forked from vhaudiquet/homeprod
148 lines
6.0 KiB
YAML
148 lines
6.0 KiB
YAML
# Stalwart Mail Server - Helm values
|
|
#
|
|
# TLS for the mail listeners is sourced from cert-manager: the
|
|
# mail-vhaudiquet-fr-tls Secret (see certificate.yaml) is mounted into the pod
|
|
# and pushed to Stalwart by the chart's tls-sync sidecar over JMAP, which also
|
|
# calls ReloadTlsCertificates on every cert-manager renewal.
|
|
# Container image
|
|
image:
|
|
repository: stalwartlabs/stalwart
|
|
tag: v0.16.11
|
|
pullPolicy: IfNotPresent
|
|
# Single-node RocksDB deployment.
|
|
replicaCount: 1
|
|
role: ""
|
|
pushShard: ""
|
|
# Recovery / bootstrap administrator.
|
|
# The Secret (stalwart-recovery-admin) is required for the lifetime of the
|
|
# deployment because the tls-sync sidecar authenticates to Stalwart's JMAP API
|
|
# with these credentials on every cert-manager renewal.
|
|
recoveryAdmin:
|
|
enabled: true
|
|
username: ENC[AES256_GCM,data:W7aZNhA=,iv:d0DosYNdnmJEc3pMIEgTSl3YyUGUvdSFUxty7oGj0s8=,tag:N4U5dbxg2gU/8bDsZKHaCQ==,type:str]
|
|
password: ""
|
|
existingSecret: ENC[AES256_GCM,data:UrgIv36m86twJhcccQFl5+yDc7+8vYQ=,iv:RekqnmgiD7nmwc1PPdEjX4hBAom9dckvjfIPEFniESc=,tag:NwpbBZcG/FU4K8gRDLmESQ==,type:str]
|
|
usernameKey: username
|
|
passwordKey: password
|
|
# Recovery mode suspends mail services and exposes only the management listener.
|
|
# Ship production values with this OFF.
|
|
recoveryMode:
|
|
enabled: false
|
|
port: 8080
|
|
logLevel: info
|
|
extraEnv: {}
|
|
extraSecretEnv: {}
|
|
# The bootstrap hook Job provisions a *fresh* domain/accounts/OIDC directory.
|
|
bootstrap:
|
|
enabled: false
|
|
# cert-manager TLS integration for the mail (SMTP/IMAP/POP3 STARTTLS + implicit
|
|
# TLS) listeners. The Secret below is produced by the Certificate in
|
|
# certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
|
|
mailTls:
|
|
enabled: true
|
|
existingSecret: ENC[AES256_GCM,data:mYuo+xDaQyYhAE/3iiSj+2HEcZF1/w==,iv:8Pauul2cBj6Hu4QoSJS/LGMpofkaZOJJqJJLDjkQ8QE=,tag:yf3216LoI8DfqQDQplhlDQ==,type:str]
|
|
certKey: tls.crt
|
|
privateKeyKey: tls.key
|
|
mountPath: /etc/stalwart/tls/ingress
|
|
hostname: mail.vhaudiquet.fr
|
|
domain: vhaudiquet.fr
|
|
# How often the sidecar re-checks the mounted cert for changes.
|
|
reloadIntervalSeconds: 300
|
|
# config.json contents - ONLY the DataStore object. All other settings
|
|
# (listeners, storage backends, domains, accounts, certs) live in the database
|
|
# and are managed via JMAP/WebUI.
|
|
config:
|
|
'@type': RocksDb
|
|
path: /var/lib/stalwart
|
|
# Main Service: ClusterIP. Used by the Ingress for the management WebUI (mgmt)
|
|
# and for in-cluster access. Mail L4 ports are exposed separately via mailService.
|
|
service:
|
|
type: ClusterIP
|
|
ports:
|
|
smtp: 25
|
|
smtps: 465
|
|
submission: 587
|
|
imap: 143
|
|
imaps: 993
|
|
pop3: 110
|
|
pop3s: 995
|
|
sieve: 4190
|
|
http: 80
|
|
https: 443
|
|
mgmt: 8080
|
|
# Dedicated LoadBalancer for SMTP/IMAP/POP3/Sieve (L4). HTTP/HTTPS/mgmt are NOT
|
|
# exposed here - the WebUI is reached via the Ingress (Traefik) below.
|
|
# The WAN router NAT for 25/465/587/993/995/4190 must be repointed to this IP.
|
|
mailService:
|
|
enabled: true
|
|
name: stalwart-mail
|
|
type: LoadBalancer
|
|
loadBalancerIP: 10.2.2.5
|
|
annotations: {}
|
|
# WebUI ingress. TLS is terminated by Caddy at the edge (wildcard cert), so the
|
|
# path is: public -> Caddy (TLS) -> Traefik (HTTP) -> this Ingress -> mgmt:8080.
|
|
# No TLS block here.
|
|
ingress:
|
|
enabled: true
|
|
annotations: {}
|
|
hosts:
|
|
- host: mail.vhaudiquet.fr
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
portName: mgmt
|
|
tls: []
|
|
# Persistent volume for the RocksDB data directory.
|
|
persistence:
|
|
enabled: true
|
|
accessMode: ReadWriteOnce
|
|
storageClass: longhorn
|
|
size: 50Gi
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
# Override chart defaults to add fsGroupChangePolicy: OnRootMismatch.
|
|
# Without this, kubelet recursively chowns every file in the NFS-backed PVC
|
|
# on every pod start (15k+ RocksDB files), causing multi-minute delays.
|
|
# OnRootMismatch skips the recursive chown if the volume root already
|
|
# has the correct owner (UID 2000).
|
|
podSecurityContext:
|
|
fsGroup: 2000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
runAsUser: 2000
|
|
runAsGroup: 2000
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containerSecurityContext: {}
|
|
sops:
|
|
lastmodified: "2026-08-20T21:26:03Z"
|
|
mac: ENC[AES256_GCM,data:/Csupnf8vdHopaEP3+MOjv+99hs1muhP5mIZCNObOoEI3oxgJMNWHhi98YzSf4d/hpubTIkirryXrtK+bvdBJYydcdxd2BKPeFnVQwGdWG8VTZoW/8xWSufKOxGsJtjKtaLh5Q1b1WYsTKsfB0WF1QlEig4CWXtDTuCTncQktvo=,iv:v79M2+gzuMPE0epOCKuFs7VXnzdkeautJFp7K6PP7f0=,tag:ew9yozsxReJgyrapnQxmrg==,type:str]
|
|
pgp:
|
|
- created_at: "2026-08-20T21:26:03Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiARAAvURAKFHR8V4cEhWqXh2hhTklHH4ob4lUC5nbIQQepSlm
|
|
MgVKyOVtOb1fcyK6nIFpAFEkiUQrg3pffxv/jCKpkL+C+UecUemuL51CgD/zGGkk
|
|
LAWqpSyicSG81yx1DVNvbTOGozwbl3YvLKl2mQz4gvfHe/Lf69EHdPPPVdoJS9in
|
|
DlZ/jwSkyXX6D4l9op4fKCW3uqTXlRWUSY2aK+sYsbINeQD9u6pdfF0Tig+Gxx2u
|
|
0B+UxknMthkPEgWAjX3KQTahlu8Nbp419BRg9TTIu8frkNvo9tGXJ0cd912yBrrV
|
|
iSGq3GZ8ZLpHJoGRK/yfL1gsNRTLAFed1HPQ0P/5N19zJojf8bnm6HpMbb+2zT4X
|
|
4KugSImWtczsXPKvtysUgboXJYJCXwCVaIwQQ6Husz2W2fjwLT4aj6GoRn6hi8pL
|
|
TTDi57iMfKmbHOZsxFM47odM95u/fPfZZjZmk/51OkJD1hndrm1QrNdLR2/ZXSTk
|
|
kgblBHzPUMkkQHkGhk4HjQ82OCfKEi7S2syWtEqHQD0FKrJsZHpF8JJcO4ntyYCr
|
|
SWzFK6LHi1l4LkswrCFv+/HfQGGU3g9zYUT9c8ys0taNkHXUS0sDgLgC9esWxTuk
|
|
I0K7TEE6HhfD8CTnBiiqz2OqPyCs2ukUqK0DLrJvuQZnbL3s5Z8p4ISUYJdmecvS
|
|
XAGtE+9OR+2fHlR9DEa1oryNl/IHpm+ERSHs5PTSjsh2yyPpILln20DZxx8ry23A
|
|
ILyBwxcGVH9cSd2vH1doK8IyvNwh4bMFFbj3OOUsWBZaqqDQjJxOprumHA7P
|
|
=1Bee
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
|
version: 3.10.2
|