From 67877a935663fe542ecb423c024c1cf9043b77c4 Mon Sep 17 00:00:00 2001 From: alexlebens Date: Mon, 5 Aug 2024 21:43:56 -0500 Subject: [PATCH] add stalwart --- .../cl01tl/applications/homepage/values.yaml | 18 +- clusters/cl01tl/platform/stalwart/Chart.yaml | 44 +++++ .../stalwart/templates/external-secret.yaml | 164 ++++++++++++++++++ .../templates/replication-source.yaml | 27 +++ clusters/cl01tl/platform/stalwart/values.yaml | 150 ++++++++++++++++ 5 files changed, 397 insertions(+), 6 deletions(-) create mode 100644 clusters/cl01tl/platform/stalwart/Chart.yaml create mode 100644 clusters/cl01tl/platform/stalwart/templates/external-secret.yaml create mode 100644 clusters/cl01tl/platform/stalwart/templates/replication-source.yaml create mode 100644 clusters/cl01tl/platform/stalwart/values.yaml diff --git a/clusters/cl01tl/applications/homepage/values.yaml b/clusters/cl01tl/applications/homepage/values.yaml index c251e3c57..54b208499 100644 --- a/clusters/cl01tl/applications/homepage/values.yaml +++ b/clusters/cl01tl/applications/homepage/values.yaml @@ -221,6 +221,12 @@ homepage: href: https://homeassistant.alexlebens.net siteMonitor: http://home-assistant.home-assistant:8123 statusStyle: dot + - Email: + icon: https://raw.githubusercontent.com/stalwartlabs/website/main/static/img/logo.png + description: Stalwart + href: https://stalwart.alexlebens.net + siteMonitor: http://stalwart.stalwart:80 + statusStyle: dot - Project Planning: icon: taiga.png description: Taiga @@ -422,12 +428,6 @@ homepage: href: https://vault.alexlebens.net siteMonitor: http://vault.vault:8200 statusStyle: dot - - Object Storage: - icon: minio.png - description: Minio Operator - href: https://minio.alexlebens.net - siteMonitor: http://console.minio-operator:9090 - statusStyle: dot - Object Storage (Outline): icon: minio.png description: Minio Tenant @@ -440,6 +440,12 @@ homepage: href: https://minio-penpot.alexlebens.net siteMonitor: http://minio-penpot-console.penpot:9090 statusStyle: dot + - Object Storage (Stalwart): + icon: minio.png + description: Minio Tenant + href: https://minio-stalwart.alexlebens.net + siteMonitor: http://minio-stalwart-console.stalwart:9090 + statusStyle: dot - Sonarr: - Sonarr: icon: sonarr.png diff --git a/clusters/cl01tl/platform/stalwart/Chart.yaml b/clusters/cl01tl/platform/stalwart/Chart.yaml new file mode 100644 index 000000000..07314c7c2 --- /dev/null +++ b/clusters/cl01tl/platform/stalwart/Chart.yaml @@ -0,0 +1,44 @@ +apiVersion: v2 +name: stalwart +version: 1.0.0 +description: Stalwart +keywords: + - stalwart + - email + - smtp +home: https://wiki.alexlebens.dev/doc/stalwart-mail-server-RxyiB7jWwR +sources: + - https://github.com/stalwartlabs/mail-server + - https://github.com/minio/operator + - https://github.com/redis/redis + - https://github.com/elastic/elasticsearch + - https://github.com/cloudnative-pg/cloudnative-pg + - https://hub.docker.com/r/stalwartlabs/mail-server + - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template + - https://github.com/minio/operator/tree/master/helm/tenant + - https://github.com/bitnami/charts/tree/main/bitnami/redis + - https://github.com/bitnami/charts/tree/main/bitnami/elasticsearch + - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster +maintainers: + - name: alexlebens +dependencies: + - name: app-template + alias: matrix-hookshot + version: 3.2.1 + repository: https://bjw-s.github.io/helm-charts/ + - name: tenant + alias: minio + version: 6.0.1 + repository: https://operator.min.io/ + - name: redis + version: 19.6.2 + repository: https://charts.bitnami.com/bitnami + - name: elasticsearch + version: 21.3.2 + repository: https://charts.bitnami.com/bitnami + - name: postgres-cluster + alias: postgres-16-cluster + version: 3.8.4 + repository: http://alexlebens.github.io/helm-charts +icon: https://raw.githubusercontent.com/stalwartlabs/website/main/static/img/logo.png +appVersion: v0.9.0 diff --git a/clusters/cl01tl/platform/stalwart/templates/external-secret.yaml b/clusters/cl01tl/platform/stalwart/templates/external-secret.yaml new file mode 100644 index 000000000..089bacd77 --- /dev/null +++ b/clusters/cl01tl/platform/stalwart/templates/external-secret.yaml @@ -0,0 +1,164 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: stalwart-minio-root-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: stalwart-minio-root-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: database + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: config.env + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/stalwart/minio/config + metadataPolicy: None + property: root-config.env + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: stalwart-minio-config-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: stalwart-minio-config-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: database + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: config.env + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/stalwart/minio/config + metadataPolicy: None + property: config.env + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: stalwart-elasticsearch-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: {{ .Release.Name }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: ELASTIC_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/stalwart/env + metadataPolicy: None + property: ELASTIC_PASSWORD + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: stalwart-config-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: stalwart-config-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + target: + template: + mergePolicy: Merge + engineVersion: v2 + data: + RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/stalwart/stalwart-config" + data: + - secretKey: BUCKET_ENDPOINT + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: S3_BUCKET_ENDPOINT + - secretKey: RESTIC_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: RESTIC_PASSWORD + - secretKey: AWS_DEFAULT_REGION + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: AWS_DEFAULT_REGION + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-volsync-backups + metadataPolicy: None + property: access_key + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-volsync-backups + metadataPolicy: None + property: secret_key + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: stalwart-postgresql-16-cluster-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: stalwart-postgresql-16-cluster-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: database + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-stalwart-postgresql + metadataPolicy: None + property: access_key + - secretKey: ACCESS_SECRET_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-stalwart-postgresql + metadataPolicy: None + property: secret_key diff --git a/clusters/cl01tl/platform/stalwart/templates/replication-source.yaml b/clusters/cl01tl/platform/stalwart/templates/replication-source.yaml new file mode 100644 index 000000000..2494aa460 --- /dev/null +++ b/clusters/cl01tl/platform/stalwart/templates/replication-source.yaml @@ -0,0 +1,27 @@ +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: stalwart-config-backup-source + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: stalwart-config-backup-source + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + sourcePVC: stalwart-config + trigger: + schedule: 0 */6 * * * + restic: + pruneIntervalDays: 7 + repository: stalwart-config-backup-secret + retain: + hourly: 1 + daily: 1 + weekly: 3 + monthly: 2 + yearly: 4 + copyMethod: Snapshot + storageClassName: ceph-block-delete + volumeSnapshotClassName: ceph-blockpool-snapshot diff --git a/clusters/cl01tl/platform/stalwart/values.yaml b/clusters/cl01tl/platform/stalwart/values.yaml new file mode 100644 index 000000000..149caaf2c --- /dev/null +++ b/clusters/cl01tl/platform/stalwart/values.yaml @@ -0,0 +1,150 @@ +tubearchivist: + controllers: + main: + type: deployment + replicas: 1 + strategy: Recreate + revisionHistoryLimit: 3 + containers: + main: + image: + repository: stalwartlabs/mail-server + tag: v0.9.0 + pullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 1Gi + serviceAccount: + create: true + service: + main: + controller: main + ports: + http: + port: 80 + targetPort: 8080 + protocol: HTTP + smtp: + port: 25 + targetPort: 25 + protocol: TCP + smtps: + port: 465 + targetPort: 465 + protocol: TCP + imaps: + port: 993 + targetPort: 993 + protocol: TCP + ingress: + main: + className: traefik + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + cert-manager.io/cluster-issuer: letsencrypt-issuer + hosts: + - host: stalwart.alexlebens.net + paths: + - path: / + pathType: Prefix + service: + name: stalwart + port: 80 + tls: + - secretName: stalwart-secret-tls + hosts: + - stalwart.alexlebens.net + persistence: + config: + storageClass: ceph-block + accessMode: ReadWriteOnce + size: 10Gi + retain: true + advancedMounts: + main: + main: + - path: /opt/stalwart-mail + readOnly: false +minio: + existingSecret: + name: stalwart-minio-root-secret + tenant: + name: minio-stalwart + configuration: + name: stalwart-minio-config-secret + pools: + - servers: 3 + name: pool + volumesPerServer: 2 + size: 10Gi + storageClassName: ceph-block + mountPath: /export + subPath: /data + metrics: + enabled: true + port: 9000 + protocol: http + certificate: + requestAutoCert: false + ingress: + console: + enabled: true + ingressClassName: traefik + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + cert-manager.io/cluster-issuer: letsencrypt-issuer + tls: + - secretName: minio-stalwart-console-secret-tls + hosts: + - minio-stalwart.alexlebens.net + host: minio-stalwart.alexlebens.net + path: / + pathType: Prefix +redis: + architecture: standalone + auth: + enabled: false +elasticsearch: + global: + storageClass: ceph-block + extraEnvVars: + - name: discovery.type + value: single-node + - name: xpack.security.enabled + value: "true" + extraEnvVarsSecret: stalwart-elasticsearch-secret + extraVolumeMounts: + - name: snapshot + mountPath: /usr/share/elasticsearch/data/snapshot + snapshotRepoPath: /usr/share/elasticsearch/data/snapshot + master: + masterOnly: false + replicaCount: 1 + data: + replicaCount: 0 + coordinating: + replicaCount: 0 + ingest: + enabled: false + replicaCount: 0 +postgres-16-cluster: + mode: standalone + cluster: + walStorage: + storageClass: local-path + storage: + storageClass: local-path + monitoring: + enabled: true + prometheusRule: + enabled: false + backup: + enabled: true + endpointURL: https://s3.us-east-2.amazonaws.com + destinationPath: s3://cl01tl-postgresql-backups/stalwart + endpointCredentials: stalwart-postgresql-16-cluster-backup-secret + backupIndex: 1 + retentionPolicy: 14d