feat(mail): enhance mail configuration with getmail and dovecot settings

- Added getmail configuration generation using template files.
- Introduced postfix and dovecot configuration checksums for deployment.
- Created new dovecot configuration file and sieve script for email handling.
- Updated main.tf to utilize local variables for configuration management.
- Removed redundant external password hasher from main.tf.

feat(nginx): improve nginx configuration management

- Centralized nginx configuration into a local variable with checksum.
- Created separate config maps for default website configurations.
- Updated deployment to utilize new configuration structure.

feat(sftpgo): add SFTPGo application deployment

- Introduced SFTPGo with Kubernetes resources including namespace, config maps, and secrets.
- Configured SFTPGo with SMTP settings and AWS credentials.
- Implemented health checks and volume mounts for persistent storage.

refactor(seafile): remove Seafile module

- Deleted Seafile module and associated resources as part of cleanup.

terraform/k8sapps/apps.tf

@@ -71,10 +71,31 @@ module "gitea" {
   fqdn     = local.gitea_fqdn
   app_name = "A13Labs git repository"
 
-  relay_smtp_host     = local.scaleway_smtp_host
-  relay_smtp_port     = local.scaleway_smtp_port
-  relay_smtp_username = var.scaleway_project_id
-  relay_smtp_password = scaleway_iam_api_key.mail_app_api.secret_key
+  smtp_host     = local.scaleway_smtp_host
+  smtp_port     = local.scaleway_smtp_port
+  smtp_username = var.scaleway_project_id
+  smtp_password = scaleway_iam_api_key.mail_app_api.secret_key
 
   from_email = "gitea@${local.primary_domain}"
 }
+
+module "sftpgo" {
+  source = "../modules/apps/sftpgo"
+
+  persistent_folder = local.persistent_folder
+  backup_folder     = local.sftpgo_backup_path
+
+  admin_username = "admin"
+  admin_password = var.sftpgo_admin_password
+
+  tag = local.sftpgo_version
+
+  smtp_host     = local.scaleway_smtp_host
+  smtp_port     = local.scaleway_smtp_port
+  smtp_username = var.scaleway_project_id
+  smtp_password = scaleway_iam_api_key.mail_app_api.secret_key
+  from_email    = "sftpgo@${local.primary_domain}"
+
+  access_key = scaleway_iam_api_key.sftpgo_app_api.access_key
+  secret_key = scaleway_iam_api_key.sftpgo_app_api.secret_key
+}

terraform/k8sapps/backups.tf

@@ -37,12 +37,12 @@ module "gitea_backup" {
   target_folder = local.gitea_backup_path
 }
 
-module "nextcloud_backup" {
+module "sftpgo_backup" {
 
   source = "../modules/utils/scw_rclone"
 
-  namespace = kubernetes_namespace.nextcloud.metadata[0].name
-  app_name  = "nextcloud"
+  namespace = module.sftpgo.namespace
+  app_name  = module.sftpgo.app_name
 
   scaleway_organization_id = var.scaleway_organization_id
   scaleway_project_id      = var.scaleway_organization_id
@@ -51,8 +51,8 @@ module "nextcloud_backup" {
   bucket_name              = scaleway_object_bucket.backup.name
 
   retention_days = local.local_backup_retention_days
-  cron_schedule  = local.nextcloud_files_backup_cron_schedule
+  cron_schedule  = local.sftpgo_files_backup_cron_schedule
 
