Add new infra architecture 3
This commit is contained in:
Urtzi Alfaro
198
infrastructure/platform/mail/mailu-helm/MIGRATION_GUIDE.md
Normal file
198
infrastructure/platform/mail/mailu-helm/MIGRATION_GUIDE.md
Normal file
@@ -0,0 +1,198 @@
|
||||
# Mailu Migration Guide: From Kustomize to Helm
|
||||
|
||||
This document outlines the migration process from the Kustomize-based Mailu deployment to the Helm-based deployment.
|
||||
|
||||
## Overview
|
||||
|
||||
The Mailu email server has been migrated from a Kustomize-based deployment to a Helm chart-based deployment. This change provides better maintainability, easier upgrades, and standardized configuration management.
|
||||
|
||||
## Key Changes
|
||||
|
||||
### 1. Service Names
|
||||
- **Old**: `mailu-smtp`, `email-smtp`, `mailu-front`, `mailu-admin`, `mailu-imap`, `mailu-antispam`
|
||||
- **New**: `mailu-postfix`, `mailu-front`, `mailu-admin`, `mailu-dovecot`, `mailu-rspamd`
|
||||
|
||||
### 2. Configuration Method
|
||||
- **Old**: Individual YAML manifests with Kustomize overlays
|
||||
- **New**: Helm chart with values files for environment-specific configuration
|
||||
|
||||
### 3. Directory Structure
|
||||
- **Old**: `infrastructure/platform/mail/mailu/{base,overlays/{dev,prod}}`
|
||||
- **New**: `infrastructure/platform/mail/mailu-helm/{dev,prod}`
|
||||
|
||||
### 4. Ingress Configuration
|
||||
- **Old**: Ingress resources created as part of the Kustomize setup
|
||||
- **New**: Built-in ingress disabled in Helm chart to work with existing ingress controller
|
||||
|
||||
## Updated Service References
|
||||
|
||||
The following configurations have been updated to use the new Helm service names:
|
||||
|
||||
## Ingress Configuration
|
||||
|
||||
The Mailu Helm chart has been configured to work with your existing ingress setup:
|
||||
|
||||
- **ingress.enabled: false**: Disables the chart's built-in Ingress creation
|
||||
- **tlsFlavorOverride: notls**: Tells Mailu's internal NGINX not to enforce TLS, as your Ingress handles TLS termination
|
||||
- **realIpHeader: X-Forwarded-For**: Ensures Mailu's NGINX logs and processes the correct client IPs from behind your Ingress
|
||||
- **realIpFrom: 0.0.0.0/0**: Trusts all proxies (restrict to your Ingress pod CIDR for security)
|
||||
|
||||
### Required Ingress Resource
|
||||
|
||||
You need to create an Ingress resource to route traffic to Mailu. Here's an example:
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: mailu-ingress
|
||||
namespace: bakery-ia # Same as Mailu's namespace
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx # Or your Ingress class
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "100m" # Allow larger email attachments
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" # For long connections
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true" # Redirect HTTP to HTTPS
|
||||
# If using Cert-Manager: cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- mail.bakery-ia.local # or mail.bakewise.ai for prod
|
||||
secretName: mail-tls-secret # Your TLS Secret
|
||||
rules:
|
||||
- host: mail.bakery-ia.local # or mail.bakewise.ai for prod
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mailu-front-http # Mailu's front service (check with kubectl get svc -n bakery-ia)
|
||||
port:
|
||||
number: 80
|
||||
```
|
||||
|
||||
Apply it: `kubectl apply -f ingress.yaml`.
|
||||
|
||||
This routes all traffic from https://mail.[domain]/ to Mailu's internal NGINX, which proxies to webmail (/webmail), admin (/admin), etc.
|
||||
|
||||
## Updated Service References
|
||||
|
||||
The following configurations have been updated to use the new Helm service names:
|
||||
|
||||
### Common ConfigMap
|
||||
- `SMTP_HOST` changed from `email-smtp.bakery-ia.svc.cluster.local` to `mailu-postfix.bakery-ia.svc.cluster.local`
|
||||
|
||||
### SigNoz Configuration
|
||||
- `signoz_smtp_host` changed from `email-smtp.bakery-ia.svc.cluster.local` to `mailu-postfix.bakery-ia.svc.cluster.local`
|
||||
- `smtp_smarthost` changed from `email-smtp.bakery-ia.svc.cluster.local:587` to `mailu-postfix.bakery-ia.svc.cluster.local:587`
|
||||
|
||||
## Deployment Process
|
||||
|
||||
### Prerequisites
|
||||
1. Helm 3.x installed
|
||||
2. Access to Kubernetes cluster
|
||||
3. Namespace `bakery-ia` exists
|
||||
|
||||
### Deployment Commands
|
||||
|
||||
#### For Development:
|
||||
```bash
|
||||
# Add Mailu Helm repository
|
||||
helm repo add mailu https://mailu.github.io/helm-charts/
|
||||
helm repo update
|
||||
|
||||
# Install Mailu for development
|
||||
helm upgrade --install mailu-dev mailu/mailu \
|
||||
--namespace bakery-ia \
|
||||
--create-namespace \
|
||||
--values infrastructure/platform/mail/mailu-helm/values.yaml \
|
||||
--values infrastructure/platform/mail/mailu-helm/dev/values.yaml
|
||||
```
|
||||
|
||||
#### For Production:
|
||||
```bash
|
||||
# Add Mailu Helm repository
|
||||
helm repo add mailu https://mailu.github.io/helm-charts/
|
||||
helm repo update
|
||||
|
||||
# Install Mailu for production
|
||||
helm upgrade --install mailu-prod mailu/mailu \
|
||||
--namespace bakery-ia \
|
||||
--create-namespace \
|
||||
--values infrastructure/platform/mail/mailu-helm/values.yaml \
|
||||
--values infrastructure/platform/mail/mailu-helm/prod/values.yaml
|
||||
```
|
||||
|
||||
## Critical Configuration Preservation
|
||||
|
||||
All critical configurations from the original Kustomize setup have been preserved:
|
||||
|
||||
- Domain and hostname settings
|
||||
- External SMTP relay configuration (Mailgun)
|
||||
- Redis integration with shared cluster
|
||||
- Database connection settings
|
||||
- TLS certificate management
|
||||
- Resource limits and requests
|
||||
- Network policies
|
||||
- Storage configuration (10Gi PVC)
|
||||
|
||||
## Rollback Procedure
|
||||
|
||||
If rollback to the Kustomize setup is needed:
|
||||
|
||||
1. Uninstall the Helm release:
|
||||
```bash
|
||||
helm uninstall mailu-dev -n bakery-ia # or mailu-prod
|
||||
```
|
||||
|
||||
2. Revert the configuration changes in `infrastructure/environments/common/configs/configmap.yaml` and `infrastructure/monitoring/signoz/signoz-values-prod.yaml`
|
||||
|
||||
3. Deploy the old Kustomize manifests:
|
||||
```bash
|
||||
kubectl apply -k infrastructure/platform/mail/mailu/overlays/dev
|
||||
# or
|
||||
kubectl apply -k infrastructure/platform/mail/mailu/overlays/prod
|
||||
```
|
||||
|
||||
## Verification Steps
|
||||
|
||||
After deployment, verify the following:
|
||||
|
||||
1. Check that all Mailu pods are running:
|
||||
```bash
|
||||
kubectl get pods -n bakery-ia | grep mailu
|
||||
```
|
||||
|
||||
2. Verify SMTP connectivity from other services:
|
||||
```bash
|
||||
# Test from a pod in the same namespace
|
||||
kubectl run test-smtp --image=curlimages/curl -n bakery-ia --rm -it -- \
|
||||
nc -zv mailu-postfix.bakery-ia.svc.cluster.local 587
|
||||
```
|
||||
|
||||
3. Check that notification service can send emails:
|
||||
```bash
|
||||
kubectl logs -n bakery-ia deployment/notification-service | grep -i smtp
|
||||
```
|
||||
|
||||
4. Verify web interface accessibility:
|
||||
```bash
|
||||
kubectl port-forward -n bakery-ia svc/mailu-front 8080:80
|
||||
# Then visit http://localhost:8080/admin
|
||||
```
|
||||
|
||||
## Known Issues
|
||||
|
||||
1. During migration, existing email data should be backed up before uninstalling the old deployment
|
||||
2. DNS records may need to be updated to point to the new service endpoints
|
||||
3. Some custom configurations may need to be reapplied after Helm installation
|
||||
|
||||
## Support
|
||||
|
||||
For issues with the new Helm-based deployment:
|
||||
|
||||
1. Check the [official Mailu Helm chart documentation](https://github.com/Mailu/helm-charts)
|
||||
2. Review Helm release status: `helm status mailu-[dev|prod] -n bakery-ia`
|
||||
3. Check pod logs: `kubectl logs -n bakery-ia deployment/[mailu-postfix|mailu-front|etc.]`
|
||||
4. Verify network connectivity between services
|
||||
171
infrastructure/platform/mail/mailu-helm/README.md
Normal file
171
infrastructure/platform/mail/mailu-helm/README.md
Normal file
@@ -0,0 +1,171 @@
|
||||
# Mailu Helm Chart for Bakery-IA
|
||||
|
||||
This directory contains the Helm chart configuration for Mailu, replacing the previous Kustomize-based setup.
|
||||
|
||||
## Overview
|
||||
|
||||
The Mailu email server is now deployed using the official Mailu Helm chart instead of Kustomize manifests. This provides better maintainability, easier upgrades, and standardized configuration. The setup is configured to work behind your existing Ingress controller (NGINX), with the internal Mailu NGINX acting as a proxy for services like webmail while your existing Ingress handles traffic routing, TLS termination, and forwarding to Mailu's internal NGINX on HTTP (port 80).
|
||||
|
||||
## Directory Structure
|
||||
|
||||
```
|
||||
mailu-helm/
|
||||
├── values.yaml # Base configuration values
|
||||
├── dev/
|
||||
│ └── values.yaml # Development-specific overrides
|
||||
├── prod/
|
||||
│ └── values.yaml # Production-specific overrides
|
||||
└── mailu-ingress.yaml # Sample ingress configuration for use with existing ingress
|
||||
```
|
||||
|
||||
## Critical Configuration Preservation
|
||||
|
||||
The following critical configurations from the original Kustomize setup have been preserved:
|
||||
|
||||
- **Domain settings**: Domain and hostnames for both dev and prod
|
||||
- **External relay**: Mailgun SMTP relay configuration
|
||||
- **Redis integration**: Connection to shared Redis cluster (database 15)
|
||||
- **Database settings**: PostgreSQL connection details
|
||||
- **Resource limits**: CPU and memory requests/limits matching original setup
|
||||
- **Network policies**: Security policies restricting access to authorized services
|
||||
- **Storage**: 10Gi persistent volume for mail data
|
||||
- **Ingress configuration**: Built-in ingress disabled to work with existing ingress
|
||||
|
||||
## Deployment
|
||||
|
||||
### Prerequisites
|
||||
|
||||
1. Helm 3.x installed
|
||||
2. Kubernetes cluster with storage provisioner
|
||||
3. Ingress controller (NGINX) - already deployed in your cluster
|
||||
4. Cert-manager for TLS certificates (optional, depends on your ingress setup)
|
||||
5. External SMTP relay account (Mailgun)
|
||||
|
||||
### Deployment Commands
|
||||
|
||||
#### For Development:
|
||||
```bash
|
||||
helm repo add mailu https://mailu.github.io/helm-charts/
|
||||
helm repo update
|
||||
helm install mailu-dev mailu/mailu \
|
||||
--namespace bakery-ia \
|
||||
--create-namespace \
|
||||
--values mailu-helm/values.yaml \
|
||||
--values mailu-helm/dev/values.yaml
|
||||
```
|
||||
|
||||
#### For Production:
|
||||
```bash
|
||||
helm repo add mailu https://mailu.github.io/helm-charts/
|
||||
helm repo update
|
||||
helm install mailu-prod mailu/mailu \
|
||||
--namespace bakery-ia \
|
||||
--create-namespace \
|
||||
--values mailu-helm/values.yaml \
|
||||
--values mailu-helm/prod/values.yaml
|
||||
```
|
||||
|
||||
### Upgrading
|
||||
|
||||
To upgrade to a newer version of the Mailu Helm chart:
|
||||
```bash
|
||||
helm repo update
|
||||
helm upgrade mailu-dev mailu/mailu \
|
||||
--namespace bakery-ia \
|
||||
--values mailu-helm/values.yaml \
|
||||
--values mailu-helm/dev/values.yaml
|
||||
```
|
||||
|
||||
## Ingress Configuration
|
||||
|
||||
The Mailu Helm chart is configured to work with your existing Ingress setup:
|
||||
|
||||
- **ingress.enabled: false**: Disables the chart's built-in Ingress creation
|
||||
- **tlsFlavorOverride: notls**: Tells Mailu's internal NGINX not to enforce TLS, as your Ingress handles TLS termination
|
||||
- **realIpHeader: X-Forwarded-For**: Ensures Mailu's NGINX logs and processes the correct client IPs from behind your Ingress
|
||||
- **realIpFrom: 0.0.0.0/0**: Trusts all proxies (restrict to your Ingress pod CIDR for security)
|
||||
|
||||
### Required Ingress Resource
|
||||
|
||||
You need to create an Ingress resource to route traffic to Mailu. Here's an example:
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: mailu-ingress
|
||||
namespace: bakery-ia # Same as Mailu's namespace
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx # Or your Ingress class
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "100m" # Allow larger email attachments
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" # For long connections
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true" # Redirect HTTP to HTTPS
|
||||
# If using Cert-Manager: cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- mail.bakery-ia.local # or mail.bakewise.ai for prod
|
||||
secretName: mail-tls-secret # Your TLS Secret
|
||||
rules:
|
||||
- host: mail.bakery-ia.local # or mail.bakewise.ai for prod
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mailu-front-http # Mailu's front service (check with kubectl get svc -n bakery-ia)
|
||||
port:
|
||||
number: 80
|
||||
```
|
||||
|
||||
Apply it: `kubectl apply -f ingress.yaml`.
|
||||
|
||||
This routes all traffic from https://mail.[domain]/ to Mailu's internal NGINX, which proxies to webmail (/webmail), admin (/admin), etc.
|
||||
|
||||
## Configuration Details
|
||||
|
||||
### Environment-Specific Values
|
||||
|
||||
- **Development** (`dev/values.yaml`):
|
||||
- Domain: `bakery-ia.local`
|
||||
- No TLS enforcement internally (handled by ingress)
|
||||
- Disabled antivirus to save resources
|
||||
- Debug logging level
|
||||
|
||||
- **Production** (`prod/values.yaml`):
|
||||
- Domain: `bakewise.ai`
|
||||
- No TLS enforcement internally (handled by ingress)
|
||||
- Enabled antivirus
|
||||
- Warning logging level
|
||||
|
||||
### Secrets Management
|
||||
|
||||
Sensitive values like passwords and API keys should be managed through Kubernetes secrets rather than being stored in the values files. The Helm chart supports referencing existing secrets for:
|
||||
|
||||
- Database passwords
|
||||
- Redis passwords
|
||||
- External relay credentials
|
||||
- Mailu secret key
|
||||
|
||||
## Integration with Notification Service
|
||||
|
||||
The notification service continues to connect to Mailu via the internal service name `mailu-postfix.bakery-ia.svc.cluster.local` on port 587 with STARTTLS.
|
||||
|
||||
## Access Information
|
||||
|
||||
- **Admin Panel**: `https://mail.[domain]/admin`
|
||||
- **Webmail**: `https://mail.[domain]/webmail`
|
||||
- **SMTP**: `mail.[domain]:587` (STARTTLS) - handled via separate TCP services if needed
|
||||
- **IMAP**: `mail.[domain]:993` (SSL/TLS) - handled via separate TCP services if needed
|
||||
|
||||
## Migration Notes
|
||||
|
||||
When migrating from the Kustomize setup to Helm:
|
||||
|
||||
1. Ensure all existing PVCs are preserved during migration
|
||||
2. Export any existing mail data before migration if needed
|
||||
3. Update any hardcoded service references in other deployments
|
||||
4. Verify that network policies still allow necessary communications
|
||||
5. Configure your existing ingress to route traffic to the Mailu services
|
||||
50
infrastructure/platform/mail/mailu-helm/dev/values.yaml
Normal file
50
infrastructure/platform/mail/mailu-helm/dev/values.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
# Dev-specific Mailu Helm values for Bakery-IA
|
||||
# Overrides base configuration for development environment
|
||||
|
||||
# Domain configuration for dev
|
||||
domain: "bakery-ia.local"
|
||||
hostnames:
|
||||
- "mail.bakery-ia.local"
|
||||
|
||||
# External relay configuration for dev
|
||||
externalRelay:
|
||||
host: "[smtp.mailgun.org]:587"
|
||||
username: "postmaster@bakery-ia.local"
|
||||
password: "mailgun-api-key-replace-in-production"
|
||||
|
||||
# Ingress configuration for dev - disabled to use with existing ingress
|
||||
ingress:
|
||||
enabled: false # Disable chart's Ingress; use existing one
|
||||
tls: false # Disable TLS in chart since ingress handles it
|
||||
tlsFlavorOverride: notls # No TLS on internal NGINX; expect external proxy to handle TLS
|
||||
realIpHeader: X-Forwarded-For # Header for client IP from your Ingress
|
||||
realIpFrom: 0.0.0.0/0 # Trust all proxies (restrict to your Ingress pod CIDR for security)
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
|
||||
# TLS flavor for dev (may use self-signed)
|
||||
tls:
|
||||
flavor: "cert"
|
||||
|
||||
# Welcome message (disabled in dev)
|
||||
welcomeMessage:
|
||||
enabled: false
|
||||
|
||||
# Log level for dev
|
||||
logLevel: "DEBUG"
|
||||
|
||||
# Network Policy for dev
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
ingressController:
|
||||
namespace: ingress-nginx
|
||||
podSelector: |
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/component: controller
|
||||
monitoring:
|
||||
namespace: monitoring
|
||||
podSelector: |
|
||||
matchLabels:
|
||||
app: signoz-prometheus
|
||||
28
infrastructure/platform/mail/mailu-helm/mailu-ingress.yaml
Normal file
28
infrastructure/platform/mail/mailu-helm/mailu-ingress.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: mailu-ingress
|
||||
namespace: bakery-ia # Same as Mailu's namespace
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx # Or your Ingress class
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "100m" # Allow larger email attachments
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" # For long connections
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true" # Redirect HTTP to HTTPS
|
||||
# If using Cert-Manager: cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- mail.bakery-ia.local # or mail.bakewise.ai for prod
|
||||
secretName: mail-tls-secret # Your TLS Secret
|
||||
rules:
|
||||
- host: mail.bakery-ia.local # or mail.bakewise.ai for prod
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mailu-front-http # Mailu's front service (check with kubectl get svc -n bakery-ia)
|
||||
port:
|
||||
number: 80
|
||||
57
infrastructure/platform/mail/mailu-helm/prod/values.yaml
Normal file
57
infrastructure/platform/mail/mailu-helm/prod/values.yaml
Normal file
@@ -0,0 +1,57 @@
|
||||
# Production-specific Mailu Helm values for Bakery-IA
|
||||
# Overrides base configuration for production environment
|
||||
|
||||
# Domain configuration for production
|
||||
domain: "bakewise.ai"
|
||||
hostnames:
|
||||
- "mail.bakewise.ai"
|
||||
|
||||
# External relay configuration for production
|
||||
externalRelay:
|
||||
host: "[smtp.mailgun.org]:587"
|
||||
username: "postmaster@bakewise.ai"
|
||||
password: "PRODUCTION_MAILGUN_API_KEY" # This should be set via secret
|
||||
|
||||
# Ingress configuration for production - disabled to use with existing ingress
|
||||
ingress:
|
||||
enabled: false # Disable chart's Ingress; use existing one
|
||||
tls: false # Disable TLS in chart since ingress handles it
|
||||
tlsFlavorOverride: notls # No TLS on internal NGINX; expect external proxy to handle TLS
|
||||
realIpHeader: X-Forwarded-For # Header for client IP from your Ingress
|
||||
realIpFrom: 0.0.0.0/0 # Trust all proxies (restrict to your Ingress pod CIDR for security)
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
|
||||
# TLS flavor for production (uses Let's Encrypt)
|
||||
tls:
|
||||
flavor: "cert"
|
||||
|
||||
# Welcome message (enabled in production)
|
||||
welcomeMessage:
|
||||
enabled: true
|
||||
subject: "Welcome to Bakewise.ai Email Service"
|
||||
body: "Welcome to our email service. Please change your password and update your profile."
|
||||
|
||||
# Log level for production
|
||||
logLevel: "WARNING"
|
||||
|
||||
# Enable antivirus in production
|
||||
antivirus:
|
||||
enabled: true
|
||||
flavor: "clamav"
|
||||
|
||||
# Network Policy for production
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
ingressController:
|
||||
namespace: ingress-nginx
|
||||
podSelector: |
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/component: controller
|
||||
monitoring:
|
||||
namespace: monitoring
|
||||
podSelector: |
|
||||
matchLabels:
|
||||
app: signoz-prometheus
|
||||
206
infrastructure/platform/mail/mailu-helm/values.yaml
Normal file
206
infrastructure/platform/mail/mailu-helm/values.yaml
Normal file
@@ -0,0 +1,206 @@
|
||||
# Base Mailu Helm values for Bakery-IA
|
||||
# Preserves critical configurations from the original Kustomize setup
|
||||
|
||||
# Domain configuration
|
||||
domain: "DOMAIN_PLACEHOLDER"
|
||||
hostnames:
|
||||
- "mail.DOMAIN_PLACEHOLDER"
|
||||
|
||||
# Mailu version to match the original setup
|
||||
mailuVersion: "2024.06"
|
||||
|
||||
# Secret key for authentication cookies
|
||||
secretKey: "cb61b934d47029a64117c0e4110c93f66bbcf5eaa15c84c42727fad78f7"
|
||||
|
||||
# Timezone
|
||||
timezone: "Etc/UTC"
|
||||
|
||||
# Postmaster configuration
|
||||
postmaster: "admin"
|
||||
|
||||
# TLS configuration
|
||||
tls:
|
||||
flavor: "cert"
|
||||
|
||||
# Limits configuration
|
||||
limits:
|
||||
messageSizeLimitInMegabytes: 50
|
||||
authRatelimit:
|
||||
ip: "60/hour"
|
||||
user: "100/day"
|
||||
messageRatelimit:
|
||||
value: "200/day"
|
||||
|
||||
# External relay configuration (Mailgun)
|
||||
externalRelay:
|
||||
host: "[smtp.mailgun.org]:587"
|
||||
username: "postmaster@DOMAIN_PLACEHOLDER"
|
||||
password: "mailgun-api-key-replace-in-production"
|
||||
|
||||
# Webmail configuration
|
||||
webmail:
|
||||
enabled: true
|
||||
flavor: "roundcube"
|
||||
|
||||
# Antivirus and antispam configuration
|
||||
antivirus:
|
||||
enabled: false # Disabled in dev to save resources
|
||||
antispam:
|
||||
enabled: true
|
||||
flavor: "rspamd"
|
||||
|
||||
# Welcome message
|
||||
welcomeMessage:
|
||||
enabled: false # Disabled during development
|
||||
|
||||
# Logging
|
||||
logLevel: "INFO"
|
||||
|
||||
# Network configuration
|
||||
subnet: "10.42.0.0/16"
|
||||
|
||||
# Redis configuration - using external Redis (shared cluster Redis)
|
||||
externalRedis:
|
||||
enabled: true
|
||||
host: "redis-service.bakery-ia.svc.cluster.local"
|
||||
port: 6380
|
||||
adminQuotaDbId: 15
|
||||
adminRateLimitDbId: 15
|
||||
rspamdDbId: 15
|
||||
|
||||
# Database configuration - using external database
|
||||
externalDatabase:
|
||||
enabled: true
|
||||
type: "postgresql"
|
||||
host: "postgres-service.bakery-ia.svc.cluster.local"
|
||||
port: 5432
|
||||
database: "mailu"
|
||||
username: "mailu"
|
||||
password: "E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT"
|
||||
|
||||
# Persistence configuration
|
||||
persistence:
|
||||
single_pvc: true
|
||||
size: 10Gi
|
||||
storageClass: ""
|
||||
accessModes: [ReadWriteOnce]
|
||||
|
||||
# Ingress configuration - disabled to use with existing ingress
|
||||
ingress:
|
||||
enabled: false # Disable chart's Ingress; use existing one
|
||||
tls: false # Disable TLS in chart since ingress handles it
|
||||
tlsFlavorOverride: notls # No TLS on internal NGINX; expect external proxy to handle TLS
|
||||
realIpHeader: X-Forwarded-For # Header for client IP from your Ingress
|
||||
realIpFrom: 0.0.0.0/0 # Trust all proxies (restrict to your Ingress pod CIDR for security)
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
|
||||
# Optional: Enable PROXY protocol for mail protocols if your Ingress supports TCP proxying
|
||||
proxyProtocol:
|
||||
smtp: false
|
||||
smtps: false
|
||||
submission: false
|
||||
imap: false
|
||||
imaps: false
|
||||
pop3: false
|
||||
pop3s: false
|
||||
manageSieve: false
|
||||
|
||||
# Front configuration
|
||||
front:
|
||||
image:
|
||||
tag: "2024.06"
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
http: 80
|
||||
https: 443
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
|
||||
# Admin configuration
|
||||
admin:
|
||||
image:
|
||||
tag: "2024.06"
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
|
||||
# Postfix configuration
|
||||
postfix:
|
||||
image:
|
||||
tag: "2024.06"
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
smtp: 25
|
||||
submission: 587
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
|
||||
# Dovecot configuration
|
||||
dovecot:
|
||||
image:
|
||||
tag: "2024.06"
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
imap: 143
|
||||
imaps: 993
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
|
||||
# Rspamd configuration
|
||||
rspamd:
|
||||
image:
|
||||
tag: "2024.06"
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
rspamd: 11333
|
||||
rspamd-admin: 11334
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
|
||||
# Network Policy
|
||||
networkPolicy:
|
||||
enabled: true
|
||||
ingressController:
|
||||
namespace: ingress-nginx
|
||||
podSelector: |
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/component: controller
|
||||
@@ -1,289 +0,0 @@
|
||||
# Mailu Email Infrastructure for Bakery-IA
|
||||
|
||||
This directory contains the Kubernetes deployment configuration for Mailu, a self-hosted email solution that integrates with external SMTP relays for optimal deliverability.
|
||||
|
||||
## Architecture Overview
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────────────────┐
|
||||
│ Kubernetes Cluster (bakery-ia) │
|
||||
├─────────────────────────────────────────────────────────────────────────────┤
|
||||
│ │
|
||||
│ ┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │
|
||||
│ │ notification- │ │ mail-service │ │ frontend │ │
|
||||
│ │ service │─────▶│ (new/optional) │ │ │ │
|
||||
│ │ │ │ Queue & Routing │ │ │ │
|
||||
│ └────────┬─────────┘ └────────┬─────────┘ └──────────────────┘ │
|
||||
│ │ │ │
|
||||
│ │ SMTP (port 587) │ SMTP (port 587) │
|
||||
│ ▼ ▼ │
|
||||
│ ┌──────────────────────────────────────────────────────────────────────┐ │
|
||||
│ │ MAILU STACK │ │
|
||||
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │
|
||||
│ │ │ front │ │ admin │ │ smtp │ │ imap │ │ │
|
||||
│ │ │ (nginx) │ │ (webmail) │ │ (postfix) │ │ (dovecot) │ │ │
|
||||
│ │ │ :80/:443 │ │ :8080 │ │ :25/:587 │ │ :993/:143 │ │ │
|
||||
│ │ └─────────────┘ └─────────────┘ └──────┬──────┘ └─────────────┘ │ │
|
||||
│ │ │ │ │
|
||||
│ │ ┌─────────────┐ ┌─────────────┐ │ Relay │ │
|
||||
│ │ │ antispam │ │ antivirus │ │ │ │
|
||||
│ │ │ (rspamd) │ │ (clamav) │ │ │ │
|
||||
│ │ └─────────────┘ └─────────────┘ │ │ │
|
||||
│ │ │ │ │
|
||||
│ │ ┌─────────────────────────────────┐ │ │ │
|
||||
│ │ │ mailu-db (redis) │ │ │ │
|
||||
│ │ └─────────────────────────────────┘ │ │ │
|
||||
│ └───────────────────────────────────────────┼──────────────────────────┘ │
|
||||
│ │ │
|
||||
└──────────────────────────────────────────────┼───────────────────────────────┘
|
||||
│
|
||||
▼
|
||||
┌──────────────────────────────────────┐
|
||||
│ EXTERNAL SMTP RELAY │
|
||||
│ (SendGrid / Mailgun / AWS SES) │
|
||||
│ │
|
||||
│ • Handles IP reputation │
|
||||
│ • Manages deliverability │
|
||||
│ • Provides bounce/complaint hooks │
|
||||
└──────────────────────────────────────┘
|
||||
│
|
||||
▼
|
||||
┌──────────────────────────────────────┐
|
||||
│ INTERNET / RECIPIENTS │
|
||||
└──────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## Components
|
||||
|
||||
### Core Services
|
||||
|
||||
- **mailu-front**: Nginx reverse proxy for web access (ports 80/443)
|
||||
- **mailu-admin**: Web administration interface (port 80)
|
||||
- **mailu-smtp**: Postfix SMTP server (ports 25/587)
|
||||
- **mailu-imap**: Dovecot IMAP server (ports 143/993)
|
||||
- **mailu-antispam**: Rspamd spam filtering (ports 11333/11334)
|
||||
- **mailu-redis**: Redis for session management (port 6379)
|
||||
|
||||
### Storage
|
||||
|
||||
- **mailu-data**: 10Gi PVC for mail storage
|
||||
- **mailu-db**: 5Gi PVC for database
|
||||
- **mailu-redis**: 1Gi PVC for Redis persistence
|
||||
|
||||
## Configuration
|
||||
|
||||
### Environment Variables
|
||||
|
||||
The Mailu stack is configured via the `mailu-configmap.yaml` file:
|
||||
|
||||
- **DOMAIN**: `bakewise.ai`
|
||||
- **HOSTNAMES**: `mail.bakewise.ai`
|
||||
- **RELAYHOST**: `smtp.mailgun.org:587`
|
||||
- **RELAY_LOGIN**: `apikey`
|
||||
- **TLS_FLAVOR**: `cert` (uses Let's Encrypt)
|
||||
- **WEBMAIL**: `roundcube`
|
||||
- **ANTIVIRUS**: `clamav`
|
||||
- **ANTISPAM**: `rspamd`
|
||||
|
||||
### Secrets
|
||||
|
||||
Secrets are managed in `mailu-secrets.yaml`:
|
||||
|
||||
- **ADMIN_PASSWORD**: Base64 encoded admin password
|
||||
- **SECRET_KEY**: Mailu internal encryption key
|
||||
- **RELAY_PASSWORD**: External SMTP relay API key
|
||||
- **DB_PASSWORD**: Database password
|
||||
- **REDIS_PASSWORD**: Redis password
|
||||
|
||||
## Deployment
|
||||
|
||||
### Prerequisites
|
||||
|
||||
1. Kubernetes cluster with storage provisioner
|
||||
2. Ingress controller (NGINX)
|
||||
3. Cert-manager for TLS certificates
|
||||
4. External SMTP relay account (Mailgun, SendGrid, AWS SES)
|
||||
|
||||
### Deployment Steps
|
||||
|
||||
1. **Configure DNS**:
|
||||
```bash
|
||||
# MX record for inbound email
|
||||
bakewise.ai. IN MX 10 mail.bakewise.ai.
