Add new infra architecture 6

infrastructure/platform/mail/mailu-helm/dev/values.yaml

@@ -1,20 +1,23 @@
 # Development-tuned Mailu configuration
 global:
-  # Use the unbound service IP - will be replaced during deployment
-  custom_dns_servers: "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  # Using Kubernetes cluster DNS for name resolution
+  # Unbound service is available at unbound-dns.bakery-ia.svc.cluster.local
+  custom_dns_servers: "10.96.0.10"  # Kubernetes cluster DNS IP
+
+# Redis configuration - use built-in Mailu Redis (no authentication needed)
+externalRedis:
+  enabled: false
 
 # Component-specific DNS configuration
+# Admin uses Kubernetes DNS (ClusterFirst) to resolve internal services like Redis
+# DNSSEC validation is handled at the application level by rspamd
 admin:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  dnsPolicy: "ClusterFirst"
 
+# RSPAMD needs Unbound for DNSSEC validation (DKIM/SPF/DMARC checks)
+# Using ClusterFirst with search domains + Kubernetes DNS which can forward to Unbound
 rspamd:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "unbound-dns.bakery-ia.svc.cluster.local"  # Using service DNS name instead of IP
+  dnsPolicy: "ClusterFirst"
 
 # Domain configuration for dev
 domain: "bakery-ia.local"
@@ -96,7 +99,7 @@ ingress:
 
 # TLS flavor for dev (may use self-signed)
 tls:
-  flavor: "cert"
+  flavor: "notls"  # Disable TLS for development
 
 # Welcome message (disabled in dev)
 welcomeMessage: