Enhance mail configuration: add envelope support in Sieve, create SMTP and IMAP SRV records, update Dovecot settings, and implement Postfix startup script

terraform/k8sapps/mail.tf

@@ -2,7 +2,69 @@ locals {
   mail_path        = "${local.persistent_folder}/mail"
   mailboxes_path   = "${local.mail_path}/mailboxes"
   getmail_path     = "${local.mail_path}/getmail"
+  postfix_path     = "${local.mail_path}/postfix"
   mail_backup_path = "${local.persistent_folder}/backup.mail"
+
+  email_accounts = [
+    {
+      domain    = "alexpires.me"
+      recipient = "c.alexandre.pires"
+      receive = {
+        type   = "imap"
+        server = "mail-pt.securemail.pro"
+        port   = 993
+      }
+      send = {
+        server = "smtp-pt.securemail.pro"
+        port   = 465
+      }
+      username  = var.alexpires_me_email_username
+      password  = var.alexpires_me_email_password
+      mailboxes = ["INBOX", "Sent", "Drafts", "Trash", "Spam"]
+    }
+  ]
+
+  getmail_jobs = flatten([
+    for account in local.email_accounts : [
+      for mailbox in account.mailboxes : {
+        name         = "${account.recipient}-${mailbox}"
+        recipient    = "${account.recipient}+${mailbox}"
+        domain       = account.domain
+        server       = account.receive.server
+        port         = account.receive.port
+        username     = account.username
+        password     = account.password
+        mailbox      = mailbox
+        delete_after = try(account.delete_after, 30)
+      }
+    ]
+  ])
+
+  postfix_env_vars = {
+    # Email configuration
+    SMTP_HOST            = local.scaleway_smtp_host
+    SMTP_PORT            = 465
+    MY_DESTINATION       = "alexpires.me"
+    MY_NETWORKS          = "127.0.0.0/8"
+    MAILNAME             = "smtp.alexpires.me"
+    DOVECOT_AUTH_ADDRESS = "dovecot-auth.mail.svc.cluster.local"
+    DOVECOT_AUTH_PORT    = 31000
+    DOVECOT_LMTP_ADDRESS = "dovecot-lmtp.mail.svc.cluster.local"
+    DOVECOT_LMTP_PORT    = 31024
+    LOG_TO_STDOUT        = 1
+  }
+
+  postfix_secrets = {
+    SMTP_USER = {
+      key  = "username"
+      name = kubernetes_secret.relay_mail_credentials.metadata[0].name
+    }
+
+    SMTP_PASSWORD = {
+      key  = "password"
+      name = kubernetes_secret.relay_mail_credentials.metadata[0].name
+    }
+  }
 }
 
 resource "kubernetes_namespace" "mail" {
@@ -27,7 +89,19 @@ resource "kubernetes_secret" "dovecot_users" {
   }
 }
 
-resource "kubernetes_service_account" "mail_service_account" {
+resource "kubernetes_secret" "relay_mail_credentials" {
+  metadata {
+    name      = "relay-mail-credentials"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    username = var.scaleway_project_id
+    password = scaleway_iam_api_key.mail_app_api.secret_key
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_service_account" "mail_app" {
 
   metadata {
     name      = "mail-app-sa"
@@ -37,6 +111,28 @@ resource "kubernetes_service_account" "mail_service_account" {
   automount_service_account_token = false
 }
 
+resource "kubernetes_config_map" "postfix_config" {
+  metadata {
+    name      = "postfix-config"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+
+  data = {
+    "run.config" = file("${path.module}/resources/mail/run.config")
+  }
+}
+
+
+resource "kubernetes_secret" "bcc_map" {
+  metadata {
+    name      = "bcc-map"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    "bcc_map" = join("\n", [for account in local.email_accounts : "/([^@]+)@${replace(account.domain, ".", "\\.")}/ $${1}+Sent@${account.domain}"])
+  }
+}
+
 resource "kubernetes_config_map" "getmail_config" {
   metadata {
     name      = "getmail-config"
@@ -194,19 +290,19 @@ resource "kubernetes_cron_job_v1" "fetch_emails" {
   }
 }
 
