unkin-agent
0ee11a065b
The smarthost routes all mail through one rspamd: inbound that survived the edge gets the AI (LiteLLM Haiku) pass and is tagged for Stalwart's Junk filing; outbound from the lab and pods is DKIM-signed. - add rspamd (milter via ClusterIP only), ClamAV and a 3-node sentinel Valkey - tag inbound (`X-Spam`, `X-Spam-Status`, `X-Spamd-Result`), reject only viruses, tempfail when ClamAV fails - score inbound against the hop before the edge relays (`external_relay`) - DKIM-sign and skip GPT only for the smarthost's mynetworks sources - elect the highest-offset Valkey on full restart; RDB, 384mb `volatile-ttl` - read a hashed controller password (`password_hash`) Requires `password_hash` in kv `mail/default/rspamd-controller`. Reviewed-on: #542 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
62 lines
1.5 KiB
YAML
62 lines
1.5 KiB
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- clamav.yaml
|
|
- cnpg_backup.yaml
|
|
- cnpg_cluster.yaml
|
|
- namespace.yaml
|
|
- rspamd-deployment.yaml
|
|
- rspamd-sa-rules.yaml
|
|
- rspamd-valkey.yaml
|
|
- rspamd-vault.yaml
|
|
- smarthost-networkpolicy.yaml
|
|
- smarthost-pdb.yaml
|
|
- smarthost-service.yaml
|
|
- smarthost-statefulset.yaml
|
|
- stalwart-blobs-bucket.yaml
|
|
- vaultauth.yaml
|
|
|
|
configMapGenerator:
|
|
- name: rspamd-config
|
|
namespace: mail
|
|
options:
|
|
disableNameSuffixHash: true
|
|
files:
|
|
- rspamd/actions.conf
|
|
- rspamd/antivirus.conf
|
|
- rspamd/dkim_signing.conf
|
|
- rspamd/external_relay.conf
|
|
- rspamd/force_actions.conf
|
|
- rspamd/gpt.conf
|
|
- rspamd/greylist.conf
|
|
- rspamd/history_redis.conf
|
|
- rspamd/local_networks.map
|
|
- rspamd/milter_headers.conf
|
|
- rspamd/options.inc
|
|
- rspamd/redis.conf
|
|
- rspamd/settings.conf
|
|
- rspamd/spamassassin.conf
|
|
- rspamd/worker-controller.inc
|
|
- rspamd/worker-normal.inc
|
|
- rspamd/worker-proxy.inc
|
|
- name: rspamd-valkey-scripts
|
|
namespace: mail
|
|
options:
|
|
disableNameSuffixHash: true
|
|
files:
|
|
- rspamd-valkey/start.sh
|
|
- name: smarthost-config
|
|
namespace: mail
|
|
options:
|
|
disableNameSuffixHash: true
|
|
files:
|
|
- smarthost/main.cf
|
|
- smarthost/master.cf
|
|
- smarthost/relay_domains
|
|
- smarthost/transport
|
|
- smarthost/gateways.cidr
|
|
- smarthost/mynetworks.cidr
|
|
- smarthost/tls_policy
|