|
||||
|
||||
# A record for mail server
|
||||
mail.bakewise.ai. IN A <your-ingress-ip>
|
||||
|
||||
# SPF record (authorize external relay)
|
||||
bakewise.ai. IN TXT "v=spf1 include:mailgun.org ~all"
|
||||
|
||||
# DKIM record (Mailu generates this)
|
||||
mailu._domainkey.bakewise.ai. IN TXT "v=DKIM1; k=rsa; p=<public-key>"
|
||||
|
||||
# DMARC record
|
||||
_dmarc.bakewise.ai. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@bakewise.ai"
|
||||
```
|
||||
|
||||
2. **Update secrets**:
|
||||
```bash
|
||||
# Generate secure passwords
|
||||
echo -n "your-secure-password" | base64
|
||||
openssl rand -base64 32
|
||||
|
||||
# Update mailu-secrets.yaml with real values
|
||||
```
|
||||
|
||||
3. **Deploy Mailu**:
|
||||
```bash
|
||||
# For production
|
||||
kubectl apply -k infrastructure/environments/prod/k8s-manifests/
|
||||
|
||||
# For development
|
||||
kubectl apply -k infrastructure/environments/dev/k8s-manifests/
|
||||
```
|
||||
|
||||
4. **Verify deployment**:
|
||||
```bash
|
||||
kubectl get pods -n bakery-ia | grep mailu
|
||||
kubectl logs -f mailu-smtp-<pod-id> -n bakery-ia
|
||||
```
|
||||
|
||||
## Integration with Notification Service
|
||||
|
||||
The notification service has been updated to use Mailu as the SMTP server:
|
||||
|
||||
```yaml
|
||||
# infrastructure/environments/common/configs/configmap.yaml
|
||||
SMTP_HOST: "mailu-smtp.bakery-ia.svc.cluster.local"
|
||||
SMTP_PORT: "587"
|
||||
SMTP_TLS: "true"
|
||||
SMTP_SSL: "false"
|
||||
```
|
||||
|
||||
## Accessing Mailu
|
||||
|
||||
### Web Interface
|
||||
|
||||
- **Admin Panel**: `https://mail.bakewise.ai/admin`
|
||||
- **Webmail**: `https://mail.bakewise.ai/webmail`
|
||||
|
||||
### SMTP Configuration
|
||||
|
||||
For external clients to send email through Mailu:
|
||||
|
||||
- **Server**: `mail.bakewise.ai`
|
||||
- **Port**: 587 (Submission)
|
||||
- **Security**: STARTTLS
|
||||
- **Authentication**: Required
|
||||
|
||||
### IMAP Configuration
|
||||
|
||||
For email clients to access mailboxes:
|
||||
|
||||
- **Server**: `mail.bakewise.ai`
|
||||
- **Port**: 993 (IMAPS)
|
||||
- **Security**: SSL/TLS
|
||||
- **Authentication**: Required
|
||||
|
||||
## Monitoring and Maintenance
|
||||
|
||||
### Health Checks
|
||||
|
||||
```bash
|
||||
# Check Mailu services
|
||||
kubectl get pods -n bakery-ia -l app=mailu
|
||||
|
||||
# Check Mailu logs
|
||||
kubectl logs -f mailu-smtp-<pod-id> -n bakery-ia
|
||||
kubectl logs -f mailu-antispam-<pod-id> -n bakery-ia
|
||||
|
||||
# Check queue status
|
||||
kubectl exec -it mailu-smtp-<pod-id> -n bakery-ia -- mailq
|
||||
```
|
||||
|
||||
### Backup and Restore
|
||||
|
||||
```bash
|
||||
# Backup mail data
|
||||
kubectl exec -it mailu-smtp-<pod-id> -n bakery-ia -- tar czf /backup/mailu-backup-$(date +%Y%m%d).tar.gz /data
|
||||
|
||||
# Restore mail data
|
||||
kubectl cp mailu-backup-<date>.tar.gz mailu-smtp-<pod-id>:/backup/ -n bakery-ia
|
||||
kubectl exec -it mailu-smtp-<pod-id> -n bakery-ia -- tar xzf /backup/mailu-backup-<date>.tar.gz -C /
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
1. **SMTP Relay Authentication Failed**:
|
||||
- Verify `RELAY_PASSWORD` in secrets matches your external relay API key
|
||||
- Check network connectivity to external relay
|
||||
|
||||
2. **TLS Certificate Issues**:
|
||||
- Ensure cert-manager is working properly
|
||||
- Check DNS records are correctly pointing to your ingress
|
||||
|
||||
3. **Email Delivery Delays**:
|
||||
- Check Mailu queue: `kubectl exec -it mailu-smtp-<pod-id> -n bakery-ia -- mailq`
|
||||
- Verify external relay service status
|
||||
|
||||
4. **Spam Filtering Issues**:
|
||||
- Check rspamd logs: `kubectl logs -f mailu-antispam-<pod-id> -n bakery-ia`
|
||||
- Adjust spam scoring in rspamd configuration
|
||||
|
||||
## Resource Requirements
|
||||
|
||||
| Component | CPU Request | CPU Limit | Memory Request | Memory Limit | Storage |
|
||||
|-----------|-------------|-----------|----------------|--------------|----------|
|
||||
| mailu-front | 100m | 200m | 128Mi | 256Mi | - |
|
||||
| mailu-admin | 100m | 300m | 256Mi | 512Mi | - |
|
||||
| mailu-smtp | 100m | 500m | 256Mi | 512Mi | 10Gi |
|
||||
| mailu-imap | 100m | 500m | 256Mi | 512Mi | - |
|
||||
| mailu-antispam | 200m | 1000m | 512Mi | 1Gi | - |
|
||||
| mailu-redis | 100m | 200m | 128Mi | 256Mi | 1Gi |
|
||||
|
||||
**Total**: ~600m CPU, ~1.7Gi Memory, 16Gi Storage
|
||||
|
||||
## Security Considerations
|
||||
|
||||
1. **Network Policies**: Mailu is protected by network policies that restrict access to only the notification service and ingress controller.
|
||||
|
||||
2. **TLS Encryption**: All external connections use TLS encryption.
|
||||
|
||||
3. **Authentication**: All services require authentication.
|
||||
|
||||
4. **Rate Limiting**: Configured to prevent abuse (60/hour per IP, 100/day per user).
|
||||
|
||||
5. **Spam Protection**: Rspamd provides comprehensive spam filtering with DKIM signing.
|
||||
|
||||
## Migration from External SMTP
|
||||
|
||||
To migrate from external SMTP (Gmail) to Mailu:
|
||||
|
||||
1. Update DNS records as shown above
|
||||
2. Deploy Mailu stack
|
||||
3. Update notification service configuration
|
||||
4. Test email delivery
|
||||
5. Monitor deliverability metrics
|
||||
6. Gradually increase email volume
|
||||
|
||||
## External Relay Provider Comparison
|
||||
|
||||
| Provider | Pros | Cons | Free Tier |
|
||||
|----------|------|------|-----------|
|
||||
| SendGrid | Best deliverability, robust API | Expensive at scale | 100/day |
|
||||
| Mailgun | Developer-friendly, good logs | EU data residency costs extra | 5,000/month (3 months) |
|
||||
| AWS SES | Cheapest at scale ($0.10/1000) | Requires warm-up period | 62,000/month (from EC2) |
|
||||
| Postmark | Transactional focus, fast | No marketing emails | 100/month |
|
||||
|
||||
**Recommendation**: AWS SES for cost-effectiveness and Kubernetes integration.
|
||||
|
||||
## Support
|
||||
|
||||
For issues with Mailu deployment:
|
||||
|
||||
1. Check the [Mailu documentation](https://mailu.io/)
|
||||
2. Review Kubernetes events: `kubectl get events -n bakery-ia`
|
||||
3. Check pod logs for specific components
|
||||
4. Verify network connectivity and DNS resolution
|
||||
@@ -1,265 +0,0 @@
|
||||
# Webmail DNS Configuration Guide
|
||||
|
||||
This guide provides the DNS configuration required to make the webmail system accessible from `webmail.bakewise.ai`.
|
||||
|
||||
## Production DNS Configuration
|
||||
|
||||
### Required DNS Records for `webmail.bakewise.ai`
|
||||
|
||||
```bash
|
||||
# A Record for webmail subdomain
|
||||
webmail.bakewise.ai. IN A <your-ingress-ip>
|
||||
|
||||
# CNAME Record (alternative approach)
|
||||
webmail.bakewise.ai. IN CNAME bakewise.ai.
|
||||
|
||||
# MX Record for email delivery (if receiving emails)
|
||||
bakewise.ai. IN MX 10 webmail.bakewise.ai.
