ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
11 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

133
services/stalwart/k8s/normal/controller/deploy.yaml Normal file
View file

@ -0,0 +1,133 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: stalwart-controller
namespace: stalwart
spec:
replicas: 2
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 0
template:
spec:
topologySpreadConstraints:
- maxSkew: 1
minDomains: 2
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
containers:
- name: controller
args:
- --dsn-file
- /run/database/dsn
- --plan
- /desired/plan.json
- --secret-root
- /run/control
- --stalwart-url
- http://stalwart-admin.stalwart.svc.cluster.local:8080
- --certificate-san
- mail.quorate.dev
- --oidc-issuer-file
- /run/control/oidc_issuer_url
- --oidc-audience-file
- /run/control/oidc_audience
- --oidc-client-id-file
- /run/control/oidc_client_id
- --oidc-client-secret-file
- /run/control/oidc_client_secret
- --app-passwords
- /desired/app-passwords.json
- --vault-address
- https://vault.vault.svc.cluster.local:8200
- --vault-role
- stalwart-cred-writer
- --vault-token-file
- /run/vault/token
- --vault-ca-cert-file
- /run/control/internal_ca_cert
- --status-address
- 0.0.0.0:9090
- --interval
- 5m
- --initial-backoff
- 5s
- --max-backoff
- 5m
- --reconcile-timeout
- 2m
- --persistent-failure-after
- "5"
- --standby-ready
volumeMounts:
- name: control
mountPath: /run/control
readOnly: true
- name: vault-token
mountPath: /run/vault
readOnly: true
volumes:
- name: control
projected:
defaultMode: 0440
sources:
- secret:
name: stalwart-oidc
items:
- key: audience
path: oidc_audience
- key: client_id
path: oidc_client_id
- key: client_secret
path: oidc_client_secret
- key: controller_subject
path: oidc_controller_subject
- key: human_admin_subject
path: oidc_human_admin_subject
- key: issuer_url
path: oidc_issuer_url
- key: notifier_subject
path: oidc_notifier_subject
- key: notifier_client_id
path: notifier_client_id
- key: notifier_client_secret
path: notifier_client_secret
- key: sender_subject
path: oidc_sender_subject
- key: sender_client_id
path: sender_client_id
- key: sender_client_secret
path: sender_client_secret
- key: test_client_id
path: test_client_id
- key: test_client_secret
path: test_client_secret
- key: test_subject
path: oidc_test_subject
- secret:
name: stalwart-runtime
items:
- key: dragonfly_url
path: dragonfly_url
- key: internal_ca_cert
path: internal_ca_cert
- secret:
name: stalwart-delivery
items:
- key: relay_endpoint
path: relay_endpoint
- key: relay_username
path: relay_username
- name: vault-token
projected:
defaultMode: 0440
sources:
- serviceAccountToken:
path: token
expirationSeconds: 600

11
services/stalwart/k8s/normal/controller/pdb.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: stalwart-controller
namespace: stalwart
spec:
minAvailable: 1
selector:
matchLabels:
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart

30
services/stalwart/k8s/normal/controller/policy.yaml Normal file
View file

@ -0,0 +1,30 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: stalwart-controller-continuous
namespace: stalwart
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "8080"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: vault
app.kubernetes.io/name: vault
app.kubernetes.io/instance: vault
component: server
toPorts:
- ports:
- port: "8200"
protocol: TCP

16
services/stalwart/k8s/normal/gateway/admin.yaml Normal file
View file

@ -0,0 +1,16 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: stalwart-admin
namespace: stalwart
spec:
parentRefs:
- name: gateway-internal
namespace: kube-system
sectionName: https
hostnames:
- mail.quorate.internal
rules:
- backendRefs:
- name: stalwart-admin
port: 8080

20
services/stalwart/k8s/normal/gateway/policy.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: stalwart-gw-egress
spec:
endpointSelector:
matchLabels:
"reserved:ingress": ""
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "8080"
protocol: TCP
- port: "8082"
protocol: TCP

55
services/stalwart/k8s/normal/host/policy.yaml Normal file
View file

@ -0,0 +1,55 @@
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: stalwart-host-probe
spec:
nodeSelector: {}
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "8080"
protocol: TCP
- port: "8443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "9090"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: stalwart-host-reply
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "32768"
endPort: 60999
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "32768"
endPort: 60999
protocol: TCP

