Add new infra architecture 3

mailu-values-corrected.yaml

@@ -0,0 +1,208 @@
+# Corrected Mailu Helm values to work with existing infrastructure
+
+# Domain configuration
+domain: bakery-ia.local
+hostnames:
+  - mail.bakery-ia.local
+
+# Mailu version
+mailuVersion: "2024.06"
+secretKey: "cb61b934d47029a64117c0e4110c93f66bbcf5eaa15c84c42727fad78f7"
+
+# Timezone
+timezone: "Etc/UTC"
+
+# Postmaster configuration
+postmaster: "admin"
+
+# TLS configuration
+tls:
+  flavor: "notls"  # Since we're using ingress for TLS
+
+# Limits configuration
+limits:
+  messageSizeLimitInMegabytes: 50
+  authRatelimit:
+    ip: "60/hour"
+    user: "100/day"
+  messageRatelimit:
+    value: "200/day"
+
+# External relay configuration (Mailgun)
+externalRelay:
+  host: "[smtp.mailgun.org]:587"
+  username: "postmaster@bakery-ia.local"
+  password: "mailgun-api-key-replace-in-production"
+
+# Webmail configuration
+webmail:
+  enabled: true
+  flavor: "roundcube"
+
+# Antivirus and antispam configuration
+antivirus:
+  enabled: false  # Disabled in dev to save resources
+antispam:
+  enabled: true
+  flavor: "rspamd"
+
+# Welcome message
+welcomeMessage:
+  enabled: false  # Disabled during development
+
+# Logging
+logLevel: "DEBUG"
+
+# Network configuration
+subnet: "10.42.0.0/16"
+
+# Redis configuration - using external Redis (shared cluster Redis)
+externalRedis:
+  enabled: true
+  host: "redis-service"  # Using the service name in the same namespace
+  port: 6380  # Using plain TCP port for internal cluster communication
+  adminQuotaDbId: 15
+  adminRateLimitDbId: 15
+  rspamdDbId: 15
+
+# Database configuration - using existing PostgreSQL service
+externalDatabase:
+  enabled: true
+  type: "postgresql"
+  host: "auth-db-service"  # Using an existing PostgreSQL service in the namespace
+  port: 5432
+  database: "mailu"  # This database needs to be created manually
+  username: "mailu"
+  password: "E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT"
+
+# Persistence configuration
+persistence:
+  single_pvc: true
+  size: 10Gi
+  storageClass: ""
+  accessModes: [ReadWriteOnce]
+
+# Ingress configuration - disabled to use with existing ingress
+ingress:
+  enabled: false  # Disable chart's Ingress; use existing one
+  tls: false      # Disable TLS in chart since ingress handles it
+  tlsFlavorOverride: notls  # No TLS on internal NGINX; expect external proxy to handle TLS
+  realIpHeader: X-Forwarded-For  # Header for client IP from your Ingress
+  realIpFrom: 0.0.0.0/0  # Trust all proxies (restrict to your Ingress pod CIDR for security)
+  path: /
+  pathType: ImplementationSpecific
+
+  # Optional: Enable PROXY protocol for mail protocols if your Ingress supports TCP proxying
+  proxyProtocol:
+    smtp: false
+    smtps: false
+    submission: false
+    imap: false
+    imaps: false
+    pop3: false
+    pop3s: false
+    manageSieve: false
+
+# Front configuration
+front:
+  image:
+    tag: "2024.06"
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    ports:
+      http: 80
+      https: 443
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
+# Admin configuration
+admin:
+  image:
+    tag: "2024.06"
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    port: 80
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 300m
+      memory: 512Mi
+
+# Postfix configuration
+postfix:
+  image:
+    tag: "2024.06"
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    ports:
+      smtp: 25
+      submission: 587
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+# Dovecot configuration
+dovecot:
+  image:
+    tag: "2024.06"
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    ports:
+      imap: 143
+      imaps: 993
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+# Rspamd configuration
+rspamd:
+  image:
+    tag: "2024.06"
+  replicaCount: 1
+  service:
+    type: ClusterIP
+    ports:
+      rspamd: 11333
+      rspamd-admin: 11334
+  resources:
+    requests:
+      cpu: 200m
+      memory: 512Mi
+    limits:
+      cpu: 1000m
+      memory: 1Gi
+
+# Network Policy
+networkPolicy:
+  enabled: true
+  ingressController:
+    namespace: ingress-nginx
+    podSelector: |
+      matchLabels:
+        app.kubernetes.io/name: ingress-nginx
+        app.kubernetes.io/instance: ingress-nginx
+        app.kubernetes.io/component: controller
+  monitoring:
+    namespace: monitoring
+    podSelector: |
+      matchLabels:
+        app: signoz-prometheus