288 lines
7.3 KiB
YAML
288 lines
7.3 KiB
YAML
# services/mailu/helmrelease.yaml
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: mailu
|
|
namespace: mailu-mailserver
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: mailu
|
|
version: 2.1.2
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: mailu
|
|
namespace: flux-system
|
|
install:
|
|
remediation: { retries: 3 }
|
|
timeout: 10m
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
remediateLastFailure: true
|
|
cleanupOnFail: true
|
|
timeout: 10m
|
|
values:
|
|
mailuVersion: "2024.06"
|
|
domain: bstein.dev
|
|
hostnames: [mail.bstein.dev]
|
|
domains:
|
|
- name: bstein.dev
|
|
enabled: true
|
|
dkim:
|
|
enabled: true
|
|
externalRelay:
|
|
host: "[email-smtp.us-east-2.amazonaws.com]:587"
|
|
existingSecret: mailu-ses-relay
|
|
usernameKey: relay-username
|
|
passwordKey: relay-password
|
|
timezone: Etc/UTC
|
|
subnet: 10.42.0.0/16
|
|
existingSecret: mailu-secret
|
|
tls:
|
|
outboundLevel: encrypt
|
|
externalDatabase:
|
|
enabled: true
|
|
type: postgresql
|
|
host: postgres-service.postgres.svc.cluster.local
|
|
port: 5432
|
|
database: mailu
|
|
username: mailu
|
|
existingSecret: mailu-db-secret
|
|
existingSecretUsernameKey: username
|
|
existingSecretPasswordKey: password
|
|
existingSecretDatabaseKey: database
|
|
initialAccount:
|
|
enabled: true
|
|
username: test
|
|
domain: bstein.dev
|
|
existingSecret: mailu-initial-account-secret
|
|
existingSecretPasswordKey: password
|
|
persistence:
|
|
accessModes: [ReadWriteMany]
|
|
size: 100Gi
|
|
storageClass: astreae
|
|
single_pvc: true
|
|
front:
|
|
hostnames: [mail.bstein.dev]
|
|
proxied: true
|
|
hostPort:
|
|
enabled: false
|
|
https:
|
|
enabled: false
|
|
external: false
|
|
forceHttps: false
|
|
externalService:
|
|
enabled: true
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Cluster
|
|
ports:
|
|
submission: true
|
|
nodePorts:
|
|
pop3: 30010
|
|
pop3s: 30011
|
|
imap: 30143
|
|
imaps: 30993
|
|
manageSieve: 30419
|
|
smtp: 30025
|
|
smtps: 30465
|
|
submission: 30587
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
admin:
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
podLivenessProbe:
|
|
enabled: true
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
podReadinessProbe:
|
|
enabled: true
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
extraEnvVars:
|
|
- name: FLASK_DEBUG
|
|
value: "1"
|
|
- name: ACCESSLOG
|
|
value: /dev/stdout
|
|
- name: ERRORLOG
|
|
value: /dev/stderr
|
|
- name: WEBROOT_REDIRECT
|
|
value: ""
|
|
- name: FORWARDED_ALLOW_IPS
|
|
value: 127.0.0.1,10.42.0.0/16
|
|
- name: DNS_RESOLVERS
|
|
value: 1.1.1.1,9.9.9.9
|
|
extraVolumes:
|
|
- name: unbound-config
|
|
configMap:
|
|
name: mailu-unbound
|
|
- name: unbound-run
|
|
emptyDir: {}
|
|
extraVolumeMounts:
|
|
- name: unbound-run
|
|
mountPath: /var/lib/unbound
|
|
extraContainers:
|
|
- name: unbound
|
|
image: docker.io/alpine:3.20
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
while :; do
|
|
printf "nameserver 10.43.0.10\n" > /etc/resolv.conf
|
|
if apk add --no-cache unbound bind-tools; then
|
|
break
|
|
fi
|
|
echo "apk failed, retrying" >&2
|
|
sleep 10
|
|
done
|
|
cat >/etc/resolv.conf <<'EOF'
|
|
search mailu-mailserver.svc.cluster.local svc.cluster.local cluster.local
|
|
nameserver 127.0.0.1
|
|
EOF
|
|
unbound-anchor -a /var/lib/unbound/root.key || true
|
|
exec unbound -d -c /opt/unbound/etc/unbound/unbound.conf
|
|
ports:
|
|
- containerPort: 53
|
|
protocol: UDP
|
|
- containerPort: 53
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: unbound-config
|
|
mountPath: /opt/unbound/etc/unbound
|
|
- name: unbound-run
|
|
mountPath: /var/lib/unbound
|
|
dnsPolicy: None
|
|
dnsConfig:
|
|
nameservers:
|
|
- 127.0.0.1
|
|
searches:
|
|
- mailu-mailserver.svc.cluster.local
|
|
- svc.cluster.local
|
|
- cluster.local
|
|
clamav:
|
|
image:
|
|
repository: clamav/clamav-debian
|
|
tag: "1.4"
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi5
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 1Gi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 3Gi
|
|
livenessProbe:
|
|
enabled: false
|
|
initialDelaySeconds: 300
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
startupProbe:
|
|
enabled: false
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 20
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
enabled: false
|
|
initialDelaySeconds: 300
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 6
|
|
successThreshold: 1
|
|
dovecot:
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
oletools:
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
postfix:
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
overrides:
|
|
smtp_use_tls: "yes"
|
|
smtp_tls_security_level: "encrypt"
|
|
smtp_sasl_security_options: "noanonymous"
|
|
redis:
|
|
enabled: true
|
|
architecture: standalone
|
|
logLevel: DEBUG
|
|
image:
|
|
repository: bitnamilegacy/redis
|
|
tag: 8.0.3-debian-12-r3
|
|
master:
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
persistence:
|
|
enabled: true
|
|
accessModes: [ReadWriteMany]
|
|
size: 8Gi
|
|
storageClass: astreae
|
|
rspamd:
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
persistence:
|
|
accessModes: [ReadWriteOnce]
|
|
size: 8Gi
|
|
storageClass: astreae
|
|
tika:
|
|
logLevel: DEBUG
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
global:
|
|
logLevel: DEBUG
|
|
storageClass: astreae
|
|
webmail:
|
|
enabled: false
|
|
nodeSelector:
|
|
hardware: rpi4
|
|
ingress:
|
|
enabled: false
|
|
ingressClassName: traefik
|
|
tls: true
|
|
existingSecret: mailu-certificates
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/service.serversscheme: https
|
|
traefik.ingress.kubernetes.io/service.serverstransport: mailu-transport@kubernetescrd
|
|
extraRules:
|
|
- host: mail.bstein.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mailu-front
|
|
port:
|
|
number: 443
|
|
service:
|
|
ports:
|
|
smtp:
|
|
port: 25
|
|
targetPort: 25
|
|
smtps:
|
|
port: 465
|
|
targetPort: 465
|
|
submission:
|
|
port: 587
|
|
targetPort: 587
|