Add new infra architecture 6

2026-01-19 16:31:11 +01:00
parent b78399da2c
commit 7d6845574c
58 changed files with 2360 additions and 492 deletions
--- a/infrastructure/platform/mail/mailu-helm/configs/coredns-unbound-patch.yaml
+++ b/infrastructure/platform/mail/mailu-helm/configs/coredns-unbound-patch.yaml
@@ -0,0 +1,38 @@
+# CoreDNS ConfigMap patch to forward external DNS queries to Unbound for DNSSEC validation
+# This is required for Mailu Admin which requires DNSSEC-validating DNS resolver
+#
+# Apply with: kubectl apply -f coredns-unbound-patch.yaml
+# Then restart CoreDNS: kubectl rollout restart deployment coredns -n kube-system
+#
+# Note: The Unbound service IP (10.104.127.213) may change when the cluster is recreated.
+# The setup script will automatically update this based on the actual Unbound service IP.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+           lameduck 5s
+        }
+        ready
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+           pods insecure
+           fallthrough in-addr.arpa ip6.arpa
+           ttl 30
+        }
+        prometheus :9153
+        forward . UNBOUND_SERVICE_IP {
+           max_concurrent 1000
+        }
+        cache 30 {
+           disable success cluster.local
+           disable denial cluster.local
+        }
+        loop
+        reload
+        loadbalance
+    }
--- a/infrastructure/platform/mail/mailu-helm/configs/mailu-certificates-secret.yaml
+++ b/infrastructure/platform/mail/mailu-helm/configs/mailu-certificates-secret.yaml
@@ -0,0 +1,26 @@
+# Self-signed TLS certificate secret for Mailu Front
+# This is required by the Mailu Helm chart even when TLS is disabled (tls.flavor: notls)
+# The Front pod mounts this secret for internal certificate handling
+#
+# For production, replace with proper certificates from cert-manager or Let's Encrypt
+# This script generates a self-signed certificate valid for 365 days
+#
+# To regenerate manually:
+#   openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+#     -keyout tls.key -out tls.crt \
+#     -subj "/CN=mail.bakery-ia.local/O=bakery-ia"
+#   kubectl create secret tls mailu-certificates \
+#     --cert=tls.crt --key=tls.key -n bakery-ia
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mailu-certificates
+  namespace: bakery-ia
+  labels:
+    app.kubernetes.io/name: mailu
+    app.kubernetes.io/component: certificates
+type: kubernetes.io/tls
+data:
+  # Placeholder - will be generated dynamically by the setup script
+  tls.crt: ""
+  tls.key: ""
--- a/infrastructure/platform/mail/mailu-helm/dev/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/dev/values.yaml
@@ -1,20 +1,23 @@
 # Development-tuned Mailu configuration
 global:
-  # Use the unbound service IP - will be replaced during deployment
-  custom_dns_servers: "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  # Using Kubernetes cluster DNS for name resolution
+  # Unbound service is available at unbound-dns.bakery-ia.svc.cluster.local
+  custom_dns_servers: "10.96.0.10"  # Kubernetes cluster DNS IP
+
+# Redis configuration - use built-in Mailu Redis (no authentication needed)
+externalRedis:
+  enabled: false

 # Component-specific DNS configuration
+# Admin uses Kubernetes DNS (ClusterFirst) to resolve internal services like Redis
+# DNSSEC validation is handled at the application level by rspamd
 admin:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  dnsPolicy: "ClusterFirst"

+# RSPAMD needs Unbound for DNSSEC validation (DKIM/SPF/DMARC checks)
+# Using ClusterFirst with search domains + Kubernetes DNS which can forward to Unbound
 rspamd:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  dnsPolicy: "ClusterFirst"

 # Domain configuration for dev
 domain: "bakery-ia.local"
@@ -96,7 +99,7 @@ ingress:

 # TLS flavor for dev (may use self-signed)
 tls:
-  flavor: "cert"
+  flavor: "notls"  # Disable TLS for development

 # Welcome message (disabled in dev)
 welcomeMessage:
--- a/infrastructure/platform/mail/mailu-helm/prod/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/prod/values.yaml
@@ -1,20 +1,20 @@
 # Production-tuned Mailu configuration
 global:
-  # Use the unbound service IP - will be replaced during deployment
-  custom_dns_servers: "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  # Using Kubernetes cluster DNS for name resolution
+  custom_dns_servers: "10.96.0.10"  # Kubernetes cluster DNS IP

