alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(mail): add Dovecot and Getmail configurations with ingress setup for SFTPGo

Browse Source
This commit is contained in:
Alexandre Pires
2025-05-05 19:56:43 +02:00
parent e6e85b00f7
commit d1267f816b
10 changed files with 530 additions and 486 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/k8sapps/apps.tf
+1
View File
@@ -89,6 +89,7 @@ module "sftpgo" {
admin_password = var.sftpgo_admin_password admin_password = var.sftpgo_admin_password
tag = local.sftpgo_version tag = local.sftpgo_version
fqdn = local.sftpgo_fqdn
smtp_host = local.scaleway_smtp_host smtp_host = local.scaleway_smtp_host
smtp_port = local.scaleway_smtp_port smtp_port = local.scaleway_smtp_port
terraform/k8sapps/config.tf
+1
View File
@@ -21,6 +21,7 @@ locals {
# sftpgo # sftpgo
sftpgo_version = "2.6.x" sftpgo_version = "2.6.x"
sftpgo_fqdn = "webdav.${local.primary_domain}"
# m3uproxy # m3uproxy
m3uproxy_version = "latest" m3uproxy_version = "latest"
terraform/k8sapps/resources/alexpires.me.conf
+2 -2
View File
@@ -20,8 +20,8 @@ server {
application/rss+xml application/rss+xml
image/svg+xml; image/svg+xml;
location ^~ /storage { location ^~ /config/dav {
proxy_pass http://http.sftpgo.svc.cluster.local:8080/storage; proxy_pass http://http.sftpgo.svc.cluster.local:8080/config/dav;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
terraform/modules/apps/mail/dovecot.tf
+227
View File
@@ -0,0 +1,227 @@
resource "kubernetes_secret" "mail_crypt_certs" {
metadata {
name = "mail-crypt-certs"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"ecprivkey.pem" = var.mail_crypt_private_key
"ecpubkey.pem" = var.mail_crypt_public_key
}
type = "Opaque"
}
resource "kubernetes_secret" "dovecot_users" {
metadata {
name = "dovecot-users"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"users" = local.dovecot_users
}
}
resource "kubernetes_config_map" "dovecot_config" {
metadata {
name = "dovecot-config"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"dovecot.conf" = local.dovecot_config
}
}
resource "kubernetes_config_map" "dovecot_sieve" {
metadata {
name = "dovecot-sieve"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"sieve" = local.dovecot_sieve
}
}
resource "kubernetes_deployment" "dovecot" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "dovecot"
labels = {
app = "dovecot"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "dovecot"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "dovecot"
}
annotations = {
"checksum/dovecot" = local.dovecot_config_checksum
"checksum/sieve" = local.dovecot_sieve_checksum
# Commented out to avoid unnecessary restarts
# "checksum/users" = local.dovecot_users_checksum
}
}
spec {
service_account_name = kubernetes_service_account.mail_app.metadata[0].name
container {
name = "dovecot"
image = "dovecot/dovecot:${var.dovecot_tag}"
port {
container_port = 31993
host_port = 993
}
port {
container_port = 31024
}
port {
container_port = 31000
}
volume_mount {
name = "email-storage"
mount_path = "/var/mail"
}
volume_mount {
name = "users"
mount_path = "/etc/dovecot/users"
sub_path = "users"
read_only = true
}
volume_mount {
name = "dovecot-config"
mount_path = "/etc/dovecot/dovecot.conf"
sub_path = "dovecot.conf"
read_only = true
}
volume_mount {
name = "dovecot-sieve"
mount_path = "/etc/dovecot/sieve/default.sieve"
sub_path = "sieve"
read_only = true
}
volume_mount {
name = "certs"
mount_path = "/etc/letsencrypt"
read_only = true
}
volume_mount {
name = "mail-crypt-certs"
mount_path = "/etc/mail-crypt"
read_only = true
}
}
volume {
name = "email-storage"
host_path {
path = local.mailboxes_path