|
||||
|
||||
# SPF Record (authorize webmail server)
|
||||
bakewise.ai. IN TXT "v=spf1 include:mailgun.org ~all"
|
||||
|
||||
# DKIM Record (will be generated by Mailu)
|
||||
mailu._domainkey.bakewise.ai. IN TXT "v=DKIM1; k=rsa; p=<public-key>"
|
||||
|
||||
# DMARC Record
|
||||
_dmarc.bakewise.ai. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@bakewise.ai"
|
||||
```
|
||||
|
||||
## Development DNS Configuration
|
||||
|
||||
### Required DNS Records for `webmail.bakery-ia.local`
|
||||
|
||||
For local development, add these entries to your `/etc/hosts` file:
|
||||
|
||||
```bash
|
||||
# Add to /etc/hosts
|
||||
127.0.0.1 webmail.bakery-ia.local
|
||||
127.0.0.1 bakery-ia.local
|
||||
127.0.0.1 monitoring.bakery-ia.local
|
||||
```
|
||||
|
||||
## TLS Certificate Configuration
|
||||
|
||||
The ingress configuration includes automatic TLS certificate provisioning using cert-manager with Let's Encrypt.
|
||||
|
||||
### Production TLS Configuration
|
||||
|
||||
The production ingress (`prod-ingress.yaml`) includes:
|
||||
|
||||
```yaml
|
||||
tls:
|
||||
- hosts:
|
||||
- bakewise.ai
|
||||
- monitoring.bakewise.ai
|
||||
- webmail.bakewise.ai # ← Added webmail domain
|
||||
secretName: bakery-ia-prod-tls-cert
|
||||
```
|
||||
|
||||
### Development TLS Configuration
|
||||
|
||||
The development ingress (`dev-ingress.yaml`) includes:
|
||||
|
||||
```yaml
|
||||
tls:
|
||||
- hosts:
|
||||
- localhost
|
||||
- bakery-ia.local
|
||||
- monitoring.bakery-ia.local
|
||||
- webmail.bakery-ia.local # ← Added webmail domain
|
||||
secretName: bakery-dev-tls-cert
|
||||
```
|
||||
|
||||
## Ingress Routing Configuration
|
||||
|
||||
### Production Routing
|
||||
|
||||
The production ingress routes traffic as follows:
|
||||
|
||||
- `https://bakewise.ai/` → Frontend service (port 3000)
|
||||
- `https://bakewise.ai/api/` → Gateway service (port 8000)
|
||||
- `https://monitoring.bakewise.ai/` → SigNoz monitoring (port 8080)
|
||||
- `https://webmail.bakewise.ai/` → Email webmail (port 80)
|
||||
- `https://webmail.bakewise.ai/webmail` → Email webmail
|
||||
- `https://webmail.bakewise.ai/admin` → Email admin interface
|
||||
|
||||
### Development Routing
|
||||
|
||||
The development ingress routes traffic as follows:
|
||||
|
||||
- `https://localhost/` → Frontend service (port 3000)
|
||||
- `https://localhost/api/` → Gateway service (port 8000)
|
||||
- `https://bakery-ia.local/` → Frontend service (port 3000)
|
||||
- `https://bakery-ia.local/api/` → Gateway service (port 8000)
|
||||
- `https://monitoring.bakery-ia.local/` → SigNoz monitoring (port 8080)
|
||||
- `https://webmail.bakery-ia.local/` → Email webmail (port 80)
|
||||
- `https://webmail.bakery-ia.local/webmail` → Email webmail
|
||||
- `https://webmail.bakery-ia.local/admin` → Email admin interface
|
||||
|
||||
## Security Headers
|
||||
|
||||
The webmail ingress includes enhanced security headers:
|
||||
|
||||
```nginx
|
||||
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';
|
||||
style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';
|
||||
connect-src 'self'; frame-src 'self';
|
||||
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
|
||||
```
|
||||
|
||||
## Deployment Steps
|
||||
|
||||
### 1. Update DNS Records
|
||||
|
||||
```bash
|
||||
# For production (using Cloudflare as example)
|
||||
cfcli dns create bakewise.ai A webmail <ingress-ip> --ttl 3600 --proxied
|
||||
|
||||
# For development (add to /etc/hosts)
|
||||
echo "127.0.0.1 webmail.bakery-ia.local" | sudo tee -a /etc/hosts
|
||||
```
|
||||
|
||||
### 2. Apply Ingress Configuration
|
||||
|
||||
```bash
|
||||
# Apply the updated ingress configuration
|
||||
kubectl apply -k infrastructure/environments/prod/k8s-manifests/
|
||||
|
||||
# Verify the ingress is configured correctly
|
||||
kubectl get ingress -n bakery-ia
|
||||
kubectl describe ingress bakery-ingress-prod -n bakery-ia
|
||||
```
|
||||
|
||||
### 3. Verify TLS Certificates
|
||||
|
||||
```bash
|
||||
# Check TLS certificate status
|
||||
kubectl get certificaterequest -n bakery-ia
|
||||
kubectl get certificate -n bakery-ia
|
||||
|
||||
# Check certificate details
|
||||
kubectl describe certificate bakery-ia-prod-tls-cert -n bakery-ia
|
||||
```
|
||||
|
||||
### 4. Test Webmail Access
|
||||
|
||||
```bash
|
||||
# Test webmail accessibility
|
||||
curl -I https://webmail.bakewise.ai
|
||||
curl -I https://webmail.bakewise.ai/webmail
|
||||
curl -I https://webmail.bakewise.ai/admin
|
||||
|
||||
# Test from browser
|
||||
open https://webmail.bakewise.ai
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### DNS Issues
|
||||
|
||||
```bash
|
||||
# Check DNS resolution
|
||||
dig webmail.bakewise.ai
|
||||
nslookup webmail.bakewise.ai
|
||||
|
||||
# Check ingress controller logs
|
||||
kubectl logs -f -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx
|
||||
```
|
||||
|
||||
### TLS Issues
|
||||
|
||||
```bash
|
||||
# Check cert-manager logs
|
||||
kubectl logs -f -n cert-manager -l app=cert-manager
|
||||
|
||||
# Check certificate status
|
||||
kubectl get certificaterequest,certificate,order,challenge -n bakery-ia
|
||||
```
|
||||
|
||||
### Ingress Issues
|
||||
|
||||
```bash
|
||||
# Check ingress controller events
|
||||
kubectl get events -n ingress-nginx
|
||||
|
||||
# Check ingress description
|
||||
kubectl describe ingress -n bakery-ia
|
||||
```
|
||||
|
||||
## Monitoring and Maintenance
|
||||
|
||||
### Check Webmail Service Status
|
||||
|
||||
```bash
|
||||
# Check email services
|
||||
kubectl get pods -n bakery-ia -l app=email
|
||||
|
||||
# Check webmail service
|
||||
kubectl get service email-webmail -n bakery-ia
|
||||
|
||||
# Check ingress routing
|
||||
kubectl get ingress -n bakery-ia -o yaml | grep -A 10 webmail
|
||||
```
|
||||
|
||||
### Update DNS Records
|
||||
|
||||
When the ingress IP changes, update the DNS records:
|
||||
|
||||
```bash
|
||||
# Get current ingress IP
|
||||
kubectl get service -n ingress-nginx ingress-nginx-controller -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
|
||||
|
||||
# Update DNS (Cloudflare example)
|
||||
cfcli dns update bakewise.ai A webmail <new-ip> --ttl 3600 --proxied
|
||||
```
|
||||
|
||||
## Access Information
|
||||
|
||||
After configuration, the webmail system will be accessible at:
|
||||
|
||||
- **Production**: `https://webmail.bakewise.ai`
|
||||
- **Development**: `https://webmail.bakery-ia.local`
|
||||
|
||||
Default credentials (configured in secrets):
|
||||
- **Admin**: `admin@bakewise.ai`
|
||||
- **Password**: Configured in `email-secrets`
|
||||
|
||||
## Integration with Existing Systems
|
||||
|
||||
The webmail system integrates with:
|
||||
|
||||
1. **SMTP Service**: `email-smtp.bakery-ia.svc.cluster.local:587`
|
||||
2. **IMAP Service**: `email-imap.bakery-ia.svc.cluster.local:993`
|
||||
3. **Notification Service**: Uses the new SMTP service for email notifications
|
||||
4. **Monitoring**: SigNoz alerts use the new email service
|
||||
|
||||
## Backup and Recovery
|
||||
|
||||
### DNS Backup
|
||||
|
||||
```bash
|
||||
# Export DNS records (Cloudflare example)
|
||||
cfcli dns export bakewise.ai > dns-backup.json
|
||||
|
||||
# Restore DNS records
|
||||
cfcli dns import bakewise.ai dns-backup.json
|
||||
```
|
||||
|
||||
### Certificate Backup
|
||||
|
||||
```bash
|
||||
# Export TLS secrets
|
||||
kubectl get secret bakery-ia-prod-tls-cert -n bakery-ia -o yaml > tls-backup.yaml
|
||||
|
||||
# Restore TLS secrets
|
||||
kubectl apply -f tls-backup.yaml
|
||||
```
|
||||
|
||||
## References
|
||||
|
||||
- [Cert-manager Documentation](https://cert-manager.io/docs/)
|
||||
- [NGINX Ingress Controller](https://kubernetes.github.io/ingress-nginx/)
|
||||
- [Let's Encrypt](https://letsencrypt.org/)
|
||||
- [DNS Configuration Best Practices](https://www.cloudflare.com/learning/dns/)
|
||||
|
||||
This configuration provides a secure, scalable webmail solution that integrates seamlessly with the existing Bakery-IA infrastructure.