-# Component-specific DNS configuration
+# Redis configuration - use built-in Mailu Redis (no authentication needed for internal)
+externalRedis:
+  enabled: false
+
+# DNS configuration for production
+# Use Kubernetes DNS (ClusterFirst) which forwards to Unbound via CoreDNS
+# This is configured automatically by the mailu-helm Tilt resource
 admin:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  dnsPolicy: "ClusterFirst"

 rspamd:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  dnsPolicy: "ClusterFirst"

 # Domain configuration for production
 domain: "bakewise.ai"
--- a/infrastructure/platform/mail/mailu-helm/scripts/deploy-mailu-prod.sh
+++ b/infrastructure/platform/mail/mailu-helm/scripts/deploy-mailu-prod.sh
@@ -0,0 +1,260 @@
+#!/bin/bash
+# =============================================================================
+# Mailu Production Deployment Script
+# =============================================================================
+# This script automates the deployment of Mailu mail server for production.
+# It handles:
+#   1. Unbound DNS deployment (for DNSSEC validation)
+#   2. CoreDNS configuration (forward to Unbound)
+#   3. TLS certificate secret creation
+#   4. Mailu Helm deployment
+#   5. Admin user creation
+#
+# Usage:
+#   ./deploy-mailu-prod.sh [--domain DOMAIN] [--admin-password PASSWORD]
+#
+# Example:
+#   ./deploy-mailu-prod.sh --domain bakewise.ai --admin-password 'SecurePass123!'
+# =============================================================================
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Default values
+DOMAIN="${DOMAIN:-bakewise.ai}"
+ADMIN_PASSWORD="${ADMIN_PASSWORD:-}"
+NAMESPACE="bakery-ia"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+MAILU_HELM_DIR="$(dirname "$SCRIPT_DIR")"
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --domain)
+            DOMAIN="$2"
+            shift 2
+            ;;
+        --admin-password)
+            ADMIN_PASSWORD="$2"
+            shift 2
+            ;;
+        --help)
+            echo "Usage: $0 [--domain DOMAIN] [--admin-password PASSWORD]"
+            echo ""
+            echo "Options:"
+            echo "  --domain          Domain for Mailu (default: bakewise.ai)"
+            echo "  --admin-password  Password for admin@DOMAIN user"
+            echo ""
+            exit 0
+            ;;
+        *)
+            echo -e "${RED}Unknown option: $1${NC}"
+            exit 1
+            ;;
+    esac
+done
+
+print_step() {
+    echo -e "\n${BLUE}==>${NC} ${GREEN}$1${NC}"
+}
+
+print_warning() {
+    echo -e "${YELLOW}WARNING:${NC} $1"
+}
+
+print_error() {
+    echo -e "${RED}ERROR:${NC} $1"
+}
+
+print_success() {
+    echo -e "${GREEN}✓${NC} $1"
+}
+
+# =============================================================================
+# Step 0: Prerequisites Check
+# =============================================================================
+print_step "Step 0: Checking prerequisites..."
+
+if ! command -v kubectl &> /dev/null; then
+    print_error "kubectl not found. Please install kubectl."
+    exit 1
+fi
+
+if ! command -v helm &> /dev/null; then
+    print_error "helm not found. Please install helm."
+    exit 1
+fi
+
+if ! kubectl get namespace "$NAMESPACE" &>/dev/null; then
+    print_warning "Namespace $NAMESPACE does not exist. Creating..."
+    kubectl create namespace "$NAMESPACE"
+fi
+
+print_success "Prerequisites check passed"
+
+# =============================================================================
+# Step 1: Deploy Unbound DNS Resolver
+# =============================================================================
+print_step "Step 1: Deploying Unbound DNS resolver..."
+
+if kubectl get deployment unbound -n "$NAMESPACE" &>/dev/null; then
+    print_success "Unbound already deployed"
+else
+    helm upgrade --install unbound "$MAILU_HELM_DIR/../../networking/dns/unbound-helm" \
+        -n "$NAMESPACE" \
+        -f "$MAILU_HELM_DIR/../../networking/dns/unbound-helm/values.yaml" \
+        -f "$MAILU_HELM_DIR/../../networking/dns/unbound-helm/prod/values.yaml" \
+        --timeout 5m \
+        --wait
+
+    print_success "Unbound deployed"
+fi
+
+# Wait for Unbound to be ready
+kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=unbound -n "$NAMESPACE" --timeout=120s
+
+# Get Unbound service IP
+UNBOUND_IP=$(kubectl get svc unbound-dns -n "$NAMESPACE" -o jsonpath='{.spec.clusterIP}')
+echo "Unbound DNS service IP: $UNBOUND_IP"
+
+# =============================================================================
+# Step 2: Configure CoreDNS to Forward to Unbound
+# =============================================================================
+print_step "Step 2: Configuring CoreDNS for DNSSEC validation..."
+
+# Check current CoreDNS forward configuration
+CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' | grep -o 'forward \. [0-9.]*' | awk '{print $3}' || echo "")
+
+if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
+    echo "Updating CoreDNS to forward to Unbound ($UNBOUND_IP)..."
+