}
}
volume {
name = "users"
secret {
secret_name = kubernetes_secret.dovecot_users.metadata[0].name
}
}
volume {
name = "dovecot-config"
config_map {
name = kubernetes_config_map.dovecot_config.metadata[0].name
}
}
volume {
name = "certs"
secret {
secret_name = "mail-tls"
}
}
volume {
name = "dovecot-sieve"
config_map {
name = kubernetes_config_map.dovecot_sieve.metadata[0].name
}
}
volume {
name = "mail-crypt-certs"
secret {
secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
}
}
}
}
}
depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
}
}
resource "kubernetes_service" "dovecot" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "dovecot"
}
spec {
selector = {
app = "dovecot"
}
port {
name = "imap"
port = 993
target_port = 31993
}
type = "LoadBalancer"
}
lifecycle {
ignore_changes = [
metadata[0].annotations
]
}
}
resource "kubernetes_service" "dovecot_lmtp" {
metadata {
name = "dovecot-lmtp"
namespace = kubernetes_namespace.mail.metadata[0].name
}
spec {
selector = {
app = "dovecot"
}
port {
port = 31024
}
cluster_ip = "None"
}
}
resource "kubernetes_service" "dovecot_auth" {
metadata {
name = "dovecot-auth"
namespace = kubernetes_namespace.mail.metadata[0].name
}
spec {
selector = {
app = "dovecot"
}
port {
port = 31000
}
cluster_ip = "None"
}
}
terraform/modules/apps/mail/getmail.tf
+79
View File
@@ -0,0 +1,79 @@
resource "kubernetes_config_map" "getmail_config" {
metadata {
name = "getmail-config"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = local.getmail_config
}
resource "kubernetes_cron_job_v1" "fetch_emails" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "fetch-emails"
}
spec {
schedule = var.fetch_emails_schedule
job_template {
metadata {
name = "fetch-emails"
}
spec {
backoff_limit = 1
parallelism = 1
completions = 1
active_deadline_seconds = 300
template {
metadata {
labels = {
app = "fetch-emails"
}
}
spec {
container {
name = "getmail"
image = "a13labs/getmail6:${var.getmail_tag}"
args = concat(["--getmaildir", "/var/getmail"], flatten([for job in local.getmail_jobs : ["-r", "/getmail/getmailrc_${job.name}"]]))
volume_mount {
name = "getmail-config"
mount_path = "/getmail"
read_only = true
}
security_context {
run_as_user = 1000
run_as_group = 1000
}
volume_mount {
name = "getmail-cache"
mount_path = "/var/getmail"
}
}
restart_policy = "Never"
volume {
name = "getmail-config"
config_map {
name = "getmail-config"
}
}
volume {
name = "getmail-cache"
host_path {
path = local.getmail_path
}
}
}
}
}
}
}
}
terraform/modules/apps/mail/main.tf
-482
View File
@@ -10,16 +10,6 @@ resource "kubernetes_namespace" "mail" {
} }
} }
resource "kubernetes_secret" "dovecot_users" {
metadata {
name = "dovecot-users"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"users" = local.dovecot_users
}
}
resource "kubernetes_secret" "relay_mail_credentials" { resource "kubernetes_secret" "relay_mail_credentials" {
metadata { metadata {
name = "relay-mail-credentials" name = "relay-mail-credentials"
@@ -32,19 +22,6 @@ resource "kubernetes_secret" "relay_mail_credentials" {
type = "Opaque" type = "Opaque"
} }
resource "kubernetes_secret" "mail_crypt_certs" {
metadata {
name = "mail-crypt-certs"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"ecprivkey.pem" = var.mail_crypt_private_key
"ecpubkey.pem" = var.mail_crypt_public_key
}
type = "Opaque"
}
resource "kubernetes_service_account" "mail_app" { resource "kubernetes_service_account" "mail_app" {
metadata { metadata {
@@ -55,58 +32,6 @@ resource "kubernetes_service_account" "mail_app" {
automount_service_account_token = false automount_service_account_token = false
} }
