feat(mail): add stunnel support for Dovecot and Postfix with configuration and certificate management

terraform/modules/apps/mail/dovecot.tf

@@ -42,6 +42,7 @@ resource "kubernetes_config_map" "dovecot_sieve" {
   }
 }
 
+
 resource "kubernetes_deployment" "dovecot" {
   metadata {
     namespace = kubernetes_namespace.mail.metadata[0].name
@@ -68,6 +69,7 @@ resource "kubernetes_deployment" "dovecot" {
         annotations = {
           "checksum/dovecot" = local.dovecot_config_checksum
           "checksum/sieve"   = local.dovecot_sieve_checksum
+          "checksum/stunnel" = local.dovecot_stunnel_config_checksum
           # Commented out to avoid unnecessary restarts
           # "checksum/users"   = local.dovecot_users_checksum
         }
@@ -82,11 +84,9 @@ resource "kubernetes_deployment" "dovecot" {
             host_port      = 993
           }
           port {
+            name           = "lmtp"
             container_port = 31024
           }
-          port {
-            container_port = 31000
-          }
           volume_mount {
             name       = "email-storage"
             mount_path = "/var/mail"
@@ -120,6 +120,25 @@ resource "kubernetes_deployment" "dovecot" {
             read_only  = true
           }
         }
+        container {
+          name  = "stunnel"
+          image = "chainguard/stunnel:${local.stunnel_tag}"
+          args  = ["/etc/conf/stunnel.conf"]
+          volume_mount {
+            name       = "stunnel-config"
+            mount_path = "/etc/conf"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "stunnel-certs"
+            mount_path = "/etc/ssl/certs/private"
+            read_only  = true
+          }
+          port {
+            name           = "auth"
+            container_port = 31000
+          }
+        }
         volume {
           name = "email-storage"
           host_path {
@@ -156,6 +175,26 @@ resource "kubernetes_deployment" "dovecot" {
             secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
           }
         }
+        volume {
+          name = "stunnel-config"
+          config_map {
+            name = kubernetes_config_map.stunnel_dovecot.metadata[0].name
+          }
+        }
+        volume {
+          name = "stunnel-certs"
+          secret {
+            secret_name = kubernetes_manifest.stunnel_cert.manifest["metadata"]["name"]
+            items {
+              key  = "tls.crt"
+              path = "tls.crt"
+            }
+            items {
+              key  = "tls.key"
+              path = "tls.key"
+            }
+          }
+        }
       }
     }
   }
@@ -203,9 +242,11 @@ resource "kubernetes_service" "dovecot_lmtp" {
       app = "dovecot"
     }
     port {
-      port = 31024
+      name        = "lmtp"
+      port        = 31024
+      target_port = 31024
     }
-    cluster_ip = "None"
+    type = "ClusterIP"
   }
 }
 
@@ -220,8 +261,10 @@ resource "kubernetes_service" "dovecot_auth" {
       app = "dovecot"
     }
     port {
-      port = 31000
+      name        = "auth"
+      port        = 31000
+      target_port = 31000
     }
-    cluster_ip = "None"
+    type = "ClusterIP"
   }
 }