-resource "kubernetes_deployment" "mail" {
+resource "kubernetes_deployment" "dovecot" {
   metadata {
     namespace = kubernetes_namespace.mail.metadata[0].name
-    name      = "mail"
+    name      = "dovecot"
     labels = {
-      app = "mail"
+      app = "dovecot"
     }
   }
   spec {
     replicas = 1
     selector {
       match_labels = {
-        app = "mail"
+        app = "dovecot"
       }
     }
     strategy {
@@ -215,11 +311,11 @@ resource "kubernetes_deployment" "mail" {
     template {
       metadata {
         labels = {
-          app = "mail"
+          app = "dovecot"
         }
       }
       spec {
-        service_account_name = kubernetes_service_account.mail_service_account.metadata[0].name
+        service_account_name = kubernetes_service_account.mail_app.metadata[0].name
         container {
           name  = "dovecot"
           image = "dovecot/dovecot:latest"
@@ -230,6 +326,9 @@ resource "kubernetes_deployment" "mail" {
           port {
             container_port = 31024
           }
+          port {
+            container_port = 31000
+          }
           volume_mount {
             name       = "email-storage"
             mount_path = "/var/mail"
@@ -291,7 +390,7 @@ resource "kubernetes_deployment" "mail" {
       }
     }
   }
-  depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_service_account]
+  depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
   lifecycle {
     replace_triggered_by = [
       kubernetes_config_map.dovecot_config,
@@ -301,15 +400,130 @@ resource "kubernetes_deployment" "mail" {
   }
 }
 
+resource "kubernetes_deployment" "postfix" {
+  metadata {
+    namespace = kubernetes_namespace.mail.metadata[0].name
+    name      = "postfix"
+    labels = {
+      app = "postfix"
+    }
+  }
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        app = "postfix"
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "postfix"
+        }
+      }
+      spec {
+        service_account_name = kubernetes_service_account.mail_app.metadata[0].name
+        container {
+          name  = "postfix"
+          image = "tozd/postfix:alpine-316"
+          port {
+            container_port = 465
+            host_port      = 465
+          }
+          dynamic "env" {
+            for_each = local.postfix_env_vars
+            content {
+              name  = env.key
+              value = env.value
+            }
+          }
+          dynamic "env" {
+            for_each = local.postfix_secrets
+            content {
+              name = env.key
+              value_from {
+                secret_key_ref {
+                  key  = env.value.key
+                  name = env.value.name
+                }
+              }
+            }
+          }
+
+          volume_mount {
+            name       = "email-storage"
+            mount_path = "/var/spool/postfix"
+          }
+          volume_mount {
+            name       = "postfix-run-config"
+            mount_path = "/etc/service/postfix/run.config"
+            sub_path   = "run.config"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "bcc-map"
+            mount_path = "/etc/postfix/bcc_map"
+            sub_path   = "bcc_map"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "certs"
+            mount_path = "/etc/letsencrypt"
+            read_only  = true
+          }
+        }
+        volume {
+          name = "email-storage"
+          host_path {
+            path = local.postfix_path
+          }
+        }
+        volume {
+          name = "postfix-run-config"
+          config_map {
+            name = kubernetes_config_map.postfix_config.metadata[0].name
+          }
+        }
+        volume {
+          name = "bcc-map"
+          secret {
+            secret_name = kubernetes_secret.bcc_map.metadata[0].name
+          }
+        }
+        volume {
+          name = "certs"
+          secret {
+            secret_name = "mail-tls"
+          }
+        }
+      }
+    }
+  }
+  depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
+  lifecycle {
+    replace_triggered_by = [
+      kubernetes_config_map.postfix_config,
+      kubernetes_secret.relay_mail_credentials,
+      kubernetes_secret.bcc_map,
+    ]
+  }
+}
+
+
 resource "kubernetes_service" "dovecot" {
   metadata {
     namespace = kubernetes_namespace.mail.metadata[0].name
-    name      = "mail"
+    name      = "dovecot"
   }
+
   spec {
     selector = {
-      app = "mail"
+      app = "dovecot"
     }
+
     port {
       name        = "imap"
       port        = 993
@@ -334,7 +548,7 @@ resource "kubernetes_service" "dovecot_lmtp" {
 
   spec {
     selector = {
-      app = "mail"
+      app = "dovecot"
     }
     port {
       port = 31024
@@ -342,3 +556,47 @@ resource "kubernetes_service" "dovecot_lmtp" {
     cluster_ip = "None"
   }
 }
+
+resource "kubernetes_service" "dovecot_auth" {
+  metadata {
+    name      = "dovecot-auth"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "dovecot"
+    }
+    port {
+      port = 31000
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_service" "postfix" {
+  metadata {
+    namespace = kubernetes_namespace.mail.metadata[0].name
+    name      = "postfix"
+  }
+
+  spec {
+    selector = {
+      app = "postfix"
+    }
+
+    port {
+      name        = "smtp"
+      port        = 465
+      target_port = 465
+    }
+
+    type = "LoadBalancer"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}