unkin-agent
82b86072ee
Stalwart is the mailbox server for the mail migration and runs multi-node from the start, so it needs a coordinator and a shared in-memory store. - run Stalwart as a 3-replica StatefulSet with a headless Service, topology spread and a PDB - add the `mail-valkey` ValkeyCluster as in-memory store and coordinator - keep data in CNPG Postgres and blobs in cephrgw S3 - converge settings from plan.ndjson in a PostSync Job, then roll the StatefulSet - add a global `spam-to-junk` Sieve script filing rspamd-tagged mail into Junk and stopping - exempt LMTP from the inbound throttles, as all inbound mail comes from the smarthost - label pods as smarthost clients and move the client LoadBalancer to 198.18.200.18 Reviewed-on: #539 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
62 lines
1.2 KiB
YAML
62 lines
1.2 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: stalwart
|
|
namespace: mail
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: stalwart
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
- name: lmtp
|
|
port: 24
|
|
targetPort: lmtp
|
|
---
|
|
# Governing Service for the StatefulSet's per-pod DNS.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: stalwart-headless
|
|
namespace: mail
|
|
spec:
|
|
clusterIP: None
|
|
selector:
|
|
app.kubernetes.io/name: stalwart
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
---
|
|
# Client-facing mail ports on the lab network. 443 is here too so the single
|
|
# internal mail.unkin.net record serves web as well as IMAP/submission.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: stalwart-lb
|
|
namespace: mail
|
|
annotations:
|
|
purelb.io/addresses: 198.18.200.18
|
|
purelb.io/service-group: common
|
|
spec:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: stalwart
|
|
ports:
|
|
- name: imaps
|
|
port: 993
|
|
targetPort: imaps
|
|
- name: submissions
|
|
port: 465
|
|
targetPort: submissions
|
|
- name: submission
|
|
port: 587
|
|
targetPort: submission
|
|
- name: https
|
|
port: 443
|
|
targetPort: https
|