apiVersion: batch/v1
kind: Job
metadata:
  name: stalwart-bootstrap
  namespace: stalwart
spec:
  backoffLimit: 3
  template:
    metadata:
      labels:
        app.kubernetes.io/name: stalwart-bootstrap
        app.kubernetes.io/instance: stalwart
        quorate.dev/zitadel-relay: "true"
    spec:
      serviceAccountName: stalwart
      automountServiceAccountToken: false
      restartPolicy: Never
      runtimeClassName: gvisor
      securityContext:
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: trust-bundle
          image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -ec
          args:
            - cat /etc/ssl/certs/ca-certificates.crt /run/runtime/internal_ca_cert > /run/trust/ca-certificates.crt
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 5m
              memory: 8Mi
            limits:
              cpu: 50m
              memory: 16Mi
          volumeMounts:
            - name: runtime
              mountPath: /run/runtime
              readOnly: true
            - name: trust
              mountPath: /run/trust
        - name: recovery
          image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
          imagePullPolicy: IfNotPresent
          restartPolicy: Always
          args:
            - --config
            - /etc/stalwart/config.json
          env:
            - name: SSL_CERT_FILE
              value: /run/trust/ca-certificates.crt
            - name: STALWART_RECOVERY_MODE
              value: "true"
            - name: STALWART_RECOVERY_MODE_PORT
              value: "8080"
            - name: STALWART_RECOVERY_ADMIN
              valueFrom:
                secretKeyRef:
                  name: stalwart-bootstrap
                  key: recovery_admin
            - name: STALWART_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: stalwart-db
                  key: password
            - name: STALWART_S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: stalwart-runtime
                  key: s3_secret_key
            - name: STALWART_CACHE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: stalwart-runtime
                  key: dragonfly_password
            - name: STALWART_RELAY_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: stalwart-delivery
                  key: relay_password
          ports:
            - name: management
              containerPort: 8080
          startupProbe:
            tcpSocket:
              port: management
            failureThreshold: 90
            periodSeconds: 2
          readinessProbe:
            httpGet:
              path: /healthz/live
              port: management
            periodSeconds: 5
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          volumeMounts:
            - name: startup
              mountPath: /etc/stalwart/config.json
              subPath: config.json
              readOnly: true
            - name: runtime
              mountPath: /run/runtime
              readOnly: true
            - name: tls
              mountPath: /run/tls
              readOnly: true
            - name: trust
              mountPath: /run/trust
              readOnly: true
            - name: tmp
              mountPath: /tmp
      containers:
        - name: completion
          image: docker.io/library/busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -ec
          args:
            - until wget -qO- http://stalwart-controller:9090/readyz >/dev/null 2>&1; do sleep 2; done
          env:
            - name: HOME
              value: /tmp
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: startup
          configMap:
            name: startup
        - name: runtime
          secret:
            secretName: stalwart-runtime
            defaultMode: 0440
        - name: tls
          secret:
            secretName: stalwart-tls
            defaultMode: 0440
        - name: tmp
          emptyDir: {}
        - name: trust
          emptyDir: {}