+    kubectl patch configmap coredns -n kube-system --type merge -p "{
+      \"data\": {
+        \"Corefile\": \".:53 {\\n    errors\\n    health {\\n       lameduck 5s\\n    }\\n    ready\\n    kubernetes cluster.local in-addr.arpa ip6.arpa {\\n       pods insecure\\n       fallthrough in-addr.arpa ip6.arpa\\n       ttl 30\\n    }\\n    prometheus :9153\\n    forward . $UNBOUND_IP {\\n       max_concurrent 1000\\n    }\\n    cache 30 {\\n       disable success cluster.local\\n       disable denial cluster.local\\n    }\\n    loop\\n    reload\\n    loadbalance\\n}\\n\"
+      }
+    }"
+
+    # Restart CoreDNS
+    kubectl rollout restart deployment coredns -n kube-system
+    kubectl rollout status deployment coredns -n kube-system --timeout=60s
+
+    print_success "CoreDNS configured to forward to Unbound"
+else
+    print_success "CoreDNS already configured for Unbound"
+fi
+
+# =============================================================================
+# Step 3: Create TLS Certificate Secret
+# =============================================================================
+print_step "Step 3: Creating TLS certificate secret..."
+
+if kubectl get secret mailu-certificates -n "$NAMESPACE" &>/dev/null; then
+    print_success "TLS certificate secret already exists"
+else
+    TEMP_DIR=$(mktemp -d)
+    cd "$TEMP_DIR"
+
+    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout tls.key -out tls.crt \
+        -subj "/CN=mail.$DOMAIN/O=$DOMAIN" 2>/dev/null
+
+    kubectl create secret tls mailu-certificates \
+        --cert=tls.crt \
+        --key=tls.key \
+        -n "$NAMESPACE"
+
+    rm -rf "$TEMP_DIR"
+    print_success "TLS certificate secret created"
+fi
+
+# =============================================================================
+# Step 4: Deploy Mailu via Helm
+# =============================================================================
+print_step "Step 4: Deploying Mailu via Helm..."
+
+# Add Mailu Helm repository
+helm repo add mailu https://mailu.github.io/helm-charts 2>/dev/null || true
+helm repo update mailu
+
+# Deploy Mailu
+helm upgrade --install mailu mailu/mailu \
+    -n "$NAMESPACE" \
+    -f "$MAILU_HELM_DIR/values.yaml" \
+    -f "$MAILU_HELM_DIR/prod/values.yaml" \
+    --timeout 10m
+
+print_success "Mailu Helm release deployed"
+
+# =============================================================================
+# Step 5: Wait for Pods to be Ready
+# =============================================================================
+print_step "Step 5: Waiting for Mailu pods to be ready..."
+
+echo "This may take 5-10 minutes (ClamAV takes time to initialize)..."
+
+# Wait for admin pod first (it's the key dependency)
+kubectl wait --for=condition=ready pod -l app.kubernetes.io/component=admin -n "$NAMESPACE" --timeout=300s || {
+    print_error "Admin pod failed to start. Checking logs..."
+    kubectl logs -n "$NAMESPACE" -l app.kubernetes.io/component=admin --tail=50
+    exit 1
+}
+
+print_success "Admin pod is ready"
+
+# Show pod status
+echo ""
+echo "Mailu Pod Status:"
+kubectl get pods -n "$NAMESPACE" | grep mailu
+
+# =============================================================================
+# Step 6: Create Admin User
+# =============================================================================
+print_step "Step 6: Creating admin user..."
+
+if [ -z "$ADMIN_PASSWORD" ]; then
+    # Generate a random password
+    ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d '/+=' | head -c 16)
+    echo -e "${YELLOW}Generated admin password: $ADMIN_PASSWORD${NC}"
+    echo -e "${YELLOW}Please save this password securely!${NC}"
+fi
+
+kubectl exec -n "$NAMESPACE" deployment/mailu-admin -- \
+    flask mailu admin admin "$DOMAIN" "$ADMIN_PASSWORD" 2>/dev/null || {
+    print_warning "Admin user may already exist or failed to create"
+}
+
+print_success "Admin user configured"
+
+# =============================================================================
+# Summary
+# =============================================================================
+echo ""
+echo "=============================================="
+echo -e "${GREEN}Mailu Deployment Complete!${NC}"
+echo "=============================================="
+echo ""
+echo "Admin Credentials:"
+echo "  Email:    admin@$DOMAIN"
+echo "  Password: $ADMIN_PASSWORD"
+echo ""
+echo "Access URLs (configure Ingress/DNS first):"
+echo "  Admin Panel: https://mail.$DOMAIN/admin"
+echo "  Webmail:     https://mail.$DOMAIN/webmail"
+echo "  SMTP:        mail.$DOMAIN:587 (STARTTLS)"
+echo "  IMAP:        mail.$DOMAIN:993 (SSL)"
+echo ""
+echo "Next Steps:"
+echo "  1. Configure DNS records (A, MX, SPF, DMARC)"
+echo "  2. Get DKIM key: kubectl exec -n $NAMESPACE deployment/mailu-admin -- cat /dkim/$DOMAIN.dkim.pub"
+echo "  3. Add DKIM TXT record to DNS"
+echo "  4. Configure Ingress for mail.$DOMAIN"
+echo ""
+echo "To check pod status:"
+echo "  kubectl get pods -n $NAMESPACE | grep mailu"
+echo ""
--- a/infrastructure/platform/mail/mailu-helm/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/values.yaml
@@ -3,8 +3,9 @@

