From 5083580d438f1fe4618a41a18e99e1f24d97b400 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Sun, 23 Mar 2025 22:05:34 +0100
Subject: [PATCH] Add mail cryptography support: create secrets for
 cryptographic keys, update Dovecot configuration, and remove unused vault
 file

---
 terraform/k8sapps/.vault                      |  1 -
 terraform/k8sapps/mail.tf                     | 24 +++++++++++++++++++
 terraform/k8sapps/resources/mail/dovecot.conf |  9 +++++++
 terraform/k8sapps/secrets.tf                  |  6 +++++
 terraform/k8sapps/sectool.env                 |  2 ++
 terraform/k8sapps/variables.tf                |  5 ++++
 6 files changed, 46 insertions(+), 1 deletion(-)
 delete mode 100644 terraform/k8sapps/.vault

diff --git a/terraform/k8sapps/.vault b/terraform/k8sapps/.vault
deleted file mode 100644
index 7007d14..0000000
--- a/terraform/k8sapps/.vault
+++ /dev/null
@@ -1 +0,0 @@
-../../repository.vault
\ No newline at end of file
diff --git a/terraform/k8sapps/mail.tf b/terraform/k8sapps/mail.tf
index b65ff9a..3adc301 100644
--- a/terraform/k8sapps/mail.tf
+++ b/terraform/k8sapps/mail.tf
@@ -101,6 +101,19 @@ resource "kubernetes_secret" "relay_mail_credentials" {
   type = "Opaque"
 }
 
+resource "kubernetes_secret" "mail_crypt_certs" {
+  metadata {
+    name      = "mail-crypt-certs"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    "ecprivkey.pem" = var.mail_crypt_private_key
+    "ecpubkey.pem"  = var.mail_crypt_public_key
+  }
+  type = "Opaque"
+}
+
+
 resource "kubernetes_service_account" "mail_app" {
 
   metadata {
@@ -356,6 +369,11 @@ resource "kubernetes_deployment" "dovecot" {
             mount_path = "/etc/letsencrypt"
             read_only  = true
           }
+          volume_mount {
+            name       = "mail-crypt-certs"
+            mount_path = "/etc/mail-crypt"
+            read_only  = true
+          }
         }
         volume {
           name = "email-storage"
@@ -387,6 +405,12 @@ resource "kubernetes_deployment" "dovecot" {
             name = kubernetes_config_map.dovecot_sieve.metadata[0].name
           }
         }
+        volume {
+          name = "mail-crypt-certs"
+          secret {
+            secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
+          }
+        }
       }
     }
   }
diff --git a/terraform/k8sapps/resources/mail/dovecot.conf b/terraform/k8sapps/resources/mail/dovecot.conf
index f12f6d8..2aaa206 100644
--- a/terraform/k8sapps/resources/mail/dovecot.conf
+++ b/terraform/k8sapps/resources/mail/dovecot.conf
@@ -233,6 +233,15 @@ sieve_script default {
   path = /etc/dovecot/sieve/default.sieve
 }
 
+mail_plugins {
+  mail_crypt = yes
+}
+
+crypt_global_private_key main {
+  crypt_private_key_file = /etc/mail-crypt/ecprivkey.pem
+}
+crypt_global_public_key_file = /etc/mail-crypt/ecpubkey.pem
+
 log_path = /dev/stdout
 info_log_path = /dev/stdout
 debug_log_path = /dev/stdout
diff --git a/terraform/k8sapps/secrets.tf b/terraform/k8sapps/secrets.tf
index 51bb84a..f7d03d2 100644
--- a/terraform/k8sapps/secrets.tf
+++ b/terraform/k8sapps/secrets.tf
@@ -75,3 +75,9 @@ variable "alexpires_me_email_password" {
   type        = string
   sensitive   = true
 }
+
+variable "mail_crypt_private_key" {
+  description = "Mailcrypt private key"
+  type        = string
+  sensitive   = true
+}
diff --git a/terraform/k8sapps/sectool.env b/terraform/k8sapps/sectool.env
index c7dab3b..5fbd136 100644
--- a/terraform/k8sapps/sectool.env
+++ b/terraform/k8sapps/sectool.env
@@ -21,3 +21,5 @@ TF_VAR_rustdesk_private_key=$RUSTDESK_PRIVATE_KEY
 TF_VAR_rustdesk_public_key=$RUSTDESK_PUBLIC_KEY
 TF_VAR_alexpires_me_email_username=$ALEXPIRES_ME_EMAIL_USERNAME
 TF_VAR_alexpires_me_email_password=$ALEXPIRES_ME_EMAIL_PASSWORD
+TF_VAR_mail_crypt_private_key=$DOVECOT_CRYPT_PRIVATE_KEY_FILE
+TF_VAR_mail_crypt_public_key=$DOVECOT_CRYPT_PUB_KEY_FILE
\ No newline at end of file
diff --git a/terraform/k8sapps/variables.tf b/terraform/k8sapps/variables.tf
index 9339561..234df9d 100644
--- a/terraform/k8sapps/variables.tf
+++ b/terraform/k8sapps/variables.tf
@@ -32,3 +32,8 @@ variable "rustdesk_public_key" {
   description = "Rustdesk public key"
   type        = string
 }
+
+variable "mail_crypt_public_key" {
+  description = "Mailcrypt public key"
+  type        = string
+}