resource "kubernetes_config_map" "postfix_config" {
metadata {
name = "postfix-config"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"run.config" = local.postfix_run_config
}
}
resource "kubernetes_secret" "bcc_map" {
metadata {
name = "bcc-map"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"bcc_map" = local.postfix_bcc_map
}
}
resource "kubernetes_config_map" "getmail_config" {
metadata {
name = "getmail-config"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = local.getmail_config
}
resource "kubernetes_config_map" "dovecot_config" {
metadata {
name = "dovecot-config"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"dovecot.conf" = local.dovecot_config
}
}
resource "kubernetes_config_map" "dovecot_sieve" {
metadata {
name = "dovecot-sieve"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"sieve" = local.dovecot_sieve
}
}
resource "kubernetes_manifest" "mail_certificate" { resource "kubernetes_manifest" "mail_certificate" {
manifest = { manifest = {
apiVersion = "cert-manager.io/v1" apiVersion = "cert-manager.io/v1"
@@ -126,410 +51,3 @@ resource "kubernetes_manifest" "mail_certificate" {
} }
} }
} }
resource "kubernetes_cron_job_v1" "fetch_emails" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "fetch-emails"
}
spec {
schedule = var.fetch_emails_schedule
job_template {
metadata {
name = "fetch-emails"
}
spec {
backoff_limit = 1
parallelism = 1
completions = 1
active_deadline_seconds = 300
template {
metadata {
labels = {
app = "fetch-emails"
}
}
spec {
container {
name = "getmail"
image = "a13labs/getmail6:${var.getmail_tag}"
args = concat(["--getmaildir", "/var/getmail"], flatten([for job in local.getmail_jobs : ["-r", "/getmail/getmailrc_${job.name}"]]))
volume_mount {
name = "getmail-config"
mount_path = "/getmail"
read_only = true
}
security_context {
run_as_user = 1000
run_as_group = 1000
}
volume_mount {
name = "getmail-cache"
mount_path = "/var/getmail"
}
}
restart_policy = "Never"
volume {
name = "getmail-config"
config_map {
name = "getmail-config"
}
}
volume {
name = "getmail-cache"
host_path {
path = local.getmail_path
}
}
}
}
}
}
}
}
resource "kubernetes_deployment" "dovecot" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "dovecot"
labels = {
app = "dovecot"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "dovecot"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "dovecot"
}
annotations = {
"checksum/dovecot" = local.dovecot_config_checksum
"checksum/sieve" = local.dovecot_sieve_checksum
# Commented out to avoid unnecessary restarts
# "checksum/users" = local.dovecot_users_checksum
}
}
spec {
service_account_name = kubernetes_service_account.mail_app.metadata[0].name
container {
name = "dovecot"
image = "dovecot/dovecot:${var.dovecot_tag}"
port {
container_port = 31993
host_port = 993
}
port {
container_port = 31024
}
port {
container_port = 31000
}
volume_mount {
name = "email-storage"
mount_path = "/var/mail"
}
volume_mount {
name = "users"
mount_path = "/etc/dovecot/users"
sub_path = "users"
read_only = true
}
volume_mount {
name = "dovecot-config"
mount_path = "/etc/dovecot/dovecot.conf"
sub_path = "dovecot.conf"
read_only = true
}
volume_mount {
name = "dovecot-sieve"
mount_path = "/etc/dovecot/sieve/default.sieve"
sub_path = "sieve"
read_only = true
}
volume_mount {
name = "certs"
mount_path = "/etc/letsencrypt"
read_only = true
}
volume_mount {
name = "mail-crypt-certs"
mount_path = "/etc/mail-crypt"
read_only = true
}
}
volume {
name = "email-storage"
host_path {
path = local.mailboxes_path
}
}
volume {
name = "users"
secret {
secret_name = kubernetes_secret.dovecot_users.metadata[0].name
}
}
volume {