66
services/stalwart/k8s/normal/kustomization.yaml Normal file
View file

@ -0,0 +1,66 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- ../controller
- server/deploy.yaml
- server/services.yaml
- server/pdb.yaml
- server/policy.yaml
- controller/policy.yaml
- controller/pdb.yaml
- gateway/policy.yaml
- host/policy.yaml
- gateway/admin.yaml
patches:
- path: controller/deploy.yaml
- target:
group: secrets.hashicorp.com
version: v1beta1
kind: VaultDynamicSecret
name: stalwart-db
patch: |-
- op: add
path: /spec/rolloutRestartTargets
value:
- kind: Deployment
name: stalwart
- kind: Deployment
name: stalwart-controller
- target:
group: secrets.hashicorp.com
version: v1beta1
kind: VaultStaticSecret
name: stalwart-runtime
patch: |-
- op: add
path: /spec/rolloutRestartTargets
value:
- kind: Deployment
name: stalwart
- target:
group: secrets.hashicorp.com
version: v1beta1
kind: VaultStaticSecret
name: stalwart-oidc
patch: |-
- op: add
path: /spec/rolloutRestartTargets
value:
- kind: Deployment
name: stalwart
- kind: Deployment
name: stalwart-controller
- target:
group: secrets.hashicorp.com
version: v1beta1
kind: VaultStaticSecret
name: stalwart-delivery
patch: |-
- op: add
path: /spec/rolloutRestartTargets
value:
- kind: Deployment
name: stalwart
- kind: Deployment
name: stalwart-controller

272
services/stalwart/k8s/normal/server/deploy.yaml Normal file
View file

@ -0,0 +1,272 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: stalwart
namespace: stalwart
spec:
replicas: 2
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 0
selector:
matchLabels:
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
template:
metadata:
annotations:
quorate.internal/configuration-revision: 712f9ab87e927320c07127aadb44f41bdbcce7f7e34c56b7c67179efefb80f0e
labels:
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
quorate.dev/zitadel-relay: "true"
spec:
serviceAccountName: stalwart
automountServiceAccountToken: false
runtimeClassName: gvisor
securityContext:
fsGroup: 65532
seccompProfile:
type: RuntimeDefault
topologySpreadConstraints:
- maxSkew: 1
minDomains: 2
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
initContainers:
- name: trust-bundle
image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
imagePullPolicy: IfNotPresent
command:
- /bin/sh
- -ec
args:
- cat /etc/ssl/certs/ca-certificates.crt /run/runtime/internal_ca_cert > /run/trust/ca-certificates.crt
securityContext:
runAsNonRoot: true
runAsUser: 2000
runAsGroup: 2000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
resources:
requests:
cpu: 5m
memory: 8Mi
limits:
cpu: 50m
memory: 16Mi
volumeMounts:
- name: runtime
mountPath: /run/runtime
readOnly: true
- name: trust
mountPath: /run/trust
- name: wait-zitadel
image: registry.quorate.internal/quorate/stalwart-controller:delivery-318c46b68e20be4d793a344ea1e5464e436edbaa@sha256:70704960a5bf3eb8398c8f26ecaefe7341faa2e7e65c16fa3c40a8e13c94b7dd
imagePullPolicy: IfNotPresent
args:
- wait-oidc
- /run/oidc/issuer_url
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
resources:
requests:
cpu: 10m
memory: 16Mi
limits:
cpu: 100m
memory: 32Mi
volumeMounts:
- name: oidc
mountPath: /run/oidc
readOnly: true
containers:
- name: stalwart
image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
imagePullPolicy: IfNotPresent
args:
- --config
- /etc/stalwart/config.json
env:
- name: SSL_CERT_FILE
value: /run/trust/ca-certificates.crt
- name: STALWART_DB_PASSWORD
valueFrom:
secretKeyRef:
name: stalwart-db
key: password
- name: STALWART_S3_SECRET_KEY
valueFrom:
secretKeyRef:
name: stalwart-runtime
key: s3_secret_key
- name: STALWART_CACHE_PASSWORD
valueFrom:
secretKeyRef:
name: stalwart-runtime
key: dragonfly_password
- name: STALWART_RELAY_PASSWORD
valueFrom:
secretKeyRef:
name: stalwart-delivery
key: relay_password
ports:
- name: management
containerPort: 8080
- name: user-http
containerPort: 8081
- name: smtp
containerPort: 25
- name: submissions
containerPort: 465
- name: submission
containerPort: 587
- name: imaps
containerPort: 993
startupProbe:
httpGet:
path: /healthz/live
port: management
failureThreshold: 90
periodSeconds: 2
livenessProbe:
httpGet:
path: /healthz/live
port: management
periodSeconds: 10
readinessProbe:
httpGet:
path: /healthz/live
port: management
periodSeconds: 5
securityContext:
runAsNonRoot: true
runAsUser: 2000
runAsGroup: 2000
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: true
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: "1"
memory: 1Gi
volumeMounts:
- name: startup
mountPath: /etc/stalwart/config.json
subPath: config.json
readOnly: true
- name: runtime
mountPath: /run/runtime
readOnly: true
- name: tls
mountPath: /run/tls
readOnly: true
- name: trust
mountPath: /run/trust
readOnly: true
- name: tmp
mountPath: /tmp
- name: account-web
image: registry.quorate.internal/quorate/mail-keys@sha256:447051628ca4aa92371acb83092f323047eab961a45140ef0877a3495ec2d98a
imagePullPolicy: IfNotPresent
ports:
- name: account-http
containerPort: 8082
protocol: TCP
- name: user-https
containerPort: 8443
protocol: TCP
startupProbe:
tcpSocket:
port: user-https
failureThreshold: 30
periodSeconds: 2
readinessProbe:
httpGet:
path: /account/oauth/callback
port: 8443
scheme: HTTPS
httpHeaders:
- name: Host
value: mail.quorate.dev
periodSeconds: 5
livenessProbe:
tcpSocket:
port: user-https
periodSeconds: 15
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
resources:
requests:
cpu: 25m
memory: 32Mi
limits:
memory: 64Mi
volumeMounts:
- name: account-config
mountPath: /run/config
readOnly: true
- name: tls
mountPath: /run/tls
readOnly: true
- name: nginx-tmp
mountPath: /tmp
volumes:
- name: account-config
secret:
secretName: mail-web
defaultMode: 0440
items:
- key: config.json
path: config.json
- name: startup
configMap:
name: startup
- name: runtime
secret:
secretName: stalwart-runtime
defaultMode: 0440
- name: tls
secret:
secretName: stalwart-tls
defaultMode: 0440
- name: oidc
secret:
secretName: stalwart-oidc
defaultMode: 0440
- name: tmp
emptyDir: {}
- name: nginx-tmp
emptyDir: {}
- name: trust
emptyDir: {}

