Add mail cryptography support: create secrets for cryptographic keys, update Dovecot configuration, and remove unused vault file

terraform/k8sapps/mail.tf

@@ -101,6 +101,19 @@ resource "kubernetes_secret" "relay_mail_credentials" {
   type = "Opaque"
 }
 
+resource "kubernetes_secret" "mail_crypt_certs" {
+  metadata {
+    name      = "mail-crypt-certs"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    "ecprivkey.pem" = var.mail_crypt_private_key
+    "ecpubkey.pem"  = var.mail_crypt_public_key
+  }
+  type = "Opaque"
+}
+
+
 resource "kubernetes_service_account" "mail_app" {
 
   metadata {
@@ -356,6 +369,11 @@ resource "kubernetes_deployment" "dovecot" {
             mount_path = "/etc/letsencrypt"
             read_only  = true
           }
+          volume_mount {
+            name       = "mail-crypt-certs"
+            mount_path = "/etc/mail-crypt"
+            read_only  = true
+          }
         }
         volume {
           name = "email-storage"
@@ -387,6 +405,12 @@ resource "kubernetes_deployment" "dovecot" {
             name = kubernetes_config_map.dovecot_sieve.metadata[0].name
           }
         }
+        volume {
+          name = "mail-crypt-certs"
+          secret {
+            secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
+          }
+        }
       }
     }
   }