 # Global DNS configuration for DNSSEC validation
 global:
-  # This will be replaced with the actual Unbound service IP during deployment
-  custom_dns_servers: "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  # Using Unbound DNS resolver directly for DNSSEC validation
+  # Unbound service is available at unbound-dns.bakery-ia.svc.cluster.local
+  custom_dns_servers: "10.104.127.213"  # Unbound service IP

 # Domain configuration
 domain: "DOMAIN_PLACEHOLDER"
@@ -25,7 +26,7 @@ postmaster: "admin"

 # TLS configuration
 tls:
-  flavor: "cert"
+  flavor: "notls"  # Disable TLS for development

 # Limits configuration
 limits:
@@ -64,24 +65,24 @@ logLevel: "INFO"
 # Network configuration
 subnet: "10.42.0.0/16"

-# Redis configuration - using external Redis (shared cluster Redis)
+# Redis configuration - using internal Redis (built-in)
 externalRedis:
-  enabled: true
-  host: "redis-service.bakery-ia.svc.cluster.local"
-  port: 6380
+  enabled: false
+  # host: "redis-service.bakery-ia.svc.cluster.local"
+  # port: 6380
  adminQuotaDbId: 15
  adminRateLimitDbId: 15
  rspamdDbId: 15

-# Database configuration - using external database
+# Database configuration - using default SQLite (built-in)
 externalDatabase:
-  enabled: true
-  type: "postgresql"
-  host: "postgres-service.bakery-ia.svc.cluster.local"
-  port: 5432
-  database: "mailu"
-  username: "mailu"
-  password: "E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT"
+  enabled: false
+  # type: "postgresql"
+  # host: "postgres-service.bakery-ia.svc.cluster.local"
+  # port: 5432
+  # database: "mailu"
+  # username: "mailu"
+  # password: "E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT"

 # Persistence configuration
 persistence:
@@ -210,16 +211,8 @@ networkPolicy:
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/component: controller

-# DNS Policy Configuration for DNSSEC validation
-# These settings ensure Mailu components use the Unbound DNS resolver
-dnsPolicy: "None"
-dnsConfig:
-  nameservers:
-    - "unbound-dns.bakery-ia.svc.cluster.local"  # Points to the Unbound service in the bakery-ia namespace
-  options:
-    - name: ndots
-      value: "5"
-    - name: timeout
-      value: "5"
-    - name: attempts
-      value: "3"
+# DNS Policy Configuration
+# Use Kubernetes DNS (ClusterFirst) for internal service resolution
+# DNSSEC validation for email is handled by rspamd component
+# Note: For production with DNSSEC needs, configure CoreDNS to forward to Unbound
+dnsPolicy: "ClusterFirst"