-  source_folder = local.nextcloud_path
-  target_folder = local.nextcloud_backup_path
+  source_folder = module.sftpgo.path
+  target_folder = local.sftpgo_backup_path
 }

terraform/k8sapps/buckets.tf

@@ -170,3 +170,45 @@ resource "scaleway_object_bucket_policy" "dovecot" {
     ]
   })
 }
+
+resource "scaleway_object_bucket" "sftpgo" {
+  name       = "a13labs-sftpgo-${random_string.bucket_suffix.result}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+}
+
+resource "scaleway_object_bucket_policy" "sftpgo" {
+  bucket = scaleway_object_bucket.sftpgo.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.sftpgo.name,
+          "${scaleway_object_bucket.sftpgo.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.sftpgo_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.sftpgo.name,
+          "${scaleway_object_bucket.sftpgo.name}/*",
+        ]
+      },
+    ]
+  })
+}

terraform/k8sapps/config.tf

@@ -11,22 +11,22 @@ locals {
     "alexpires.me" = {
       domain_name = "alexpires.me"
       fqdn        = ["blog.alexpires.me", "www.alexpires.me", "alexpires.me"]
+      config      = file("${path.module}/resources/alexpires.me.conf")
     }
   }
 
+  # gitea
   gitea_version = "1.23.4"
   gitea_fqdn    = "code.${local.primary_domain}"
 
-  nextcloud_version                    = "30.0.0-apache"
-  nextcloud_fqdn                       = "cloud.${local.primary_domain}"
-  nextcloud_sql_backup_cron_schedule   = "40 2 * * *"
-  nextcloud_files_backup_cron_schedule = "50 2 * * *"
-
+  # sftpgo
+  sftpgo_version = "2.6.x"
 
   # m3uproxy
   m3uproxy_version = "latest"
   m3uproxy_fqdn    = "tv.${local.primary_domain}"
 
+  # geoip
   geoip_cron_schedule = "0 0 * * *"
   geoip_editions = [
     "GeoLite2-Country",
@@ -37,19 +37,21 @@ locals {
   rustdesk_fqdn = "rustdesk.${local.primary_domain}"
 
   # backup
-  local_backup_retention_days      = 2
-  cloud_backup_retention_days      = 3
-  mail_backup_path                 = "${local.persistent_folder}/backup.mail"
-  gitea_backup_path                = "${local.persistent_folder}/backup.gitea"
-  gitea_sql_backup_cron_schedule   = "20 2 * * *"
-  gitea_files_backup_cron_schedule = "30 2 * * *"
-  mail_files_backup_cron_schedule  = "0 3 * * *"
+  local_backup_retention_days       = 2
+  cloud_backup_retention_days       = 3
+  mail_backup_path                  = "${local.persistent_folder}/backup.mail"
+  gitea_backup_path                 = "${local.persistent_folder}/backup.gitea"
+  sftpgo_backup_path                = "${local.persistent_folder}/backup.sftpgo"
+  gitea_sql_backup_cron_schedule    = "20 2 * * *"
+  gitea_files_backup_cron_schedule  = "30 2 * * *"
+  sftpgo_files_backup_cron_schedule = "50 2 * * *"
+  mail_files_backup_cron_schedule   = "0 3 * * *"
 
-  fetch_emails_schedule = "*/2 * * * *"
 
   # email settings
-  scaleway_smtp_host = "smtp.tem.scw.cloud"
-  scaleway_smtp_port = 587
+  fetch_emails_schedule = "*/2 * * * *"
+  scaleway_smtp_host    = "smtp.tem.scw.cloud"
+  scaleway_smtp_port    = 587
   email_accounts = [
     {
       domain    = "alexpires.me"

terraform/k8sapps/disabled/resources/alexpires.me.conf

@@ -0,0 +1,46 @@
+server {
+    listen 8080;
+    server_name localhost;
+    root /tmp/site;
+
+    resolver kube-dns.kube-system.svc.cluster.local valid=10s;
+
+    gzip on;
+    gzip_comp_level 9;
+    gzip_types
+    text/html
+    text/plain
+    text/css
+    text/js
+    text/xml
+    text/javascript
+    application/javascript
+    application/json
+    application/xml
+    application/rss+xml
+    image/svg+xml;
+
+    location ^~ /storage {
+        proxy_pass http://http.sftpgo.svc.cluster.local:8080/storage;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+    }
+
+    location / {
+        index index.html index.htm;
+    }
+
+    location ~* ^/([^/]+) {
+        index index.html index.htm;
+        error_page 404 = @error;
+    }
+
+    error_page 404 /404.html;
+    location @error {
+        try_files /$1/404.html /404.html =404;
+    }
+}

terraform/k8sapps/iam.tf

@@ -14,6 +14,10 @@ resource "scaleway_iam_application" "dovecot_app" {
   name = "dovecot_app"
 }
 
