unkin-agent 52cfabb38f Verify smarthost edge relays against the internal CA (#548) ...

The edge MTAs present certificates from the internal Vault PKI, so the smarthost cannot verify mta1/mta2.edge.unkin.net against the system CA bundle.

- pin both edge relay TLS policies to the internal CA via `tafile=`
- mount `vault-ca-cert` into the smarthost pods and reload on change

---------

Co-authored-by: BenVincent <benvin@main.unkin.net>
Reviewed-on: #548
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-10-14 22:06:30 +11:00

..

rspamd

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

rspamd-valkey

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

smarthost

Verify smarthost edge relays against the internal CA (#548)

2026-10-14 22:06:30 +11:00

clamav.yaml

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

cnpg_backup.yaml

Add mail namespace with Stalwart backing stores (#538)

2026-10-12 00:25:41 +11:00

cnpg_cluster.yaml

Add mail namespace with Stalwart backing stores (#538)

2026-10-12 00:25:41 +11:00

gateway.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

httproute.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

kustomization.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

namespace.yaml

Add mail namespace with Stalwart backing stores (#538)

2026-10-12 00:25:41 +11:00

rspamd-deployment.yaml

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

rspamd-sa-rules.yaml

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

rspamd-valkey.yaml

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

rspamd-vault.yaml

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

smarthost-networkpolicy.yaml

Add postfix smarthost to the mail namespace (#541)

2026-10-12 22:30:47 +11:00

smarthost-pdb.yaml

Add postfix smarthost to the mail namespace (#541)

2026-10-12 22:30:47 +11:00

smarthost-service.yaml

Add postfix smarthost to the mail namespace (#541)

2026-10-12 22:30:47 +11:00

smarthost-statefulset.yaml

Verify smarthost edge relays against the internal CA (#548)

2026-10-14 22:06:30 +11:00

stalwart-apply-job.yaml

Give stalwart-apply a writable HOME (#549)

2026-10-13 21:26:50 +11:00

stalwart-apply-rbac.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

stalwart-blobs-bucket.yaml

Add mail namespace with Stalwart backing stores (#538)

2026-10-12 00:25:41 +11:00

stalwart-configmap.yaml

Add main.unkin.net as a second mail domain (#550)

2026-10-13 21:43:43 +11:00

stalwart-pdb.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

stalwart-service.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

stalwart-statefulset.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

valkey.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

vaultauth.yaml

Add rspamd, ClamAV and sentinel Valkey to the mail namespace (#542)

2026-10-12 22:36:55 +11:00

vaultstaticsecret.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00

vmpodscrape.yaml

Deploy Stalwart into the mail namespace (#539)

2026-10-13 20:58:08 +11:00