
-    - name: smtp
-      port: 25
-      targetPort: 25
-      protocol: TCP
-    - name: submission
-      port: 587
-      targetPort: 587
-      protocol: TCP
----
-# External LoadBalancer for inbound MX (internet → postfix)
-apiVersion: v1
-kind: Service
-metadata:
-  name: postfix-external
-  namespace: mailgateway
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: smtp-in.main.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.199.1
-    purelb.io/service-group: dmz
-    purelb.io/addresses: 198.18.199.1
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: postfix
-  ports:
-    - name: smtp
-      port: 25
-      targetPort: 25
-      protocol: TCP

apps/base/mailgateway/vaultstaticsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: dkim-keys
-  namespace: mailgateway
-spec:
-  destination:
-    create: true
-    name: dkim-keys
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/mailgateway/default/dkim-keys
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/stalwart/certificate.yaml

@@ -0,0 +1,36 @@
+---
+# TLS cert for stalwart's own HTTPS/IMAPS/STARTTLS listeners (mail.main.unkin.net)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: stalwart-tls
+  namespace: stalwart
+spec:
+  secretName: stalwart-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.main.unkin.net
+  dnsNames:
+    - mail.main.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA
+---
+# TLS cert for Traefik Gateway (internal k8s admin URL)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: stalwart-gateway-tls
+  namespace: stalwart
+spec:
+  secretName: stalwart-gateway-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.k8s.syd1.au.unkin.net
+  dnsNames:
+    - mail.k8s.syd1.au.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA

apps/base/stalwart/cnpg_cluster.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: stalwart-postgres
+  namespace: stalwart
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: stalwart
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: stalwart
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: "2"
+      memory: 2Gi
+    requests:
+      cpu: 500m
+      memory: 1Gi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 20Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/stalwart/cnpg_pooler.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: stalwart-postgres-pooler
+  namespace: stalwart
+spec:
+  cluster:
+    name: stalwart-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "50"
+      max_client_conn: "200"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw

apps/base/stalwart/gateway.yaml

@@ -1,4 +1,5 @@
 ---
+# Traefik gateway for stalwart web admin UI (separate from the LoadBalancer HTTPS port)
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -6,26 +7,26 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: mail.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/hostname: mail.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: rspamd
-  namespace: mailgateway
+  name: stalwart
+  namespace: stalwart
 spec:
   gatewayClassName: traefik-internal
   listeners:
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: rspamd.k8s.syd1.au.unkin.net
+      hostname: mail.k8s.syd1.au.unkin.net
       name: http
       port: 80
       protocol: HTTP
     - allowedRoutes:
         namespaces:
           from: Same
-      hostname: rspamd.k8s.syd1.au.unkin.net
+      hostname: mail.k8s.syd1.au.unkin.net
       name: https
       port: 443
       protocol: HTTPS
@@ -33,5 +34,5 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: rspamd-tls
+            name: stalwart-gateway-tls
         mode: Terminate

apps/base/stalwart/httproute.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  parentRefs:
+    - name: stalwart
+      namespace: stalwart
+  hostnames:
+    - mail.k8s.syd1.au.unkin.net
+  rules:
+    - backendRefs:
+        - name: stalwart
+          port: 8080

apps/base/stalwart/kustomization.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - certificate.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - services.yaml
+  - stalwart-deployment.yaml
+  - stalwart-hpa.yaml
+  - valkey.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: stalwart-config
+    files:
+      - config.toml=resources/config.toml
+    options:
+      disableNameSuffixHash: true

apps/base/stalwart/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: mailgateway
+  name: stalwart

