feat(mail): add Dovecot and Getmail configurations with ingress setup for SFTPGo

2025-05-05 19:56:43 +02:00
parent e6e85b00f7
commit d1267f816b
10 changed files with 530 additions and 486 deletions
@@ -0,0 +1,227 @@
+resource "kubernetes_secret" "mail_crypt_certs" {
+  metadata {
+    name      = "mail-crypt-certs"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    "ecprivkey.pem" = var.mail_crypt_private_key
+    "ecpubkey.pem"  = var.mail_crypt_public_key
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_secret" "dovecot_users" {
+  metadata {
+    name      = "dovecot-users"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+  data = {
+    "users" = local.dovecot_users
+  }
+}
+
+resource "kubernetes_config_map" "dovecot_config" {
+  metadata {
+    name      = "dovecot-config"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+
+  data = {
+    "dovecot.conf" = local.dovecot_config
+  }
+}
+
+resource "kubernetes_config_map" "dovecot_sieve" {
+  metadata {
+    name      = "dovecot-sieve"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+
+  data = {
+    "sieve" = local.dovecot_sieve
+  }
+}
+
+resource "kubernetes_deployment" "dovecot" {
+  metadata {
+    namespace = kubernetes_namespace.mail.metadata[0].name
+    name      = "dovecot"
+    labels = {
+      app = "dovecot"
+    }
+  }
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        app = "dovecot"
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+    template {
+      metadata {
+        labels = {
+          app = "dovecot"
+        }
+        annotations = {
+          "checksum/dovecot" = local.dovecot_config_checksum
+          "checksum/sieve"   = local.dovecot_sieve_checksum
+          # Commented out to avoid unnecessary restarts
+          # "checksum/users"   = local.dovecot_users_checksum
+        }
+      }
+      spec {
+        service_account_name = kubernetes_service_account.mail_app.metadata[0].name
+        container {
+          name  = "dovecot"
+          image = "dovecot/dovecot:${var.dovecot_tag}"
+          port {
+            container_port = 31993
+            host_port      = 993
+          }
+          port {
+            container_port = 31024
+          }
+          port {
+            container_port = 31000
+          }
+          volume_mount {
+            name       = "email-storage"
+            mount_path = "/var/mail"
+          }
+          volume_mount {
+            name       = "users"
+            mount_path = "/etc/dovecot/users"
+            sub_path   = "users"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "dovecot-config"
+            mount_path = "/etc/dovecot/dovecot.conf"
+            sub_path   = "dovecot.conf"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "dovecot-sieve"
+            mount_path = "/etc/dovecot/sieve/default.sieve"
+            sub_path   = "sieve"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "certs"
+            mount_path = "/etc/letsencrypt"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "mail-crypt-certs"
+            mount_path = "/etc/mail-crypt"
+            read_only  = true
+          }
+        }
+        volume {
+          name = "email-storage"
+          host_path {
+            path = local.mailboxes_path
+          }
+        }
+        volume {
+          name = "users"
+          secret {
+            secret_name = kubernetes_secret.dovecot_users.metadata[0].name
+          }
+        }
+        volume {
+          name = "dovecot-config"
+          config_map {
+            name = kubernetes_config_map.dovecot_config.metadata[0].name
+          }
+        }
+        volume {
+          name = "certs"
+          secret {
+            secret_name = "mail-tls"
+          }
+        }
+        volume {
+          name = "dovecot-sieve"
+          config_map {
+            name = kubernetes_config_map.dovecot_sieve.metadata[0].name
+          }
+        }
+        volume {
+          name = "mail-crypt-certs"
+          secret {
+            secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
+          }
+        }
+      }
+    }
+  }
+  depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
+  lifecycle {
+    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
+  }
+}
+
+resource "kubernetes_service" "dovecot" {
+  metadata {
+    namespace = kubernetes_namespace.mail.metadata[0].name
+    name      = "dovecot"
+  }
+
+  spec {
+    selector = {
+      app = "dovecot"
+    }
+
+    port {
+      name        = "imap"
+      port        = 993
+      target_port = 31993
+    }
+
+    type = "LoadBalancer"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}
+
+resource "kubernetes_service" "dovecot_lmtp" {
+  metadata {
+    name      = "dovecot-lmtp"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "dovecot"
+    }
+    port {
+      port = 31024
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_service" "dovecot_auth" {
+  metadata {
+    name      = "dovecot-auth"
+    namespace = kubernetes_namespace.mail.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "dovecot"
+    }
+    port {
+      port = 31000
+    }
+    cluster_ip = "None"
+  }
+}