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: bakery-ia
|
||||
|
||||
resources:
|
||||
- mailu-configmap.yaml
|
||||
- mailu-secrets.yaml
|
||||
- mailu-pvc.yaml
|
||||
- mailu-deployment.yaml
|
||||
- mailu-services.yaml
|
||||
- mailu-antispam.yaml
|
||||
- mailu-networkpolicy.yaml
|
||||
- mailu-nginx-config.yaml
|
||||
|
||||
labels:
|
||||
- includeSelectors: true
|
||||
pairs:
|
||||
app: mailu
|
||||
platform: mail
|
||||
managed-by: kustomize
|
||||
@@ -1,48 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-antispam
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
spec:
|
||||
containers:
|
||||
- name: antispam
|
||||
image: ghcr.io/mailu/rspamd:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 11333
|
||||
name: rspamd
|
||||
- containerPort: 11334
|
||||
name: rspamd-admin
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
@@ -1,79 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mailu-config
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: config
|
||||
data:
|
||||
# Domain configuration
|
||||
DOMAIN: "DOMAIN_PLACEHOLDER"
|
||||
HOSTNAMES: "mail.DOMAIN_PLACEHOLDER"
|
||||
POSTMASTER: "admin"
|
||||
|
||||
# Kubernetes-specific settings
|
||||
# These help Mailu components discover each other in K8s
|
||||
FRONT_ADDRESS: "mailu-front.bakery-ia.svc.cluster.local"
|
||||
ADMIN_ADDRESS: "mailu-admin.bakery-ia.svc.cluster.local"
|
||||
SMTP_ADDRESS: "mailu-smtp.bakery-ia.svc.cluster.local"
|
||||
IMAP_ADDRESS: "mailu-imap.bakery-ia.svc.cluster.local"
|
||||
ANTISPAM_ADDRESS: "mailu-antispam.bakery-ia.svc.cluster.local"
|
||||
|
||||
# Redis Configuration - Using shared cluster Redis (database 15 reserved for Mailu)
|
||||
# The shared Redis has 16 databases (0-15), Mailu uses db 15 for isolation
|
||||
# Using plain TCP port 6380 for internal cluster communication (TLS on 6379 for external)
|
||||
# Primary configuration: Redis URL is configured in mailu-secrets.yaml as REDIS_URL
|
||||
# Format: redis://:password@host:port/db
|
||||
# Fallback configuration: REDIS_ADDRESS, REDIS_DB, and REDIS_PW
|
||||
REDIS_ADDRESS: "redis-service.bakery-ia.svc.cluster.local:6380"
|
||||
REDIS_DB: "15"
|
||||
# REDIS_PW is set from secrets for Redis authentication
|
||||
|
||||
# External SMTP Relay Configuration
|
||||
# Mailu relays outbound emails through an external service for better deliverability
|
||||
# Supported providers: Mailgun, SendGrid, AWS SES, Postmark
|
||||
#
|
||||
# Provider RELAYHOST examples:
|
||||
# Mailgun: [smtp.mailgun.org]:587
|
||||
# SendGrid: [smtp.sendgrid.net]:587
|
||||
# AWS SES: [email-smtp.us-east-1.amazonaws.com]:587
|
||||
# Postmark: [smtp.postmarkapp.com]:587
|
||||
#
|
||||
# IMPORTANT: Update RELAY_PASSWORD in mailu-secrets.yaml with your provider's API key
|
||||
RELAYHOST: "[smtp.mailgun.org]:587"
|
||||
RELAY_LOGIN: "postmaster@DOMAIN_PLACEHOLDER"
|
||||
|
||||
# Security settings
|
||||
TLS_FLAVOR: "cert"
|
||||
AUTH_RATELIMIT_IP: "60/hour"
|
||||
AUTH_RATELIMIT_USER: "100/day"
|
||||
|
||||
# Message limits
|
||||
MESSAGE_SIZE_LIMIT: "52428800" # 50MB
|
||||
MESSAGE_RATELIMIT: "200/day"
|
||||
|
||||
# Features - disable ClamAV in dev to save resources (enable in prod)
|
||||
WEBMAIL: "roundcube"
|
||||
ANTIVIRUS: "none"
|
||||
ANTISPAM: "rspamd"
|
||||
|
||||
# Postfix configuration
|
||||
POSTFIX_MESSAGE_SIZE_LIMIT: "52428800"
|
||||
POSTFIX_QUEUE_MINIMUM: "1"
|
||||
POSTFIX_QUEUE_LIFETIME: "7d"
|
||||
|
||||
# DKIM configuration
|
||||
DKIM_SELECTOR: "mailu"
|
||||
DKIM_KEY_LENGTH: "2048"
|
||||
|
||||
# Webmail settings
|
||||
WEB_WEBMAIL: "/webmail"
|
||||
WEB_ADMIN: "/admin"
|
||||
WEBMAIL_ADMIN: "admin@DOMAIN_PLACEHOLDER"
|
||||
|
||||
# Logging
|
||||
LOG_LEVEL: "INFO"
|
||||
|
||||
# Disable welcome email during development
|
||||
WELCOME: "false"
|
||||
@@ -1,218 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-front
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: front
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: front
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: front
|
||||
spec:
|
||||
containers:
|
||||
- name: front
|
||||
image: ghcr.io/mailu/nginx:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
- containerPort: 443
|
||||
name: https
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
- name: mailu-tls
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: nginx-config
|
||||
mountPath: /overrides/ingress-fix.conf
|
||||
subPath: ingress-fix.conf
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
- name: mailu-tls
|
||||
secret:
|
||||
# TLS secret name is environment-specific:
|
||||
# - Dev: bakery-dev-tls-cert (self-signed, from dev-certificate.yaml)
|
||||
# - Prod: bakery-ia-prod-tls-cert (Let's Encrypt, from prod-certificate.yaml)
|
||||
# Patched via kustomize overlays in dev/prod kustomization.yaml
|
||||
secretName: MAILU_TLS_SECRET_PLACEHOLDER
|
||||
items:
|
||||
- key: tls.crt
|
||||
path: cert.pem
|
||||
- key: tls.key
|
||||
path: key.pem
|
||||
- name: nginx-config
|
||||
configMap:
|
||||
name: mailu-nginx-config
|
||||
items:
|
||||
- key: ingress-fix.conf
|
||||
path: ingress-fix.conf
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-admin
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: admin
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: admin
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: admin
|
||||
spec:
|
||||
containers:
|
||||
- name: admin
|
||||
image: ghcr.io/mailu/admin:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-smtp
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
containers:
|
||||
- name: smtp
|
||||
image: ghcr.io/mailu/postfix:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 25
|
||||
name: smtp
|
||||
- containerPort: 587
|
||||
name: submission
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-imap
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: imap
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: imap
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: imap
|
||||
spec:
|
||||
containers:
|
||||
- name: imap
|
||||
image: ghcr.io/mailu/dovecot:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 143
|
||||
name: imap
|
||||
- containerPort: 993
|
||||
name: imaps
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
@@ -1,93 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: mailu-network-policy
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: network-policy
|
||||
spec:
|
||||
# Apply to all Mailu pods (matches mailu-deployment.yaml labels)
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
# Allow SMTP from notification-service
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: notification-service
|
||||
ports:
|
||||
- port: 25
|
||||
- port: 587
|
||||
# Allow SMTP from other internal services that may need to send email
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: bakery-ia
|
||||
ports:
|
||||
- port: 587
|
||||
# Allow webmail/admin access via ingress controller
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: ingress-nginx
|
||||
ports:
|
||||
- port: 80
|
||||
- port: 443
|
||||
# Allow internal Mailu component communication
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
ports:
|
||||
- port: 25
|
||||
- port: 587
|
||||
- port: 143
|
||||
- port: 993
|
||||
- port: 80
|
||||
- port: 11333
|
||||
- port: 11334
|
||||
egress:
|
||||
# Allow relay to external SMTP (Mailgun)
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
except:
|
||||
- 10.0.0.0/8
|
||||
- 172.16.0.0/12
|
||||
- 192.168.0.0/16
|
||||
ports:
|
||||
- port: 587
|
||||
- port: 465
|
||||
- port: 25
|
||||
# Allow internal Mailu component communication
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
ports:
|
||||
- port: 25
|
||||
- port: 587
|
||||
- port: 143
|
||||
- port: 993
|
||||
- port: 80
|
||||
- port: 11333
|
||||
- port: 11334
|
||||
# Allow connection to shared Redis (database 15)
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: redis
|
||||
ports:
|
||||
- port: 6379
|
||||
# Allow DNS lookups
|
||||
- to: []
|
||||
ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
@@ -1,31 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mailu-nginx-config
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: nginx-config
|
||||
data:
|
||||
# Custom Nginx configuration to prevent redirect loops when behind ingress
|
||||
# This file is mounted as /overrides/ingress-fix.conf in the Mailu frontend container
|
||||
ingress-fix.conf: |
|
||||
# Override the default HTTP to HTTPS redirect behavior
|
||||
# When behind ingress controller, we should trust X-Forwarded-Proto header
|
||||
# and avoid redirect loops
|
||||
|
||||
# Disable the HTTP to HTTPS redirect by overriding the redirect condition
|
||||
# This prevents the redirect loop by setting the proxy protocol to https
|
||||
set $proxy_x_forwarded_proto "https";
|
||||
|
||||
# Override the map directive to always return https when behind ingress
|
||||
map "" $proxy_x_forwarded_proto {
|
||||
default "https";
|
||||
}
|
||||
|
||||
# Trust the X-Forwarded-* headers from the ingress controller
|
||||
set_real_ip_from 10.0.0.0/8;
|
||||
set_real_ip_from 172.16.0.0/12;
|
||||
set_real_ip_from 192.168.0.0/16;
|
||||
real_ip_header X-Forwarded-For;
|
||||
real_ip_recursive on;
|
||||
@@ -1,21 +0,0 @@
|
||||
# Mailu data storage - shared across all Mailu components
|
||||
# Contains: mail data, SQLite database, DKIM keys, SSL certificates, queue
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mailu-data
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: storage
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
# NOTE: Change storageClassName based on your cluster's storage provisioner
|
||||
# For local development (kind): standard
|
||||
# For AWS EKS: gp2 or gp3
|
||||
# For GKE: standard or premium-rwo
|
||||
# For AKS: managed-premium or managed-csi
|
||||
@@ -1,37 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mailu-secrets
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: secrets
|
||||
type: Opaque
|
||||
data:
|
||||
# Admin credentials (base64 encoded)
|
||||
# IMPORTANT: Replace with real credentials before production deployment
|
||||
# Generate with: openssl rand -base64 24 | tr -d '\n' | base64
|
||||
ADMIN_PASSWORD: "VzJYS2tSdUxpT25ZS2RCWVFTQXJvbjFpeWtFU1M1b2I=" # W2XKkRuLiOnYKdBYQSAron1iykESS5ob
|
||||
|
||||
# Mailu secret key for internal encryption
|
