mailu: capture helm release and cert

.gitignore

@@ -1 +1,3 @@
-AGENTS.md
+# Ignore markdown by default, but keep top-level docs
+*.md
+!README.md

README.md

@@ -0,0 +1,3 @@
+# titan-iac
+
+Flux-managed Kubernetes cluster for bstein.dev services. See `AGENTS.md` for contributor guidance and service-specific manifests under `services/` and `infrastructure/`.

clusters/atlas/flux-system/applications/kustomization.yaml

@@ -15,3 +15,4 @@ resources:
   - sui-metrics/kustomization.yaml
   - keycloak/kustomization.yaml
   - oauth2-proxy/kustomization.yaml
+  - mailu/kustomization.yaml

clusters/atlas/flux-system/applications/mailu/kustomization.yaml

@@ -0,0 +1,18 @@
+# clusters/atlas/flux-system/applications/mailu/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mailu
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./services/mailu
+  targetNamespace: mailu-mailserver
+  prune: true
+  wait: true
+  dependsOn:
+    - name: helm

clusters/atlas/flux-system/gotk-sync.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   interval: 1m0s
   ref:
-    branch: feature/sso
+    branch: feature/mailu
   secretRef:
     name: flux-system-gitea
   url: ssh://git@scm.bstein.dev:2242/bstein/titan-iac.git

infrastructure/core/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - ../modules/base
   - ../modules/profiles/atlas-ha
   - ../sources/cert-manager/letsencrypt.yaml
+  - ../sources/cert-manager/letsencrypt-prod.yaml

infrastructure/sources/cert-manager/letsencrypt-prod.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: brad.stein@gmail.com
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik

infrastructure/sources/helm/mailu.yaml

@@ -0,0 +1,9 @@
+# infrastructure/sources/helm/mailu.yaml
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: mailu
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://mailu.github.io/helm-charts

services/mailu/certificate.yaml

@@ -0,0 +1,13 @@
+# services/mailu/certificate.yaml
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mailu-tls
+  namespace: mailu-mailserver
+spec:
+  secretName: mailu-certificates
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  dnsNames:
+    - mail.bstein.dev

services/mailu/helmrelease.yaml

@@ -0,0 +1,170 @@
+# services/mailu/helmrelease.yaml
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mailu
+  namespace: mailu-mailserver
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: mailu
+      version: 2.1.2
+      sourceRef:
+        kind: HelmRepository
+        name: mailu
+        namespace: flux-system
+  install:
+    remediation: { retries: 3 }
+  upgrade:
+    remediation: { retries: 3 }
+  values:
+    mailuVersion: "2024.06"
+    domain: bstein.dev
+    hostnames: [mail.bstein.dev]
+    domains:
+      - name: bstein.dev
+        enabled: true
+        dkim:
+          enabled: true
+    timezone: Etc/UTC
+    subnet: 10.42.0.0/16
+    existingSecret: mailu-secret
+    externalDatabase:
+      enabled: true
+      type: postgresql
+      host: postgres-service.postgres.svc.cluster.local
+      port: 5432
+      database: mailu
+      username: mailu
+      existingSecret: mailu-db-secret
+      existingSecretUsernameKey: username
+      existingSecretPasswordKey: password
+      existingSecretDatabaseKey: database
+    initialAccount:
+      enabled: true
+      username: test
+      domain: bstein.dev
+      existingSecret: mailu-initial-account-secret
+      existingSecretPasswordKey: password
+    persistence:
+      accessModes: [ReadWriteMany]
+      size: 100Gi
+      storageClass: astreae
+      single_pvc: true
+    front:
+      hostnames: [mail.bstein.dev]
+      proxied: true
+      https:
+        enabled: true
+        external: true
+        forceHttps: false
+      externalService:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        nodePorts:
+          pop3: 30010
+          pop3s: 30011
+          imap: 30143
+          imaps: 30993
+          manageSieve: 30419
+          smtp: 30025
+          smtps: 30465
+          submission: 30587
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+    admin:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+      extraEnvVars:
+        - name: FLASK_DEBUG
+          value: "1"
+        - name: ACCESSLOG
+          value: /dev/stdout
+        - name: ERRORLOG
+          value: /dev/stderr
+        - name: WEBROOT_REDIRECT
+          value: ""
+        - name: FORWARDED_ALLOW_IPS
+          value: 127.0.0.1,10.42.0.0/16
+        - name: DNS_RESOLVERS
+          value: 1.1.1.1,9.9.9.9
+    clamav:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+    dovecot:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+    oletools:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+    postfix:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+    redis:
+      enabled: true
+      architecture: standalone
+      logLevel: DEBUG
+      master:
+        nodeSelector:
+          hardware: rpi4
+        persistence:
+          enabled: true
+          accessModes: [ReadWriteMany]
+          size: 8Gi
+          storageClass: astreae
+    rspamd:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+      persistence:
+        accessModes: [ReadWriteOnce]
+        size: 8Gi
+        storageClass: astreae
+    tika:
+      logLevel: DEBUG
+      nodeSelector:
+        hardware: rpi4
+    global:
+      logLevel: DEBUG
+      storageClass: astreae
+    webmail:
+      enabled: false
+      nodeSelector:
+        hardware: rpi4
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      tls: true
+      existingSecret: mailu-certificates
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      extraRules:
+        - host: mail.bstein.dev
+          http:
+            paths:
+              - path: /
+                pathType: Prefix
+                backend:
+                  service:
+                    name: mailu-front
+                    port:
+                      number: 443
+    service:
+      ports:
+        smtp:
+          port: 25
+          targetPort: 25
+        smtps:
+          port: 465
+          targetPort: 465
+        submission:
+          port: 587
+          targetPort: 587

services/mailu/kustomization.yaml

@@ -0,0 +1,8 @@
+# services/mailu/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: mailu-mailserver
+resources:
+  - namespace.yaml
+  - helmrelease.yaml
+  - certificate.yaml

services/mailu/namespace.yaml

@@ -0,0 +1,5 @@
+# services/mailu/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mailu-mailserver