ce7cb702218693d08ea6d83464d2457c9250027c

services/stalwart/k8s/base/account.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: stalwart
+  namespace: stalwart
+automountServiceAccountToken: false
+imagePullSecrets:
+  - name: quay-cluster-pull

services/stalwart/k8s/base/app-passwords.json

@@ -0,0 +1,57 @@
+[
+  {
+    "clientIdFile": "/run/control/notifier_client_id",
+    "clientSecretFile": "/run/control/notifier_client_secret",
+    "username": "********",
+    "description": "zitadel-notification-v1",
+    "vaultPath": "secret/data/stalwart/zitadel-notification",
+    "vaultKey": "smtp_password",
+    "permissions": {
+      "@type": "Replace",
+      "permissions": {
+        "authenticate": true,
+        "emailSend": true
+      }
+    }
+  },
+  {
+    "clientIdFile": "/run/control/sender_client_id",
+    "clientSecretFile": "/run/control/sender_client_secret",
+    "username": "********",
+    "description": "alert-submit-v1",
+    "vaultPath": "secret/data/stalwart/alert-identity",
+    "vaultKey": "smtp_password",
+    "permissions": {
+      "@type": "Replace",
+      "permissions": {
+        "authenticate": true,
+        "emailSend": true
+      }
+    }
+  },
+  {
+    "clientIdFile": "/run/control/test_client_id",
+    "clientSecretFile": "/run/control/test_client_secret",
+    "username": "********",
+    "description": "test-mail-v1",
+    "vaultPath": "secret/data/stalwart/test-client",
+    "vaultKey": "password",
+    "permissions": {
+      "@type": "Replace",
+      "permissions": {
+        "authenticate": true,
+        "emailReceive": true,
+        "emailSend": true,
+        "imapAuthenticate": true,
+        "imapCapability": true,
+        "imapExamine": true,
+        "imapFetch": true,
+        "imapIdle": true,
+        "imapList": true,
+        "imapSearch": true,
+        "imapSelect": true,
+        "imapStatus": true
+      }
+    }
+  }
+]

services/stalwart/k8s/base/certificate.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: stalwart-tls
+  namespace: stalwart
+  annotations:
+    reflector.v1.k8s.emberstack.com/reflects: kube-system/gateway-relay-tls
+type: kubernetes.io/tls

services/stalwart/k8s/base/config.json

@@ -0,0 +1,13 @@
+{
+  "@type": "PostgreSql",
+  "host": "main-rw.postgres.svc.cluster.local",
+  "port": 5432,
+  "database": "stalwart",
+  "authUsername": "stalwart",
+  "authSecret": {
+    "@type": "EnvironmentVariable",
+    "variableName": "STALWART_DB_PASSWORD"
+  },
+  "useTls": false,
+  "allowInvalidCerts": false
+}

services/stalwart/k8s/base/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - account.yaml
+  - certificate.yaml
+  - vault/auth.yaml
+  - vault/quay-pull.yaml
+  - vault/database.yaml
+  - vault/delivery.yaml
+  - vault/identity.yaml
+  - vault/runtime.yaml
+configMapGenerator:
+  - name: startup
+    namespace: stalwart
+    files:
+      - config.json
+  - name: desired
+    namespace: stalwart
+    files:
+      - app-passwords.json
+      - plan.json

services/stalwart/k8s/base/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: stalwart
+  labels:
+    gateway.quorate.internal/allow-internal: "true"
+    security.quorate.internal/public-runtime: gvisor

services/stalwart/k8s/base/vault/auth.yaml

@@ -0,0 +1,12 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: stalwart
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: stalwart
+    serviceAccount: stalwart
+  vaultConnectionRef: vault/vault

services/stalwart/k8s/base/vault/database.yaml

@@ -0,0 +1,26 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: stalwart-db
+  namespace: stalwart
+spec:
+  mount: database
+  path: static-creds/stalwart
+  allowStaticCreds: true
+  refreshAfter: 5m
+  destination:
+    name: stalwart-db
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        username:
+          text: '{{ get .Secrets "username" }}'
+        password:
+          text: '{{ get .Secrets "password" }}'
+        dsn:
+          text: 'postgresql://{{ get .Secrets "username" }}:{{ get .Secrets "password" }}@main-rw.postgres.svc.cluster.local:5432/stalwart?sslmode=disable'
+  vaultAuthRef: default

services/stalwart/k8s/base/vault/delivery.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-delivery
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/oci-email-delivery
+  refreshAfter: 1h
+  destination:
+    name: stalwart-delivery
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        relay_endpoint:
+          text: '{{ get .Secrets "endpoint" }}'
+        relay_password:
+          text: '{{ get .Secrets "password" }}'
+        relay_username:
+          text: '{{ get .Secrets "username" }}'
+  vaultAuthRef: default