||||
# Generate with: openssl rand -base64 32
|
||||
SECRET_KEY: "Y2I2MWI5MzRkNDcwMjlhNjQxMTdjMGU0MTEwYzkzZjY2YmJjZjVlYWExNWM4NGM0MjcyN2ZhZDc4Zjc=" # cb61b934d47029a64117c0e4110c93f66bbcf5eaa15c84c42727fad78f7
|
||||
|
||||
# External SMTP relay credentials (Mailgun)
|
||||
# For Mailgun: use postmaster@domain as username
|
||||
RELAY_USER: "cG9zdG1hc3RlckBET01BSU5fUExBQ0VIT0xERVI=" # postmaster@DOMAIN_PLACEHOLDER
|
||||
RELAY_PASSWORD: "bWFpbGd1bi1hcGkta2V5LXJlcGxhY2UtaW4tcHJvZHVjdGlvbg==" # mailgun-api-key-replace-in-production
|
||||
|
||||
# Database credentials
|
||||
DB_PASSWORD: "RThLejQ3WW1WekRsSEdzMU05d0FiSnp4Y0tuR09OQ1Q=" # E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT
|
||||
|
||||
# Dovecot admin password (moved from ConfigMap for security)
|
||||
DOVEADM_PASSWORD: "WnZhMzNoaVBJc2ZtV3RxUlBWV29taTRYZ2xLTlZPcHY=" # Zva33hiPIsfmWtqRPVWomi4XglKNVOpv
|
||||
|
||||
# Redis password - same as shared cluster Redis (redis-secrets)
|
||||
# Mailu uses database 15 for isolation from other services
|
||||
# REDIS_PW is required by Mailu for Redis authentication
|
||||
REDIS_PASSWORD: "SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0E=" # J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A
|
||||
REDIS_PW: "SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0E=" # J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A
|
||||
# Redis URL for Mailu - using plain TCP port 6380 for internal cluster communication
|
||||
REDIS_URL: "cmVkaXM6Ly86SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0FAcmVkaXMtc2VydmljZS5iYWtlcnktaWEuc3ZjLmNsdXN0ZXIubG9jYWw6NjM4MC8xNQ==" # redis://:J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A@redis-service.bakery-ia.svc.cluster.local:6380/15
|
||||
@@ -1,126 +0,0 @@
|
||||
# Mailu Services - Routes traffic to Mailu stack components
|
||||
# All services use app: mailu selectors to match mailu-deployment.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-front
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: front
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: front
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: 443
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-admin
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: admin
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: admin
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
# Primary SMTP service - used by notification-service and other internal services
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-smtp
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: smtp
|
||||
ports:
|
||||
- name: smtp
|
||||
port: 25
|
||||
targetPort: 25
|
||||
- name: submission
|
||||
port: 587
|
||||
targetPort: 587
|
||||
---
|
||||
# Alias for backwards compatibility with services expecting 'email-smtp'
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: email-smtp
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: smtp
|
||||
ports:
|
||||
- name: smtp
|
||||
port: 25
|
||||
targetPort: 25
|
||||
- name: submission
|
||||
port: 587
|
||||
targetPort: 587
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-imap
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: imap
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: imap
|
||||
ports:
|
||||
- name: imap
|
||||
port: 143
|
||||
targetPort: 143
|
||||
- name: imaps
|
||||
port: 993
|
||||
targetPort: 993
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-antispam
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: antispam
|
||||
ports:
|
||||
- name: rspamd
|
||||
port: 11333
|
||||
targetPort: 11333
|
||||
- name: rspamd-admin
|
||||
port: 11334
|
||||
targetPort: 11334
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: bakery-ia
|
||||
|
||||
resources:
|
||||
- mailu-configmap.yaml
|
||||
- mailu-secrets.yaml
|
||||
- mailu-pvc.yaml
|
||||
- mailu-deployment.yaml
|
||||
- mailu-services.yaml
|
||||
- mailu-antispam.yaml
|
||||
- mailu-networkpolicy.yaml
|
||||
# NOTE: mailu-ingress.yaml removed - ingress is now centralized in platform/networking
|
||||
# NOTE: mailu-replacement.yaml removed - using official Mailu stack
|
||||
# NOTE: email-config.yaml removed - configuration consolidated into mailu-configmap.yaml
|
||||
# NOTE: Network policy kept here for self-contained module (could be moved to global security)
|
||||
# NOTE: Mailu uses shared Redis (redis-service) with database 15 - no separate Redis needed
|
||||
|
||||
labels:
|
||||
- includeSelectors: true
|
||||
pairs:
|
||||
app: mailu
|
||||
platform: mail
|
||||
managed-by: kustomize
|
||||
@@ -1,48 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-antispam
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
spec:
|
||||
containers:
|
||||
- name: antispam
|
||||
image: ghcr.io/mailu/rspamd:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 11333
|
||||
name: rspamd
|
||||
- containerPort: 11334
|
||||
name: rspamd-admin
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
@@ -1,79 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mailu-config
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: config
|
||||
data:
|
||||
# Domain configuration
|
||||
DOMAIN: "bakewise.ai"
|
||||
HOSTNAMES: "mail.bakewise.ai"
|
||||
POSTMASTER: "admin"
|
||||
|
||||
# Kubernetes-specific settings
|
||||
# These help Mailu components discover each other in K8s
|
||||
FRONT_ADDRESS: "mailu-front.bakery-ia.svc.cluster.local"
|
||||
ADMIN_ADDRESS: "mailu-admin.bakery-ia.svc.cluster.local"
|
||||
SMTP_ADDRESS: "mailu-smtp.bakery-ia.svc.cluster.local"
|
||||
IMAP_ADDRESS: "mailu-imap.bakery-ia.svc.cluster.local"
|
||||
ANTISPAM_ADDRESS: "mailu-antispam.bakery-ia.svc.cluster.local"
|
||||
|
||||
# Redis Configuration - Using shared cluster Redis (database 15 reserved for Mailu)
|
||||
# The shared Redis has 16 databases (0-15), Mailu uses db 15 for isolation
|
||||
# Using plain TCP port 6380 for internal cluster communication (TLS on 6379 for external)
|
||||
# Primary configuration: Redis URL is configured in mailu-secrets.yaml as REDIS_URL
|
||||
# Format: redis://:password@host:port/db
|
||||
# Fallback configuration: REDIS_ADDRESS, REDIS_DB, and REDIS_PW
|
||||
REDIS_ADDRESS: "redis-service.bakery-ia.svc.cluster.local:6380"
|
||||
REDIS_DB: "15"
|
||||
# REDIS_PW is set from secrets for Redis authentication
|
||||
|
||||
# External SMTP Relay Configuration
|
||||
# Mailu relays outbound emails through an external service for better deliverability
|
||||
# Supported providers: Mailgun, SendGrid, AWS SES, Postmark
|
||||
#
|
||||
# Provider RELAYHOST examples:
|
||||
# Mailgun: [smtp.mailgun.org]:587
|
||||
# SendGrid: [smtp.sendgrid.net]:587
|
||||
# AWS SES: [email-smtp.us-east-1.amazonaws.com]:587
|
||||
# Postmark: [smtp.postmarkapp.com]:587
|
||||
#
|
||||
# IMPORTANT: Update RELAY_PASSWORD in mailu-secrets.yaml with your provider's API key
|
||||
RELAYHOST: "[smtp.mailgun.org]:587"
|
||||
RELAY_LOGIN: "postmaster@bakewise.ai"
|
||||
|
||||
# Security settings
|
||||
TLS_FLAVOR: "cert"
|
||||
AUTH_RATELIMIT_IP: "60/hour"
|
||||
AUTH_RATELIMIT_USER: "100/day"
|
||||
|
||||
# Message limits
|
||||
MESSAGE_SIZE_LIMIT: "52428800" # 50MB
|
||||
MESSAGE_RATELIMIT: "200/day"
|
||||
|
||||
# Features - disable ClamAV in dev to save resources (enable in prod)
|
||||
WEBMAIL: "roundcube"
|
||||
ANTIVIRUS: "none"
|
||||
ANTISPAM: "rspamd"
|
||||
|
||||
# Postfix configuration
|
||||
POSTFIX_MESSAGE_SIZE_LIMIT: "52428800"
|
||||
POSTFIX_QUEUE_MINIMUM: "1"
|
||||
POSTFIX_QUEUE_LIFETIME: "7d"
|
||||
|
||||
# DKIM configuration
|
||||
DKIM_SELECTOR: "mailu"
|
||||
DKIM_KEY_LENGTH: "2048"
|
||||
|
||||
# Webmail settings
|
||||
WEB_WEBMAIL: "/webmail"
|
||||
WEB_ADMIN: "/admin"
|
||||
WEBMAIL_ADMIN: "admin@bakewise.ai"
|
||||
|
||||
# Logging
|
||||
LOG_LEVEL: "INFO"
|
||||
|
||||
# Disable welcome email during development
|
||||
WELCOME: "false"
|
||||
@@ -1,208 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-front
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: front
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: front
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: front
|
||||
spec:
|
||||
containers:
|
||||
- name: front
|
||||
image: ghcr.io/mailu/nginx:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
- containerPort: 443
|
||||
name: https
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
- name: mailu-tls
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
- name: mailu-tls
|
||||
secret:
|
||||
# TLS secret name is environment-specific:
|
||||
# - Dev: bakery-dev-tls-cert (self-signed, from dev-certificate.yaml)
|
||||
# - Prod: bakery-ia-prod-tls-cert (Let's Encrypt, from prod-certificate.yaml)
|
||||
# Patched via kustomize overlays in dev/prod kustomization.yaml
|
||||
secretName: MAILU_TLS_SECRET_PLACEHOLDER
|
||||
items:
|
||||
- key: tls.crt
|
||||
path: cert.pem
|
||||
- key: tls.key
|
||||
path: key.pem
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-admin
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: admin
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: admin
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: admin
|
||||
spec:
|
||||
containers:
|
||||
- name: admin
|
||||
image: ghcr.io/mailu/admin:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-smtp
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
containers:
|
||||
- name: smtp
|
||||
image: ghcr.io/mailu/postfix:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 25
|
||||
name: smtp
|
||||
- containerPort: 587
|
||||
name: submission
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-imap
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: imap
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
component: imap
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu
|
||||
component: imap
|
||||
spec:
|
||||
containers:
|
||||
- name: imap
|
||||
image: ghcr.io/mailu/dovecot:2024.06
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 143
|
||||
name: imap
|
||||
- containerPort: 993
|
||||
name: imaps
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
- secretRef:
|
||||
name: mailu-secrets
|
||||
volumeMounts:
|
||||
- name: mailu-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: mailu-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mailu-data
|
||||
@@ -1,93 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: mailu-network-policy