+resource "scaleway_iam_application" "sftpgo_app" {
+  name = "sftpgo_app"
+}
+
 resource "scaleway_iam_policy" "object_read_write_backup" {
   name           = "K8s backup app policy"
   description    = "Gives k8s backup job access to object storage in project"
@@ -77,6 +81,24 @@ resource "scaleway_iam_policy" "object_read_write_dovecot" {
   }
 }
 
+
+resource "scaleway_iam_policy" "object_read_write_sftpgo" {
+  name           = "SFtpGo app policy"
+  description    = "Gives sftpgo job access to object storage in project"
+  application_id = scaleway_iam_application.sftpgo_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "ObjectStorageObjectsWrite",
+      "ObjectStorageObjectsRead",
+      "ObjectStorageBucketsRead",
+      "ObjectStorageBucketsWrite",
+      "ObjectStorageObjectsDelete"
+    ]
+  }
+}
+
 resource "scaleway_iam_api_key" "backup_app_api" {
   application_id = scaleway_iam_application.backup_app.id
   description    = "k8s backup app API key"
@@ -96,3 +118,8 @@ resource "scaleway_iam_api_key" "dovecot_app_api" {
   application_id = scaleway_iam_application.dovecot_app.id
   description    = "dovecot access API key"
 }
+
+resource "scaleway_iam_api_key" "sftpgo_app_api" {
+  application_id = scaleway_iam_application.sftpgo_app.id
+  description    = "sftpgo access API key"
+}

terraform/k8sapps/resources/alexpires.me.conf

@@ -0,0 +1,46 @@
+server {
+    listen 8080;
+    server_name localhost;
+    root /tmp/site;
+
+    resolver kube-dns.kube-system.svc.cluster.local valid=10s;
+
+    gzip on;
+    gzip_comp_level 9;
+    gzip_types
+    text/html
+    text/plain
+    text/css
+    text/js
+    text/xml
+    text/javascript
+    application/javascript
+    application/json
+    application/xml
+    application/rss+xml
+    image/svg+xml;
+
+    location ^~ /storage {
+        proxy_pass http://http.sftpgo.svc.cluster.local:8080/storage;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+    }
+
+    location / {
+        index index.html index.htm;
+    }
+
+    location ~* ^/([^/]+) {
+        index index.html index.htm;
+        error_page 404 = @error;
+    }
+
+    error_page 404 /404.html;
+    location @error {
+        try_files /$1/404.html /404.html =404;
+    }
+}

terraform/k8sapps/secrets.tf

@@ -76,3 +76,10 @@ variable "mail_crypt_private_key" {
   type        = string
   sensitive   = true
 }
+
+variable "sftpgo_admin_password" {
+  description = "SFTPGo admin password"
+  type        = string
+  sensitive   = true
+}
+

terraform/k8sapps/sectool.env

@@ -22,4 +22,5 @@ TF_VAR_rustdesk_public_key=$RUSTDESK_PUBLIC_KEY
 TF_VAR_alexpires_me_email_username=$ALEXPIRES_ME_EMAIL_USERNAME
 TF_VAR_alexpires_me_email_password=$ALEXPIRES_ME_EMAIL_PASSWORD
 TF_VAR_mail_crypt_private_key=$DOVECOT_CRYPT_PRIVATE_KEY_FILE
-TF_VAR_mail_crypt_public_key=$DOVECOT_CRYPT_PUB_KEY_FILE
+TF_VAR_mail_crypt_public_key=$DOVECOT_CRYPT_PUB_KEY_FILE
+TF_VAR_sftpgo_admin_password=$SFTPGO_ADMIN_PASSWORD