ce7cb702218693d08ea6d83464d2457c9250027c

services/stalwart/k8s/relay/gateway/policy.yaml

@@ -0,0 +1,37 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: stalwart-relay
+  namespace: stalwart
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: stalwart
+      app.kubernetes.io/instance: stalwart
+  ingress:
+    - fromEntities:
+        - ingress
+      toPorts:
+        - ports:
+            - port: "8082"
+              protocol: TCP
+    - fromEntities:
+        - host
+        - remote-node
+        - world
+      toPorts:
+        - ports:
+            - port: "8443"
+              protocol: TCP
+            - port: "25"
+              protocol: TCP
+            - port: "465"
+              protocol: TCP
+            - port: "993"
+              protocol: TCP
+    - fromEntities:
+        - cluster
+      toPorts:
+        - ports:
+            - port: "587"
+              protocol: TCP

services/stalwart/k8s/relay/gateway/route.yaml

@@ -0,0 +1,44 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: stalwart-user
+  namespace: stalwart
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - mail.quorate.dev
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /account/
+            statusCode: 302
+    - matches:
+        - path:
+            type: Exact
+            value: /login
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /account/login
+            statusCode: 302
+    - filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-For
+                value: "%REQ(X-ENVOY-EXTERNAL-ADDRESS)%"
+      backendRefs:
+        - name: stalwart-user
+          port: 8082

services/stalwart/k8s/relay/gateway/services.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-user
+  namespace: stalwart
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: stalwart
+    app.kubernetes.io/instance: stalwart
+  ports:
+    - name: http
+      port: 8082
+      targetPort: account-http
+      protocol: TCP
+      appProtocol: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-submission
+  namespace: stalwart
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: stalwart
+    app.kubernetes.io/instance: stalwart
+  ports:
+    - name: submission
+      port: 587
+      targetPort: submission
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-relay
+  namespace: stalwart
+  labels:
+    app.kubernetes.io/name: stalwart
+    app.kubernetes.io/instance: stalwart
+    io.cilium/bgp-announce: "true"
+    health.quorate.dev/name: Mail
+  annotations:
+    lbipam.cilium.io/ips: "10.66.153.202"
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  ipFamilies:
+    - IPv4
+  ipFamilyPolicy: SingleStack
+  selector:
+    app.kubernetes.io/name: stalwart
+    app.kubernetes.io/instance: stalwart
+  ports:
+    - name: https
+      port: 443
+      targetPort: user-https
+      protocol: TCP
+    - name: smtp
+      port: 25
+      targetPort: smtp
+      protocol: TCP
+    - name: submissions
+      port: 465
+      targetPort: submissions
+      protocol: TCP
+    - name: imaps
+      port: 993
+      targetPort: imaps
+      protocol: TCP