Add new infra architecture 6

infrastructure/platform/mail/mailu-helm/configs/coredns-unbound-patch.yaml

@@ -0,0 +1,38 @@
+# CoreDNS ConfigMap patch to forward external DNS queries to Unbound for DNSSEC validation
+# This is required for Mailu Admin which requires DNSSEC-validating DNS resolver
+#
+# Apply with: kubectl apply -f coredns-unbound-patch.yaml
+# Then restart CoreDNS: kubectl rollout restart deployment coredns -n kube-system
+#
+# Note: The Unbound service IP (10.104.127.213) may change when the cluster is recreated.
+# The setup script will automatically update this based on the actual Unbound service IP.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+           lameduck 5s
+        }
+        ready
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+           pods insecure
+           fallthrough in-addr.arpa ip6.arpa
+           ttl 30
+        }
+        prometheus :9153
+        forward . UNBOUND_SERVICE_IP {
+           max_concurrent 1000
+        }
+        cache 30 {
+           disable success cluster.local
+           disable denial cluster.local
+        }
+        loop
+        reload
+        loadbalance
+    }

infrastructure/platform/mail/mailu-helm/configs/mailu-certificates-secret.yaml

@@ -0,0 +1,26 @@
+# Self-signed TLS certificate secret for Mailu Front
+# This is required by the Mailu Helm chart even when TLS is disabled (tls.flavor: notls)
+# The Front pod mounts this secret for internal certificate handling
+#
+# For production, replace with proper certificates from cert-manager or Let's Encrypt
+# This script generates a self-signed certificate valid for 365 days
+#
+# To regenerate manually:
+#   openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+#     -keyout tls.key -out tls.crt \
+#     -subj "/CN=mail.bakery-ia.local/O=bakery-ia"
+#   kubectl create secret tls mailu-certificates \
+#     --cert=tls.crt --key=tls.key -n bakery-ia
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mailu-certificates
+  namespace: bakery-ia
+  labels:
+    app.kubernetes.io/name: mailu
+    app.kubernetes.io/component: certificates
+type: kubernetes.io/tls
+data:
+  # Placeholder - will be generated dynamically by the setup script
+  tls.crt: ""
+  tls.key: ""