Refactor Gitea and SSH configurations, update backup scripts, and enhance Nginx settings

- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand.
- Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters.
- Removed unused gitea-auth script from playbook_gitea.yml.
- Updated systools_version in playbook_systools.yml to 0.4.5.
- Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS.
- Added a new script test_imaps for IMAP testing.
- Updated Terraform configurations for various applications, including:
  - Added a backup script for MariaDB with retention policy.
  - Changed Gitea version to 1.24-rootless and adjusted SSH settings.
  - Updated Nginx configurations to log errors and access to stderr/stdout.
  - Refactored services to use ClusterIP type and adjusted security contexts for deployments.
  - Added temporary storage for applications using empty_dir.
  - Enhanced backup.sh scripts for better error handling and logging.

terraform/modules/apps/mail/config.tf

@@ -31,7 +31,7 @@ locals {
     MY_DESTINATION       = join(",", [for account in var.email_accounts : account.domain])
     MY_NETWORKS          = "127.0.0.0/8"
     MAILNAME             = "smtp.${var.primary_domain}"
-    DOVECOT_LMTP_ADDRESS = "dovecot-lmtp.mail.svc.cluster.local"
+    DOVECOT_LMTP_ADDRESS = "lmtp.mail.svc.cluster.local"
     DOVECOT_LMTP_PORT    = 31024
     LOG_TO_STDOUT        = 0
   }
@@ -64,7 +64,7 @@ locals {
       password             = job.password
       mailbox              = job.mailbox
       delete_after         = job.delete_after
-      dovecot_lmtp_address = "dovecot-lmtp.mail.svc.cluster.local"
+      dovecot_lmtp_address = "lmtp.mail.svc.cluster.local"
       dovecot_lmtp_port    = 31024
     })
   }

terraform/modules/apps/mail/dovecot.tf

@@ -59,7 +59,7 @@ resource "kubernetes_deployment" "dovecot" {
       }
     }
     strategy {
-      type = "Recreate"
+      type = "RollingUpdate"
     }
     template {
       metadata {
@@ -81,7 +81,6 @@ resource "kubernetes_deployment" "dovecot" {
           image = "dovecot/dovecot:${var.dovecot_tag}"
           port {
             container_port = 31993
-            host_port      = 993
           }
           port {
             name           = "lmtp"
@@ -207,7 +206,7 @@ resource "kubernetes_deployment" "dovecot" {
 resource "kubernetes_service" "dovecot" {
   metadata {
     namespace = kubernetes_namespace.mail.metadata[0].name
-    name      = "dovecot"
+    name      = "imap"
   }
 
   spec {
@@ -221,7 +220,7 @@ resource "kubernetes_service" "dovecot" {
       target_port = 31993
     }
 
-    type = "LoadBalancer"
+    type = "ClusterIP"
   }
 
   lifecycle {
@@ -233,7 +232,7 @@ resource "kubernetes_service" "dovecot" {
 
 resource "kubernetes_service" "dovecot_lmtp" {
   metadata {
-    name      = "dovecot-lmtp"
+    name      = "lmtp"
     namespace = kubernetes_namespace.mail.metadata[0].name
   }
 
@@ -246,13 +245,14 @@ resource "kubernetes_service" "dovecot_lmtp" {
       port        = 31024
       target_port = 31024
     }
-    type = "ClusterIP"
+    type       = "ClusterIP"
+    cluster_ip = "None"
   }
 }
 
 resource "kubernetes_service" "dovecot_auth" {
   metadata {
-    name      = "dovecot-auth"
+    name      = "auth"
     namespace = kubernetes_namespace.mail.metadata[0].name
   }
 
@@ -265,6 +265,7 @@ resource "kubernetes_service" "dovecot_auth" {
       port        = 31000
       target_port = 31000
     }
-    type = "ClusterIP"
+    type       = "ClusterIP"
+    cluster_ip = "None"
   }
 }

terraform/modules/apps/mail/postfix.tf

@@ -20,7 +20,6 @@ resource "kubernetes_secret" "bcc_map" {
   }
 }
 
-
 resource "kubernetes_deployment" "postfix" {
   metadata {
     namespace = kubernetes_namespace.mail.metadata[0].name
@@ -37,7 +36,7 @@ resource "kubernetes_deployment" "postfix" {
       }
     }
     strategy {
-      type = "Recreate"
+      type = "RollingUpdate"
     }
     template {
       metadata {
@@ -57,7 +56,6 @@ resource "kubernetes_deployment" "postfix" {
           image = "tozd/postfix:${var.postfix_tag}"
           port {
             container_port = 465
-            host_port      = 465
           }
           dynamic "env" {
             for_each = local.postfix_env_vars
@@ -177,7 +175,7 @@ resource "kubernetes_deployment" "postfix" {
 resource "kubernetes_service" "postfix" {
   metadata {
     namespace = kubernetes_namespace.mail.metadata[0].name
-    name      = "postfix"
+    name      = "smtps"
   }
 
   spec {
@@ -191,7 +189,8 @@ resource "kubernetes_service" "postfix" {
       target_port = 465
     }
 
-    type = "LoadBalancer"
+    type       = "ClusterIP"
+    cluster_ip = "None"
   }
 
   lifecycle {

terraform/modules/apps/mail/resources/postfix/stunnel.conf

@@ -3,5 +3,5 @@ foreground = yes
 [dovecot-auth]
 client = yes
 accept = 127.0.0.1:31000
-connect = dovecot-auth.mail.svc.cluster.local:31000
+connect = auth.mail.svc.cluster.local:31000
 CAfile = /etc/ssl/certs/ca.pem

terraform/modules/apps/mail/stunnel.tf

@@ -1,3 +1,6 @@
+# This file defines the configuration for stunnel in the mail module.
+
+# Creates a Kubernetes ConfigMap for stunnel configuration for Dovecot.
 resource "kubernetes_config_map" "stunnel_dovecot" {
   metadata {
     name      = "stunnel-dovecot"
@@ -8,6 +11,7 @@ resource "kubernetes_config_map" "stunnel_dovecot" {
   }
 }
 
+# Creates a Kubernetes ConfigMap for stunnel configuration for Postfix.
 resource "kubernetes_config_map" "stunnel_postfix" {
   metadata {
     name      = "stunnel-postfix"
@@ -18,6 +22,7 @@ resource "kubernetes_config_map" "stunnel_postfix" {
   }
 }
 
+# Creates a Kubernetes manifest for the stunnel certificate using cert-manager.
 resource "kubernetes_manifest" "stunnel_cert" {
   manifest = {
     apiVersion = "cert-manager.io/v1"
@@ -38,6 +43,7 @@ resource "kubernetes_manifest" "stunnel_cert" {
   }
 }
 
+# Creates a Kubernetes ConfigMap for the CA certificate.
 resource "kubernetes_config_map" "ca_pem" {
   metadata {
     name      = "ca-pem"
@@ -47,3 +53,4 @@ resource "kubernetes_config_map" "ca_pem" {
     "ca.pem" = var.ca_pem
   }
 }
+