name = "dovecot-config"
config_map {
name = kubernetes_config_map.dovecot_config.metadata[0].name
}
}
volume {
name = "certs"
secret {
secret_name = "mail-tls"
}
}
volume {
name = "dovecot-sieve"
config_map {
name = kubernetes_config_map.dovecot_sieve.metadata[0].name
}
}
volume {
name = "mail-crypt-certs"
secret {
secret_name = kubernetes_secret.mail_crypt_certs.metadata[0].name
}
}
}
}
}
depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
}
}
resource "kubernetes_deployment" "postfix" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "postfix"
labels = {
app = "postfix"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "postfix"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "postfix"
}
annotations = {
"checksum/runconfig" = local.postfix_run_config_checksum
"checksum/bccmap" = local.postfix_bcc_map_checksum
}
}
spec {
service_account_name = kubernetes_service_account.mail_app.metadata[0].name
container {
name = "postfix"
image = "tozd/postfix:${var.postfix_tag}"
port {
container_port = 465
host_port = 465
}
dynamic "env" {
for_each = local.postfix_env_vars
content {
name = env.key
value = env.value
}
}
dynamic "env" {
for_each = local.postfix_secrets
content {
name = env.key
value_from {
secret_key_ref {
key = env.value.key
name = env.value.name
}
}
}
}
volume_mount {
name = "email-storage"
mount_path = "/var/spool/postfix"
}
volume_mount {
name = "postfix-run-config"
mount_path = "/etc/service/postfix/run.config"
sub_path = "run.config"
read_only = true
}
volume_mount {
name = "bcc-map"
mount_path = "/etc/postfix/bcc_map"
sub_path = "bcc_map"
read_only = true
}
volume_mount {
name = "certs"
mount_path = "/etc/letsencrypt"
read_only = true
}
volume_mount {
name = "postfix-logs"
mount_path = "/var/log/postfix"
read_only = false
}
}
volume {
name = "email-storage"
host_path {
path = local.postfix_path
}
}
volume {
name = "postfix-run-config"
config_map {
name = kubernetes_config_map.postfix_config.metadata[0].name
}
}
volume {
name = "bcc-map"
secret {
secret_name = kubernetes_secret.bcc_map.metadata[0].name
}
}
volume {
name = "certs"
secret {
secret_name = "mail-tls"
}
}
volume {
name = "postfix-logs"
host_path {
path = "/var/log/postfix"
}
}
}
}
}
depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
}
}
resource "kubernetes_service" "dovecot" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "dovecot"
}
spec {
selector = {
app = "dovecot"
}
port {
name = "imap"
port = 993
target_port = 31993
}
type = "LoadBalancer"
}
lifecycle {
ignore_changes = [
metadata[0].annotations
]
}
}
resource "kubernetes_service" "dovecot_lmtp" {
metadata {
name = "dovecot-lmtp"
namespace = kubernetes_namespace.mail.metadata[0].name
}
spec {
selector = {
app = "dovecot"
}
port {
port = 31024
}
cluster_ip = "None"
}
}
resource "kubernetes_service" "dovecot_auth" {
metadata {
name = "dovecot-auth"
namespace = kubernetes_namespace.mail.metadata[0].name
}
spec {
selector = {
app = "dovecot"
}
port {
port = 31000
}
cluster_ip = "None"
}
}
resource "kubernetes_service" "postfix" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "postfix"
}
spec {
selector = {
app = "postfix"
}
port {
name = "smtp"
port = 465
target_port = 465
}
type = "LoadBalancer"
}
lifecycle {
ignore_changes = [
metadata[0].annotations
]
}
}
terraform/modules/apps/mail/postfix.tf
+172
View File
@@ -0,0 +1,172 @@
resource "kubernetes_config_map" "postfix_config" {
metadata {
name = "postfix-config"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"run.config" = local.postfix_run_config
}
}
resource "kubernetes_secret" "bcc_map" {
metadata {
name = "bcc-map"
namespace = kubernetes_namespace.mail.metadata[0].name
