a13labs.infra/terraform/modules/apps/mail/postfix.tf

resource "kubernetes_config_map" "postfix_config" {
  metadata {
    name      = "postfix-config"
    namespace = kubernetes_namespace.mail.metadata[0].name
  }

  data = {
    "run.config" = local.postfix_run_config
  }
}

resource "kubernetes_secret" "bcc_map" {
  metadata {
    name      = "bcc-map"
    namespace = kubernetes_namespace.mail.metadata[0].name
  }
  data = {
    "bcc_map" = local.postfix_bcc_map
  }
}

resource "kubernetes_deployment" "postfix" {
  metadata {
    namespace = kubernetes_namespace.mail.metadata[0].name
    name      = "postfix"
    labels = {
      app = "postfix"
    }
  }
  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "postfix"
      }
    }
    strategy {
      type = "RollingUpdate"
    }
    template {
      metadata {
        labels = {
          app = "postfix"
        }
        annotations = {
          "checksum/runconfig" = local.postfix_run_config_checksum
          "checksum/bccmap"    = local.postfix_bcc_map_checksum
          "checksum/stunnel"   = local.postfix_stunnel_config_checksum
        }
      }
      spec {
        service_account_name = kubernetes_service_account.mail_app.metadata[0].name
        container {
          name  = "postfix"
          image = "tozd/postfix:${var.postfix_tag}"
          port {
            container_port = 465
          }
          dynamic "env" {
            for_each = local.postfix_env_vars
            content {
              name  = env.key
              value = env.value
            }
          }
          dynamic "env" {
            for_each = local.postfix_secrets
            content {
              name = env.key
              value_from {
                secret_key_ref {
                  key  = env.value.key
                  name = env.value.name
                }
              }
            }
          }

          volume_mount {
            name       = "email-storage"
            mount_path = "/var/spool/postfix"
          }
          volume_mount {
            name       = "postfix-run-config"
            mount_path = "/etc/service/postfix/run.config"
            sub_path   = "run.config"
            read_only  = true
          }
          volume_mount {
            name       = "bcc-map"
            mount_path = "/etc/postfix/bcc_map"
            sub_path   = "bcc_map"
            read_only  = true
          }
          volume_mount {
            name       = "certs"
            mount_path = "/etc/letsencrypt"
            read_only  = true
          }
          volume_mount {
            name       = "postfix-logs"
            mount_path = "/var/log/postfix"
            read_only  = false
          }
        }
        container {
          name  = "stunnel"
          image = "chainguard/stunnel:${local.stunnel_tag}"
          args  = ["/etc/conf/stunnel.conf"]
          volume_mount {
            name       = "stunnel-config"
            mount_path = "/etc/conf/stunnel.conf"
            sub_path   = "stunnel.conf"
            read_only  = true
          }
          volume_mount {
            name       = "stunnel-ca"
            mount_path = "/etc/ssl/certs/ca.pem"
            sub_path   = "ca.pem"
            read_only  = true
          }
        }
        volume {
          name = "email-storage"
          host_path {
            path = local.postfix_path
          }
        }
        volume {
          name = "postfix-run-config"
          config_map {
            name = kubernetes_config_map.postfix_config.metadata[0].name
          }
        }
        volume {
          name = "bcc-map"
          secret {
            secret_name = kubernetes_secret.bcc_map.metadata[0].name
          }
        }
        volume {
          name = "certs"
          secret {
            secret_name = "mail-tls"
          }
        }
        volume {
          name = "postfix-logs"
          host_path {
            path = "/var/log/postfix"
          }
        }
        volume {
          name = "stunnel-config"
          config_map {
            name = kubernetes_config_map.stunnel_postfix.metadata[0].name
          }
        }
        volume {
          name = "stunnel-ca"
          config_map {
            name = kubernetes_config_map.ca_pem.metadata[0].name
          }
        }
      }
    }
  }
  depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
  lifecycle {
    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
  }
}

resource "kubernetes_service" "postfix" {
  metadata {
    namespace = kubernetes_namespace.mail.metadata[0].name
    name      = "smtps"
  }

  spec {
    selector = {
      app = "postfix"
    }

    port {
      name        = "smtp"
      port        = 465
      target_port = 465
    }

    type       = "ClusterIP"
    cluster_ip = "None"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }
}