Add custom error pages and Nginx configuration for proxy module

- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module.
- Created a .gitignore file to exclude non-HTML files in the error resources directory.
- Updated Nginx configuration to serve custom error pages for upstream errors.
- Added new Nginx configuration templates for handling HTTP and stream protocols.
- Implemented Wireguard configuration templates and associated variables for secure connections.
- Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps.
- Defined variables for the Stunnel and Wireguard modules to facilitate configuration.
- Created a new Wol Proxy module with Kubernetes resources for deployment and service management.

terraform/modules/apps/mail/dovecot.tf

@@ -59,7 +59,7 @@ resource "kubernetes_deployment" "dovecot" {
       }
     }
     strategy {
-      type = "RollingUpdate"
+      type = var.dovecot_use_host_networking ? "Recreate" : "RollingUpdate"
     }
     template {
       metadata {
@@ -81,6 +81,7 @@ resource "kubernetes_deployment" "dovecot" {
           image = "dovecot/dovecot:${var.dovecot_tag}"
           port {
             container_port = 31993
+            host_port      = var.dovecot_use_host_networking ? 993 : null
           }
           port {
             name           = "lmtp"
@@ -118,6 +119,19 @@ resource "kubernetes_deployment" "dovecot" {
             mount_path = "/etc/mail-crypt"
             read_only  = true
           }
+          volume_mount {
+            name       = "dovecot-logs"
+            mount_path = "/var/log/dovecot"
+            read_only  = false
+          }
+          volume_mount {
+            name       = "tmp"
+            mount_path = "/tmp"
+          }
+          volume_mount {
+            name       = "dovecot-run"
+            mount_path = "/var/run/dovecot"
+          }
         }
         container {
           name  = "stunnel"
@@ -194,6 +208,20 @@ resource "kubernetes_deployment" "dovecot" {
             }
           }
         }
+        volume {
+          name = "dovecot-logs"
+          host_path {
+            path = "/var/log/dovecot"
+          }
+        }
+        volume {
+          name = "tmp"
+          empty_dir {}
+        }
+        volume {
+          name = "dovecot-run"
+          empty_dir {}
+        }
       }
     }
   }
@@ -245,8 +273,7 @@ resource "kubernetes_service" "dovecot_lmtp" {
       port        = 31024
       target_port = 31024
     }
-    type       = "ClusterIP"
-    cluster_ip = "None"
+    type = "ClusterIP"
   }
 }
 
@@ -265,7 +292,6 @@ resource "kubernetes_service" "dovecot_auth" {
       port        = 31000
       target_port = 31000
     }
-    type       = "ClusterIP"
-    cluster_ip = "None"
+    type = "ClusterIP"
   }
 }

terraform/modules/apps/mail/postfix.tf

@@ -36,7 +36,7 @@ resource "kubernetes_deployment" "postfix" {
       }
     }
     strategy {
-      type = "RollingUpdate"
+      type = "Recreate"
     }
     template {
       metadata {
@@ -56,6 +56,7 @@ resource "kubernetes_deployment" "postfix" {
           image = "tozd/postfix:${var.postfix_tag}"
           port {
             container_port = 465
+            host_port      = var.postfix_use_host_networking ? 465 : null
           }
           dynamic "env" {
             for_each = local.postfix_env_vars
@@ -189,8 +190,7 @@ resource "kubernetes_service" "postfix" {
       target_port = 465
     }
 
-    type       = "ClusterIP"
-    cluster_ip = "None"
+    type = "ClusterIP"
   }
 
   lifecycle {

terraform/modules/apps/mail/resources/dovecot/dovecot.conf

@@ -71,8 +71,6 @@ mail_attribute {
   }
 }
 
-log_path = /dev/stdout
-
 imap_hibernate_timeout = 5s
 
 mail_plugins {
@@ -242,9 +240,10 @@ crypt_global_private_key main {
 }
 crypt_global_public_key_file = /etc/mail-crypt/ecpubkey.pem
 
-log_path = /dev/stdout
-info_log_path = /dev/stdout
-debug_log_path = /dev/stdout
+
+log_path = /var/log/dovecot/default.log
+info_log_path = /var/log/dovecot/info.log
+debug_log_path = /var/log/dovecot/debug.log
 
 # Enable verbose logging
 # auth_verbose = yes

terraform/modules/apps/mail/resources/postfix/run.config

@@ -39,7 +39,7 @@ postconf -e "smtpd_sasl_type=dovecot"
 postconf -e "smtpd_sasl_path=inet:localhost:31000"
 postconf -e "smtpd_sasl_auth_enable=yes"
 postconf -e "smtpd_sasl_security_options=noanonymous"
-postconf -e "smtpd_recipient_restrictions=permit_sasl_authenticated, reject"
+postconf -e "smtpd_recipient_restrictions=permit_sasl_authenticated, reject_unauth_destination"
 postconf -e "smtpd_relay_restrictions=permit_sasl_authenticated, reject_unauth_destination"
 postconf -e "smtpd_sasl_authenticated_header=yes"
 postconf -e "smtpd_tls_wrappermode=yes"
@@ -68,7 +68,8 @@ smtps     inet  n       -       n       -       -       smtpd
   -o syslog_name=postfix/smtps
   -o smtpd_tls_wrappermode=yes
   -o smtpd_sasl_auth_enable=yes
-  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
+  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination
+  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject_unauth_destination
 " | sudo tee -a /etc/postfix/master.cf
 
 /usr/sbin/postfix -c /etc/postfix start

terraform/modules/apps/mail/variables.tf

@@ -92,3 +92,15 @@ variable "ca_pem" {
   type        = string
   sensitive   = true
 }
+
+variable "postfix_use_host_networking" {
+  description = "Whether to use host networking for the Postfix container"
+  type        = bool
+  default     = false
+}
+
+variable "dovecot_use_host_networking" {
+  description = "Whether to use host networking for the Dovecot container"
+  type        = bool
+  default     = false
+}