apps/base/stalwart/resources/config.toml

@@ -0,0 +1,228 @@
+[server]
+hostname = "mail.main.unkin.net"
+greeting = "Stalwart ESMTP"
+
+# SMTP relay listener (receives from postfix for local delivery)
+[server.listener."smtp-relay"]
+bind = ["0.0.0.0:25"]
+protocol = "smtp"
+greeting = "Stalwart SMTP Relay"
+
+[server.listener."smtp-relay".proxy]
+trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+# SMTP submission listener (user-facing, TLS required)
+[server.listener."submission"]
+bind = ["0.0.0.0:587"]
+protocol = "smtp"
+greeting = "Stalwart SMTP Submission"
+tls.require = true
+
+[server.listener."submission".proxy]
+trusted-networks = ["127.0.0.0/8", "::1"]
+
+# IMAP listener
+[server.listener."imap"]
+bind = ["0.0.0.0:143"]
+protocol = "imap"
+
+[server.listener."imap".proxy]
+trusted-networks = ["127.0.0.0/8", "::1"]
+
+# IMAPS listener (implicit TLS)
+[server.listener."imaps"]
+bind = ["0.0.0.0:993"]
+protocol = "imap"
+tls.implicit = true
+
+[server.listener."imaps".proxy]
+trusted-networks = ["127.0.0.0/8", "::1"]
+
+# HTTPS (web admin + JMAP) for external LoadBalancer
+[server.listener."https"]
+bind = ["0.0.0.0:443"]
+protocol = "http"
+tls.implicit = true
+
+[server.listener."https".proxy]
+trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+# Plain HTTP for Traefik reverse proxy (TLS terminated at Traefik)
+[server.listener."http-internal"]
+bind = ["0.0.0.0:8080"]
+protocol = "http"
+
+[server.listener."http-internal".proxy]
+trusted-networks = ["127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+[server.tls]
+enable = true
+implicit = false
+certificate = "default"
+
+[server.http]
+use-x-forwarded = true
+permissive-cors = false
+
+[webadmin]
+path = "/var/lib/stalwart/webadmin"
+auto-update = true
+resource = "https://artifactapi.k8s.syd1.au.unkin.net/generic/github/stalwartlabs/webadmin/releases/latest/download/webadmin.zip"
+
+# PostgreSQL store (via CNPG pooler)
+[store."postgresql"]
+type = "postgresql"
+host = "stalwart-postgres-pooler.stalwart.svc.cluster.local"
+port = 5432
+database = "stalwart"
+user = "stalwart"
+password = "%{env:POSTGRES_PASSWORD}%"
+timeout = "15s"
+
+[store."postgresql".tls]
+enable = true
+allow-invalid-certs = false
+
+[store."postgresql".pool]
+max-connections = 10
+
+[store."postgresql".purge]
+frequency = "0 3 *"
+
+# S3/Ceph-RGW store for blobs
+[store."s3"]
+type = "s3"
+bucket = "stalwart-maildata"
+region = "syd1"
+access-key = "%{env:S3_ACCESS_KEY}%"
+secret-key = "%{env:S3_SECRET_KEY}%"
+endpoint = "https://radosgw.service.consul"
+timeout = "30s"
+key-prefix = "stalwart/"
+compression = "lz4"
+
+[store."s3".purge]
+frequency = "30 5 *"
+
+# Valkey in-memory store (rate limiting, locks, OAuth codes, greylisting)
+[store."valkey"]
+type = "redis"
+urls = ["redis://stalwart-valkey.stalwart.svc.cluster.local:6379"]
+
+# Storage assignment
+[storage]
+data = "postgresql"
+fts = "postgresql"
+blob = "s3"
+lookup = "postgresql"
+directory = "internal"
+in-memory = "valkey"
+
+# Directory configuration
+[directory.internal]
+type = "internal"
+store = "postgresql"
+
+# Fallback admin (password hash from Vault)
+[authentication.fallback-admin]
+user = "admin"
+secret = "%{env:ADMIN_PASSWORD_HASH}%"
+
+[authentication]
+[authentication.directory]
+directories = ["internal"]
+
+[authorization]
+directory = "internal"
+
+# JMAP configuration
+[jmap]
+directory = "internal"
+
+[jmap.protocol]
+request-max-size = 10485760
+get.max-objects = 500
+query.max-results = 5000
+changes.max-results = 5000
+upload.max-size = 50000000
+upload.ttl = "1h"
+
+# IMAP configuration
+[imap]
+directory = "internal"
+
+[imap.protocol]
+max-requests = 64
+
+# Inbound rate limiting
+[[queue.limiter.inbound]]
+key = ["remote_ip"]
+rate = "500/1s"
+enable = true
+
+# Outbound routing through postfix relay
+[queue]
+path = "/var/lib/stalwart/queue"
+
+[queue.schedule]
+retry = ["2s", "5s", "1m", "5m", "15m", "30m", "1h", "2h"]
+notify = ["1d", "3d"]
+expire = "5d"
+
+[session.extensions]
+future-release = "7d"
+
+# Route local domain mail locally, everything else through postfix relay
+[queue.strategy]
+route = [
+    { if = "is_local_domain('', rcpt_domain)", then = "'local'" },
+    { else = "'relay'" }
+]
+
+[queue.route."local"]
+type = "local"
+
+[queue.route."relay"]
+type = "relay"
+address = "postfix.mailgateway.svc.cluster.local"
+port = 25
+protocol = "smtp"
+
+[queue.route."relay".tls]
+implicit = false
+allow-invalid-certs = false
+
+# Session configuration
+[session.ehlo]
+reject-non-fqdn = false
+
+[session.rcpt]
+type = "internal"
+store = "postgresql"
+max-recipients = 25
+
+[session.data]
+max-messages = 10
+max-message-size = 52428800
+
+# Spam filtering offloaded to postfix/rspamd — disable internal spam filter
+[spam-filter]
+enable = false
+
+# TLS certificate (cert-manager issues to /etc/stalwart/tls/)
+[certificate."default"]
+cert = "%{file:/etc/stalwart/tls/tls.crt}%"
+private-key = "%{file:/etc/stalwart/tls/tls.key}%"
+default = true
+
+# Logging
+[tracer]
+type = "log"
+level = "info"
+ansi = false
+multiline = true
+
+# Metrics
+[metrics]
+prometheus.enable = true
+prometheus.port = 9090