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: network-policy
|
||||
spec:
|
||||
# Apply to all Mailu pods (matches mailu-deployment.yaml labels)
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
# Allow SMTP from notification-service
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: notification-service
|
||||
ports:
|
||||
- port: 25
|
||||
- port: 587
|
||||
# Allow SMTP from other internal services that may need to send email
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: bakery-ia
|
||||
ports:
|
||||
- port: 587
|
||||
# Allow webmail/admin access via ingress controller
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: ingress-nginx
|
||||
ports:
|
||||
- port: 80
|
||||
- port: 443
|
||||
# Allow internal Mailu component communication
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
ports:
|
||||
- port: 25
|
||||
- port: 587
|
||||
- port: 143
|
||||
- port: 993
|
||||
- port: 80
|
||||
- port: 11333
|
||||
- port: 11334
|
||||
egress:
|
||||
# Allow relay to external SMTP (Mailgun)
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
except:
|
||||
- 10.0.0.0/8
|
||||
- 172.16.0.0/12
|
||||
- 192.168.0.0/16
|
||||
ports:
|
||||
- port: 587
|
||||
- port: 465
|
||||
- port: 25
|
||||
# Allow internal Mailu component communication
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app: mailu
|
||||
ports:
|
||||
- port: 25
|
||||
- port: 587
|
||||
- port: 143
|
||||
- port: 993
|
||||
- port: 80
|
||||
- port: 11333
|
||||
- port: 11334
|
||||
# Allow connection to shared Redis (database 15)
|
||||
- to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: redis
|
||||
ports:
|
||||
- port: 6379
|
||||
# Allow DNS lookups
|
||||
- to: []
|
||||
ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
@@ -1,21 +0,0 @@
|
||||
# Mailu data storage - shared across all Mailu components
|
||||
# Contains: mail data, SQLite database, DKIM keys, SSL certificates, queue
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mailu-data
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: storage
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
# NOTE: Change storageClassName based on your cluster's storage provisioner
|
||||
# For local development (kind): standard
|
||||
# For AWS EKS: gp2 or gp3
|
||||
# For GKE: standard or premium-rwo
|
||||
# For AKS: managed-premium or managed-csi
|
||||
@@ -1,37 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mailu-secrets
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: secrets
|
||||
type: Opaque
|
||||
data:
|
||||
# Admin credentials (base64 encoded)
|
||||
# IMPORTANT: Replace with real credentials before production deployment
|
||||
# Generate with: openssl rand -base64 24 | tr -d '\n' | base64
|
||||
ADMIN_PASSWORD: "VzJYS2tSdUxpT25ZS2RCWVFTQXJvbjFpeWtFU1M1b2I=" # W2XKkRuLiOnYKdBYQSAron1iykESS5ob
|
||||
|
||||
# Mailu secret key for internal encryption
|
||||
# Generate with: openssl rand -base64 32
|
||||
SECRET_KEY: "Y2I2MWI5MzRkNDcwMjlhNjQxMTdjMGU0MTEwYzkzZjY2YmJjZjVlYWExNWM4NGM0MjcyN2ZhZDc4Zjc=" # cb61b934d47029a64117c0e4110c93f66bbcf5eaa15c84c42727fad78f7
|
||||
|
||||
# External SMTP relay credentials (Mailgun)
|
||||
# For Mailgun: use postmaster@domain as username
|
||||
RELAY_USER: "cG9zdG1hc3RlckBiYWtld2lzZS5haQ==" # postmaster@bakewise.ai
|
||||
RELAY_PASSWORD: "bWFpbGd1bi1hcGkta2V5LXJlcGxhY2UtaW4tcHJvZHVjdGlvbg==" # mailgun-api-key-replace-in-production
|
||||
|
||||
# Database credentials
|
||||
DB_PASSWORD: "RThLejQ3WW1WekRsSEdzMU05d0FiSnp4Y0tuR09OQ1Q=" # E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT
|
||||
|
||||
# Dovecot admin password (moved from ConfigMap for security)
|
||||
DOVEADM_PASSWORD: "WnZhMzNoaVBJc2ZtV3RxUlBWV29taTRYZ2xLTlZPcHY=" # Zva33hiPIsfmWtqRPVWomi4XglKNVOpv
|
||||
|
||||
# Redis password - same as shared cluster Redis (redis-secrets)
|
||||
# Mailu uses database 15 for isolation from other services
|
||||
# REDIS_PW is required by Mailu for Redis authentication
|
||||
REDIS_PASSWORD: "SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0E=" # J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A
|
||||
REDIS_PW: "SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0E=" # J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A
|
||||
# Redis URL for Mailu - using plain TCP port 6380 for internal cluster communication
|
||||
REDIS_URL: "cmVkaXM6Ly86SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0FAcmVkaXMtc2VydmljZS5iYWtlcnktaWEuc3ZjLmNsdXN0ZXIubG9jYWw6NjM4MC8xNQ==" # redis://:J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A@redis-service.bakery-ia.svc.cluster.local:6380/15
|
||||
@@ -1,126 +0,0 @@
|
||||
# Mailu Services - Routes traffic to Mailu stack components
|
||||
# All services use app: mailu selectors to match mailu-deployment.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-front
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: front
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: front
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: 443
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-admin
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: admin
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: admin
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
# Primary SMTP service - used by notification-service and other internal services
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-smtp
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: smtp
|
||||
ports:
|
||||
- name: smtp
|
||||
port: 25
|
||||
targetPort: 25
|
||||
- name: submission
|
||||
port: 587
|
||||
targetPort: 587
|
||||
---
|
||||
# Alias for backwards compatibility with services expecting 'email-smtp'
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: email-smtp
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: smtp
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: smtp
|
||||
ports:
|
||||
- name: smtp
|
||||
port: 25
|
||||
targetPort: 25
|
||||
- name: submission
|
||||
port: 587
|
||||
targetPort: 587
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-imap
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: imap
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: imap
|
||||
ports:
|
||||
- name: imap
|
||||
port: 143
|
||||
targetPort: 143
|
||||
- name: imaps
|
||||
port: 993
|
||||
targetPort: 993
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mailu-antispam
|
||||
namespace: bakery-ia
|
||||
labels:
|
||||
app: mailu
|
||||
component: antispam
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mailu
|
||||
component: antispam
|
||||
ports:
|
||||
- name: rspamd
|
||||
port: 11333
|
||||
targetPort: 11333
|
||||
- name: rspamd-admin
|
||||
port: 11334
|
||||
targetPort: 11334
|
||||
@@ -1,32 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
|
||||
namePrefix: dev-
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: ConfigMap
|
||||
name: mailu-config
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /data/DOMAIN
|
||||
value: "bakery-ia.local"
|
||||
- op: replace
|
||||
path: /data/HOSTNAMES
|
||||
value: "mail.bakery-ia.local"
|
||||
- op: replace
|
||||
path: /data/RELAY_LOGIN
|
||||
value: "postmaster@bakery-ia.local"
|
||||
- op: replace
|
||||
path: /data/WEBMAIL_ADMIN
|
||||
value: "admin@bakery-ia.local"
|
||||
- target:
|
||||
kind: Secret
|
||||
name: mailu-secrets
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /data/RELAY_USER
|
||||
value: "cG9zdG1hc3RlckBiYWtlcnktaWEubG9jYWw=" # postmaster@bakery-ia.local
|
||||
@@ -1,32 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
|
||||
namePrefix: prod-
|
||||
|
||||
patches:
|
||||
- target:
|
||||
kind: ConfigMap
|
||||
name: mailu-config
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /data/DOMAIN
|
||||
value: "bakewise.ai"
|
||||
- op: replace
|
||||
path: /data/HOSTNAMES
|
||||
value: "mail.bakewise.ai"
|
||||
- op: replace
|
||||
path: /data/RELAY_LOGIN
|
||||
value: "postmaster@bakewise.ai"
|
||||
- op: replace
|
||||
path: /data/WEBMAIL_ADMIN
|
||||
value: "admin@bakewise.ai"
|
||||
- target:
|
||||
kind: Secret
|
||||
name: mailu-secrets
|
||||
patch: |-
|
||||
- op: replace
|
||||
path: /data/RELAY_USER
|
||||
value: "cG9zdG1hc3RlckBiYWtld2lzZS5haQ==" # postmaster@bakewise.ai
|
||||
@@ -10,7 +10,7 @@ metadata:
|
||||
# Nginx ingress controller annotations
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "100m"
|
||||
nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
||||
@@ -69,24 +69,10 @@ spec:
|
||||
- host: mail.DOMAIN_PLACEHOLDER # To be replaced by kustomize
|
||||
http:
|
||||
paths:
|
||||
- path: /webmail
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mailu-front
|
||||
port:
|
||||
number: 80
|
||||
- path: /admin
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mailu-front
|
||||
port:
|
||||
number: 80
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mailu-front
|
||||
port:
|
||||
number: 80
|
||||
number: 80
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea-http
|
||||
namespace: bakery-ia
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: gitea-http.gitea.svc.cluster.local
|
||||
ports:
|
||||
- port: 3000
|
||||
targetPort: 3000
|
||||
@@ -3,6 +3,7 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- gitea-service.yaml
|
||||
|
||||
namePrefix: dev-
|
||||
|
||||
@@ -34,4 +35,4 @@ patches:
|
||||
value: mail.bakery-ia.local
|
||||
- op: replace
|
||||
path: /metadata/annotations/nginx.ingress.kubernetes.io~1cors-allow-origin
|
||||
value: "https://localhost,https://localhost:3000,https://localhost:3001,https://127.0.0.1,https://127.0.0.1:3000,https://127.0.0.1:3001,https://bakery-ia.local,http://localhost,http://localhost:3000,http://localhost:3001,http://127.0.0.1,http://127.0.0.1:3000"
|
||||
value: "https://localhost,https://localhost:3000,https://localhost:3001,https://127.0.0.1,https://127.0.0.1:3000,https://127.0.0.1:3001,https://bakery-ia.local,http://localhost,http://localhost:3000,http://localhost:3001,http://127.0.0.1,http://127.0.0.1:3000"
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea-http
|
||||
namespace: bakery-ia
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: gitea-http.gitea.svc.cluster.local
|
||||
ports:
|
||||
- port: 3000
|
||||
targetPort: 3000
|
||||
@@ -3,6 +3,7 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../base
|
||||
- gitea-service.yaml
|
||||
|
||||
namePrefix: prod-
|
||||
|
||||
|
||||
Reference in New Issue
Block a user