From 366cdafd6a0c817ead198d3f94f9058d65e4370f Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 12 Oct 2026 00:18:21 +1100
Subject: [PATCH] Add stalwart OIDC application and provider

- add config/providers_oauth2/stalwart.yaml reading its client_secret from kv/kubernetes/namespace/mail/stalwart/oauth-credentials
- add permission group akP-mail-users bound to the stalwart application
- nest akP-mail-users under akR-global-admin
---
 config/permissions/akP-mail-users.yaml |  3 +++
 config/providers_oauth2/stalwart.yaml  | 21 +++++++++++++++++++++
 config/roles/akR-global-admin.yaml     |  1 +
 3 files changed, 25 insertions(+)
 create mode 100644 config/permissions/akP-mail-users.yaml
 create mode 100644 config/providers_oauth2/stalwart.yaml

diff --git a/config/permissions/akP-mail-users.yaml b/config/permissions/akP-mail-users.yaml
new file mode 100644
index 0000000..21745b0
--- /dev/null
+++ b/config/permissions/akP-mail-users.yaml
@@ -0,0 +1,3 @@
+# Permission group akP-mail-users (name = filename). Grants mailbox access:
+# bound to the stalwart application, gating mail.unkin.net logins.
+application: stalwart
diff --git a/config/providers_oauth2/stalwart.yaml b/config/providers_oauth2/stalwart.yaml
new file mode 100644
index 0000000..29d05a3
--- /dev/null
+++ b/config/providers_oauth2/stalwart.yaml
@@ -0,0 +1,21 @@
+# OAuth2/OIDC provider + application for Stalwart (mail server, web UI/JMAP at
+# https://mail.unkin.net in the mail namespace). Stalwart's OIDC directory
+# validates access tokens (JWT, userinfo fallback) and requires aud=stalwart
+# plus the openid+email scopes; it maps preferred_username/name from profile.
+# client_secret is read from Vault (seeded out of band), never committed.
+name: stalwart
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: confidential
+client_id: stalwart
+launch_url: https://mail.unkin.net/
+client_secret_vault:
+  mount: kv
+  path: kubernetes/namespace/mail/stalwart/oauth-credentials
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  - matching_mode: strict
+    url: https://mail.unkin.net/oauth2/callback
diff --git a/config/roles/akR-global-admin.yaml b/config/roles/akR-global-admin.yaml
index d378b75..1f0b61b 100644
--- a/config/roles/akR-global-admin.yaml
+++ b/config/roles/akR-global-admin.yaml
@@ -10,6 +10,7 @@ permissions:
   - akP-traefik-admin
   - akP-logviewer-admin
   - akP-vlogs-admin
+  - akP-mail-users
   - akP-watchstate-admin
   - akP-repospawner-admin
   - akP-vault-admin