apps/base/stalwart/services.yaml

@@ -0,0 +1,57 @@
+---
+# Internal service - postfix connects here to deliver inbound mail
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  selector:
+    app: stalwart
+  ports:
+    - name: smtp-relay
+      port: 25
+      targetPort: 25
+      protocol: TCP
+    - name: http-internal
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+    - name: metrics
+      port: 9090
+      targetPort: 9090
+      protocol: TCP
+---
+# External LoadBalancer for user-facing mail services
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-external
+  namespace: stalwart
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: mail.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.199.2
+    purelb.io/service-group: dmz
+    purelb.io/addresses: 198.18.199.2
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: stalwart
+  ports:
+    - name: submission
+      port: 587
+      targetPort: 587
+      protocol: TCP
+    - name: imap
+      port: 143
+      targetPort: 143
+      protocol: TCP
+    - name: imaps
+      port: 993
+      targetPort: 993
+      protocol: TCP
+    - name: https
+      port: 443
+      targetPort: 443
+      protocol: TCP

apps/base/stalwart/stalwart-deployment.yaml

@@ -0,0 +1,109 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart
+  namespace: stalwart
+spec:
+  selector:
+    matchLabels:
+      app: stalwart
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: stalwart
+    spec:
+      securityContext:
+        runAsUser: 2000
+        runAsGroup: 2000
+        fsGroup: 2000
+      containers:
+        - name: stalwart
+          image: ghcr.io/stalwartlabs/stalwart:v0.16.6
+          ports:
+            - containerPort: 25
+              name: smtp-relay
+              protocol: TCP
+            - containerPort: 587
+              name: submission
+              protocol: TCP
+            - containerPort: 143
+              name: imap
+              protocol: TCP
+            - containerPort: 993
+              name: imaps
+              protocol: TCP
+            - containerPort: 443
+              name: https
+              protocol: TCP
+            - containerPort: 8080
+              name: http-internal
+              protocol: TCP
+            - containerPort: 9090
+              name: metrics
+              protocol: TCP
+          env:
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-credentials
+                  key: password
+            - name: S3_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: access_key
+            - name: S3_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: s3-credentials
+                  key: secret_key
+            - name: ADMIN_PASSWORD_HASH
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-admin
+                  key: password_hash
+          livenessProbe:
+            httpGet:
+              path: /healthz/live
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz/ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          volumeMounts:
+            - name: config
+              mountPath: /etc/stalwart/config.toml
+              subPath: config.toml
+              readOnly: true
+            - name: tls
+              mountPath: /etc/stalwart/tls
+              readOnly: true
+            - name: data
+              mountPath: /var/lib/stalwart
+      volumes:
+        - name: config
+          configMap:
+            name: stalwart-config
+        - name: tls
+          secret:
+            secretName: stalwart-tls
+        - name: data
+          emptyDir: {}

apps/base/stalwart/stalwart-hpa.yaml

@@ -2,13 +2,13 @@
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
-  name: postfix-hpa
-  namespace: mailgateway
+  name: stalwart-hpa
+  namespace: stalwart
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
     kind: Deployment
-    name: postfix
+    name: stalwart
   minReplicas: 2
   maxReplicas: 6
   metrics:
@@ -27,7 +27,7 @@ spec:
           value: 100
           periodSeconds: 60
         - type: Pods
-          value: 4
+          value: 2
           periodSeconds: 30
     scaleDown:
       stabilizationWindowSeconds: 300

apps/base/stalwart/valkey.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart-valkey
+  namespace: stalwart
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: stalwart-valkey
+  template:
+    metadata:
+      labels:
+        app: stalwart-valkey
+    spec:
+      containers:
+        - name: valkey
+          image: valkey/valkey:8-alpine
+          args:
+            - "--save"
+            - ""
+            - "--appendonly"
+            - "no"
+          ports:
+            - containerPort: 6379
+              name: valkey
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          livenessProbe:
+            tcpSocket:
+              port: 6379
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command: ["valkey-cli", "ping"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-valkey
+  namespace: stalwart
+spec:
+  selector:
+    app: stalwart-valkey
+  ports:
+    - port: 6379
+      targetPort: 6379
+      name: valkey

apps/base/stalwart/vaultauth.yaml

@@ -3,10 +3,10 @@ apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
   name: default
-  namespace: mailgateway
+  namespace: stalwart
 spec:
   allowedNamespaces:
-    - mailgateway
+    - stalwart
   kubernetes:
     audiences:
       - vault

apps/base/stalwart/vaultstaticsecret.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: stalwart
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/stalwart/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: s3-credentials
+  namespace: stalwart
+spec:
+  destination:
+    create: true
+    name: s3-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/stalwart/default/s3-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-admin
+  namespace: stalwart
+spec:
+  destination:
+    create: true
+    name: stalwart-admin
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/stalwart/default/stalwart-admin
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/overlays/au-syd1/stalwart/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/mailgateway
+  - ../../../base/stalwart

argocd/applicationsets/platform.yaml

@@ -21,12 +21,12 @@ spec:
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
       - path: apps/overlays/*/node-feature-discovery
-      - path: apps/overlays/*/mailgateway
       - path: apps/overlays/*/puppet
       - path: apps/overlays/*/purelb
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/stalwart
       - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vault