services/stalwart/k8s/base/vault/identity.yaml

@@ -0,0 +1,65 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-alert
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/alert-identity
+  refreshAfter: 1h
+  destination:
+    name: stalwart-alert
+    create: true
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: mail-web
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/oidc/zitadel
+  refreshAfter: 1h
+  destination:
+    name: mail-web
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        config.json:
+          text: '{{ dict "issuer" (get .Secrets "issuer_url") "clientId" (get .Secrets "account_client_id") "scope" (printf "openid profile urn:zitadel:iam:org:project:id:%s:aud" (get .Secrets "audience")) | toJson }}'
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-test-client
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/test-client
+  refreshAfter: 1h
+  destination:
+    name: stalwart-test-client
+    create: true
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-oidc
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/oidc/zitadel
+  refreshAfter: 1h
+  destination:
+    name: stalwart-oidc
+    create: true
+  vaultAuthRef: default

services/stalwart/k8s/base/vault/quay-pull.yaml

@@ -0,0 +1,29 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: quay-cluster-pull
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  destination:
+    name: quay-cluster-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: stalwart
+    - kind: Deployment
+      name: stalwart-controller
+  vaultAuthRef: default

services/stalwart/k8s/base/vault/runtime.yaml

@@ -0,0 +1,18 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-runtime
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/runtime
+  refreshAfter: 1h
+  destination:
+    name: stalwart-runtime
+    create: true
+    transformation:
+      templates:
+        dragonfly_url:
+          text: 'redis://default:{{ get .Secrets "dragonfly_password" }}@stalwart.dragonfly.svc.cluster.local:6379'
+  vaultAuthRef: default

services/stalwart/k8s/bootstrap/controller/deploy.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stalwart-controller
+  namespace: stalwart
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+        - name: controller
+          args:
+            - --dsn-file
+            - /run/database/dsn
+            - --plan
+            - /desired/plan.json
+            - --secret-root
+            - /run/control
+            - --stalwart-url
+            - http://stalwart-bootstrap.stalwart.svc.cluster.local:8080
+            - --certificate-san
+            - mail.quorate.dev
+            - --bootstrap-user
+            - recovery
+            - --bootstrap-password-file
+            - /run/bootstrap/password
+            - --status-address
+            - 0.0.0.0:9090
+            - --interval
+            - 5m
+            - --initial-backoff
+            - 5s
+            - --max-backoff
+            - 5m
+            - --reconcile-timeout
+            - 2m
+            - --persistent-failure-after
+            - "5"
+          volumeMounts:
+            - name: control
+              mountPath: /run/control
+              readOnly: true
+            - name: bootstrap
+              mountPath: /run/bootstrap
+              readOnly: true
+      volumes:
+        - name: control
+          projected:
+            defaultMode: 0440
+            sources:
+              - secret:
+                  name: stalwart-oidc
+                  items:
+                    - key: audience
+                      path: oidc_audience
+                    - key: controller_subject
+                      path: oidc_controller_subject
+                    - key: human_admin_subject
+                      path: oidc_human_admin_subject
+                    - key: issuer_url
+                      path: oidc_issuer_url
+                    - key: notifier_subject
+                      path: oidc_notifier_subject
+                    - key: sender_subject
+                      path: oidc_sender_subject
+                    - key: test_subject
+                      path: oidc_test_subject
+              - secret:
+                  name: stalwart-runtime
+                  items:
+                    - key: dragonfly_url
+                      path: dragonfly_url
+              - secret:
+                  name: stalwart-delivery
+                  items:
+                    - key: relay_endpoint
+                      path: relay_endpoint
+                    - key: relay_username
+                      path: relay_username
+        - name: bootstrap
+          secret:
+            secretName: stalwart-bootstrap
+            defaultMode: 0440

services/stalwart/k8s/bootstrap/controller/policy.yaml

@@ -0,0 +1,30 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: stalwart-controller-bootstrap
+  namespace: stalwart
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: stalwart-controller
+      app.kubernetes.io/instance: stalwart
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-bootstrap
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-bootstrap
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP

services/stalwart/k8s/bootstrap/host/policy.yaml

@@ -0,0 +1,53 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: bootstrap-host-probe
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-bootstrap
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-controller
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: bootstrap-host-reply
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-bootstrap
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-controller
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