11
services/stalwart/k8s/normal/server/pdb.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: stalwart
namespace: stalwart
spec:
minAvailable: 1
selector:
matchLabels:
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart

113
services/stalwart/k8s/normal/server/policy.yaml Normal file
View file

@ -0,0 +1,113 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: stalwart
namespace: stalwart
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
ingress:
- fromEntities:
- host
toPorts:
- ports:
- port: "8080"
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "8080"
protocol: TCP
- fromEntities:
- ingress
toPorts:
- ports:
- port: "8080"
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
gateway.networking.k8s.io/gateway-name: gateway-internal
toPorts:
- ports:
- port: "8080"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: postgres
cnpg.io/cluster: main
toPorts:
- ports:
- port: "5432"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: dragonfly
app.kubernetes.io/name: dragonfly
app: stalwart
toPorts:
- ports:
- port: "6379"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: "7070"
protocol: TCP
- toCIDR:
- 10.66.127.81/32
toPorts:
- ports:
- port: "443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
rules:
dns:
- matchPattern: "*"
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: zitadel
app.kubernetes.io/name: zitadel-oidc-internal
app.kubernetes.io/instance: zitadel
toPorts:
- ports:
- port: "8443"
protocol: TCP
- toFQDNs:
- matchName: cdn.jsdelivr.net
- matchName: data.phishtank.com
- matchName: disposable.github.io
- matchName: github.com
- matchName: gist.githubusercontent.com
- matchName: openphish.com
- matchName: release-assets.githubusercontent.com
toPorts:
- ports:
- port: "443"
protocol: TCP
- toFQDNs:
- matchName: smtp.email.ap-osaka-1.oci.oraclecloud.com
toPorts:
- ports:
- port: "587"
protocol: TCP

15
services/stalwart/k8s/normal/server/services.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: stalwart-admin
namespace: stalwart
spec:
type: ClusterIP
publishNotReadyAddresses: true
selector:
app.kubernetes.io/name: stalwart
app.kubernetes.io/instance: stalwart
ports:
- name: management
port: 8080
targetPort: management