Add mail cryptography support: create secrets for cryptographic keys, update Dovecot configuration, and remove unused vault file

terraform/k8sapps/.vault

@@ -1 +0,0 @@
-../../repository.vault

terraform/k8sapps/mail.tf

@@ -101,6 +101,19 @@ resource "kubernetes_secret" "relay_mail_credentials" {
   type = "Opaque"
 }
 
+resource "kubernetes_secret" "mail_crypt_certs" {
+  metadata {
+    name      = "mail-crypt-certs"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    "ecprivkey.pem" = var.mail_crypt_private_key
+    "ecpubkey.pem"  = var.mail_crypt_public_key
+  }
+  type = "Opaque"
+}
+
+
 resource "kubernetes_service_account" "mail_app" {
 
   metadata {
@@ -356,6 +369,11 @@ resource "kubernetes_deployment" "dovecot" {
             mount_path = "/etc/letsencrypt"
             read_only  = true
           }
+          volume_mount {
+            name       = "mail-crypt-certs"
+            mount_path = "/etc/mail-crypt"
+            read_only  = true
+          }
         }
         volume {
           name = "email-storage"
@@ -387,6 +405,12 @@ resource "kubernetes_deployment" "dovecot" {
             name = kubernetes_config_map.dovecot_sieve.metadata[0].name
           }
         }
+        volume {
+          name = "mail-crypt-certs"
+          secret {
+            secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
+          }
+        }
       }
     }
   }

terraform/k8sapps/resources/mail/dovecot.conf

@@ -233,6 +233,15 @@ sieve_script default {
   path = /etc/dovecot/sieve/default.sieve
 }
 
+mail_plugins {
+  mail_crypt = yes
+}
+
+crypt_global_private_key main {
+  crypt_private_key_file = /etc/mail-crypt/ecprivkey.pem
+}
+crypt_global_public_key_file = /etc/mail-crypt/ecpubkey.pem
+
 log_path = /dev/stdout
 info_log_path = /dev/stdout
 debug_log_path = /dev/stdout

terraform/k8sapps/secrets.tf

@@ -75,3 +75,9 @@ variable "alexpires_me_email_password" {
   type        = string
   sensitive   = true
 }
+
+variable "mail_crypt_private_key" {
+  description = "Mailcrypt private key"
+  type        = string
+  sensitive   = true
+}

terraform/k8sapps/sectool.env

@@ -21,3 +21,5 @@ TF_VAR_rustdesk_private_key=$RUSTDESK_PRIVATE_KEY
 TF_VAR_rustdesk_public_key=$RUSTDESK_PUBLIC_KEY
 TF_VAR_alexpires_me_email_username=$ALEXPIRES_ME_EMAIL_USERNAME
 TF_VAR_alexpires_me_email_password=$ALEXPIRES_ME_EMAIL_PASSWORD
+TF_VAR_mail_crypt_private_key=$DOVECOT_CRYPT_PRIVATE_KEY_FILE
+TF_VAR_mail_crypt_public_key=$DOVECOT_CRYPT_PUB_KEY_FILE

terraform/k8sapps/variables.tf

@@ -32,3 +32,8 @@ variable "rustdesk_public_key" {
   description = "Rustdesk public key"
   type        = string
 }
+
+variable "mail_crypt_public_key" {
+  description = "Mailcrypt public key"
+  type        = string
+}