services/stalwart/k8s/bootstrap/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - ../controller
+  - server/secret.yaml
+  - server/job.yaml
+  - server/service.yaml
+  - server/policy.yaml
+  - controller/policy.yaml
+  - host/policy.yaml
+patches:
+  - path: controller/deploy.yaml

services/stalwart/k8s/bootstrap/server/job.yaml

@@ -0,0 +1,186 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: stalwart-bootstrap
+  namespace: stalwart
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: stalwart-bootstrap
+        app.kubernetes.io/instance: stalwart
+        quorate.dev/zitadel-relay: "true"
+    spec:
+      serviceAccountName: stalwart
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      runtimeClassName: gvisor
+      securityContext:
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: trust-bundle
+          image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - cat /etc/ssl/certs/ca-certificates.crt /run/runtime/internal_ca_cert > /run/trust/ca-certificates.crt
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 2000
+            runAsGroup: 2000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          resources:
+            requests:
+              cpu: 5m
+              memory: 8Mi
+            limits:
+              cpu: 50m
+              memory: 16Mi
+          volumeMounts:
+            - name: runtime
+              mountPath: /run/runtime
+              readOnly: true
+            - name: trust
+              mountPath: /run/trust
+        - name: recovery
+          image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
+          imagePullPolicy: IfNotPresent
+          restartPolicy: Always
+          args:
+            - --config
+            - /etc/stalwart/config.json
+          env:
+            - name: SSL_CERT_FILE
+              value: /run/trust/ca-certificates.crt
+            - name: STALWART_RECOVERY_MODE
+              value: "true"
+            - name: STALWART_RECOVERY_MODE_PORT
+              value: "8080"
+            - name: STALWART_RECOVERY_ADMIN
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-bootstrap
+                  key: recovery_admin
+            - name: STALWART_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-db
+                  key: password
+            - name: STALWART_S3_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-runtime
+                  key: s3_secret_key
+            - name: STALWART_CACHE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-runtime
+                  key: dragonfly_password
+            - name: STALWART_RELAY_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-delivery
+                  key: relay_password
+          ports:
+            - name: management
+              containerPort: 8080
+          startupProbe:
+            tcpSocket:
+              port: management
+            failureThreshold: 90
+            periodSeconds: 2
+          readinessProbe:
+            httpGet:
+              path: /healthz/live
+              port: management
+            periodSeconds: 5
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 2000
+            runAsGroup: 2000
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          volumeMounts:
+            - name: startup
+              mountPath: /etc/stalwart/config.json
+              subPath: config.json
+              readOnly: true
+            - name: runtime
+              mountPath: /run/runtime
+              readOnly: true
+            - name: tls
+              mountPath: /run/tls
+              readOnly: true
+            - name: trust
+              mountPath: /run/trust
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      containers:
+        - name: completion
+          image: docker.io/library/busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - until wget -qO- http://stalwart-controller:9090/readyz >/dev/null 2>&1; do sleep 2; done
+          env:
+            - name: HOME
+              value: /tmp
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 250m
+              memory: 128Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: startup
+          configMap:
+            name: startup
+        - name: runtime
+          secret:
+            secretName: stalwart-runtime
+            defaultMode: 0440
+        - name: tls
+          secret:
+            secretName: stalwart-tls
+            defaultMode: 0440
+        - name: tmp
+          emptyDir: {}
+        - name: trust
+          emptyDir: {}

services/stalwart/k8s/bootstrap/server/policy.yaml

@@ -0,0 +1,90 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: stalwart-bootstrap
+  namespace: stalwart
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: stalwart-bootstrap
+      app.kubernetes.io/instance: stalwart
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-controller
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            cnpg.io/cluster: main
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: dragonfly
+            app.kubernetes.io/name: dragonfly
+            app: stalwart
+      toPorts:
+        - ports:
+            - port: "6379"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: versitygw
+            app.kubernetes.io/name: versitygw
+            app.kubernetes.io/instance: versitygw
+      toPorts:
+        - ports:
+            - port: "7070"
+              protocol: TCP
+    - toCIDR:
+        - 10.66.127.81/32
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: stalwart
+            app.kubernetes.io/name: stalwart-controller
+            app.kubernetes.io/instance: stalwart
+      toPorts:
+        - ports:
+            - port: "9090"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zitadel
+            app.kubernetes.io/name: zitadel-oidc-internal
+            app.kubernetes.io/instance: zitadel
+      toPorts:
+        - ports:
+            - port: "8443"
+              protocol: TCP

services/stalwart/k8s/bootstrap/server/secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-bootstrap
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/bootstrap-credentials
+  destination:
+    name: stalwart-bootstrap
+    create: true
+  vaultAuthRef: default