}
data = {
"bcc_map" = local.postfix_bcc_map
}
}
resource "kubernetes_deployment" "postfix" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "postfix"
labels = {
app = "postfix"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "postfix"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "postfix"
}
annotations = {
"checksum/runconfig" = local.postfix_run_config_checksum
"checksum/bccmap" = local.postfix_bcc_map_checksum
}
}
spec {
service_account_name = kubernetes_service_account.mail_app.metadata[0].name
container {
name = "postfix"
image = "tozd/postfix:${var.postfix_tag}"
port {
container_port = 465
host_port = 465
}
dynamic "env" {
for_each = local.postfix_env_vars
content {
name = env.key
value = env.value
}
}
dynamic "env" {
for_each = local.postfix_secrets
content {
name = env.key
value_from {
secret_key_ref {
key = env.value.key
name = env.value.name
}
}
}
}
volume_mount {
name = "email-storage"
mount_path = "/var/spool/postfix"
}
volume_mount {
name = "postfix-run-config"
mount_path = "/etc/service/postfix/run.config"
sub_path = "run.config"
read_only = true
}
volume_mount {
name = "bcc-map"
mount_path = "/etc/postfix/bcc_map"
sub_path = "bcc_map"
read_only = true
}
volume_mount {
name = "certs"
mount_path = "/etc/letsencrypt"
read_only = true
}
volume_mount {
name = "postfix-logs"
mount_path = "/var/log/postfix"
read_only = false
}
}
volume {
name = "email-storage"
host_path {
path = local.postfix_path
}
}
volume {
name = "postfix-run-config"
config_map {
name = kubernetes_config_map.postfix_config.metadata[0].name
}
}
volume {
name = "bcc-map"
secret {
secret_name = kubernetes_secret.bcc_map.metadata[0].name
}
}
volume {
name = "certs"
secret {
secret_name = "mail-tls"
}
}
volume {
name = "postfix-logs"
host_path {
path = "/var/log/postfix"
}
}
}
}
}
depends_on = [kubernetes_manifest.mail_certificate, kubernetes_service_account.mail_app]
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
}
}
resource "kubernetes_service" "postfix" {
metadata {
namespace = kubernetes_namespace.mail.metadata[0].name
name = "postfix"
}
spec {
selector = {
app = "postfix"
}
port {
name = "smtp"
port = 465
target_port = 465
}
type = "LoadBalancer"
}
lifecycle {
ignore_changes = [
metadata[0].annotations
]
}
}
terraform/modules/apps/sftpgo/config.tf
+1 -1
View File
@@ -44,7 +44,7 @@ locals {
} }
} }
], ],
"web_root" : "/storage", "web_root" : "/config/dav",
}, },
"telemetry" : { "telemetry" : {
"bind_port" : 10000, "bind_port" : 10000,
terraform/modules/apps/sftpgo/ingress.tf
+41
View File
@@ -0,0 +1,41 @@
resource "kubernetes_ingress_v1" "ingress" {
depends_on = [
kubernetes_deployment.sftpgo,
]
metadata {
name = "webdav-ingress"
namespace = kubernetes_namespace.sftpgo.metadata[0].name
annotations = {
"kubernetes.io/ingress.class" = "public"
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
"kubernetes.io/tls-acme" = "true"
"nginx.ingress.kubernetes.io/ssl-redirect" = "true"
"nginx.ingress.kubernetes.io/proxy-body-size" = "4G"
"nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
"nginx.ingress.kubernetes.io/proxy-buffer-size" = "32k"
"nginx.ingress.kubernetes.io/proxy-buffers-number" = "16"
}
}
spec {
tls {
hosts = [var.fqdn]
secret_name = "webdav-tls"
}
rule {
host = var.fqdn
http {
path {
backend {
service {
name = "webdav"
port {
number = 8081
}
}
}
}
}
}
}
}
terraform/modules/apps/sftpgo/variables.tf
+5
View File
@@ -66,3 +66,8 @@ variable "secret_key" {
type = string type = string
sensitive = true sensitive = true
} }
variable "fqdn" {
description = "The fully qualified domain name for the Rustdesk server"
type = string
}