commit 16dd02660da418cbdc8bfbde6346f30528f0607d
parent 40234de37954658396646ca10c20c066f781166e
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Tue, 24 Mar 2026 10:34:05 +0100
fix servicemonitor
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
3 files changed, 53 insertions(+), 28 deletions(-)
diff --git a/apps/talos_cluster/stalwart/kustomization.yaml b/apps/talos_cluster/stalwart/kustomization.yaml
@@ -7,3 +7,11 @@ resources:
- secret.yaml
- ingress.yaml
- routing.yaml
+
+patches:
+ - path: servicemonitor-patch.yaml
+ target:
+ group: monitoring.coreos.com
+ version: v1
+ kind: ServiceMonitor
+ name: stalwart-mail
diff --git a/apps/talos_cluster/stalwart/secret.yaml b/apps/talos_cluster/stalwart/secret.yaml
@@ -1,34 +1,35 @@
apiVersion: v1
kind: Secret
metadata:
- name: stalwart-secret
- namespace: stalwart
+ name: stalwart-secret
+ namespace: stalwart
type: Opaque
stringData:
- pg-user: ENC[AES256_GCM,data:2M2yBdjpFII=,iv:ixB2FyyZ28MK+EdpG2FWvlVTauy4XexeAkkMlrHyR2U=,tag:grgnCldASwOyfsagds7Gdg==,type:str]
- pg-password: ENC[AES256_GCM,data:UJJQDB9C/1wZWG6bUb+72to/98IJb+EqevKnwaGfqaw70ZCTEJecrM+qzZpp0XTR1FflKqWc2kbsPEn2AEp3,iv:tUwiB50qe+3h6pVvqgc99pABS/6X6f882fzU4Q1lGyM=,tag:+nXaej6dkCsA0Hp2A8WLpQ==,type:str]
- s3-access-key: ENC[AES256_GCM,data:cBUdiQixXubz6NfEt6HZ15GlYSs=,iv:TKfZRXizjGCQvSETs+kjciaPIbKmL7kxHi+UUadU+Qk=,tag:ZD4cjJOsp73EuKylmrXkGg==,type:str]
- s3-secret-key: ENC[AES256_GCM,data:cwJtv65kgiKdq+qm1QJkjFlZ4xLsQQmAt24NsNqXnQHJz0N4xmQZWw==,iv:7Va/MdKN97W6zEBd9G9Gu1pPThWRyMJJOHfPbL0C0/c=,tag:XCMHXq28SLpxgowMitH+oA==,type:str]
- ldap-bind-password: ENC[AES256_GCM,data:VNJjJPbDAv5MxaHe4I+RplmX8wPX9AjscPaKKGst5qhVq7+kPV5UinYGNfxSAocFYzwKvv7YNb/s1pF1E9y+,iv:KoItQlnlqR4poFXr4sr5UU4PVApxmShS0JpUZWazPdM=,tag:sGFbAoIA0L136Q0IKxvidw==,type:str]
- admin-password: ENC[AES256_GCM,data:X4/ZCinPTvkp,iv:jO8RFUs07EaxL5B80TO+VCDheIotkvSK9OqrgZrp84Y=,tag:bDCuHqaQdKTuOSFFmAewYQ==,type:str]
- metrics-password: ENC[AES256_GCM,data:tIcFtJ6mZENWXUYSltwF2BWfoKXugoPpV+JyeiKXLFQ2x7YYbkyHChrCiEVEPMB6frOgk7JCA0XPo9abB/e/,iv:iEeH3+khjpWf7zB2xxsYv8uqKLYZC339EPlKgRReJ0g=,tag:XZXc9vajrZIsAqEjXS0d9Q==,type:str]
+ pg-user: ENC[AES256_GCM,data:2pQjb+GIRPU=,iv:+xsaXMDdt4YaWTq7JcTnfka3/5WKBzFJJp8PCDDh3EY=,tag:4/hDnbizor+aguoGBavQSA==,type:str]
+ pg-password: ENC[AES256_GCM,data:vLcV39f8cggB4Q7sz/YPUVj937fa4fPYJGMv48rtUho90wdnIDSi5EdI1MU3gdSgvgfCa9zy1E03gI9p+EWs,iv:GSXogFiO3s9L7wzMmta+avTinaS0dFXbaGckBCaPaOA=,tag:ZMfxrPRcURA1pNNv61GfNA==,type:str]
+ s3-access-key: ENC[AES256_GCM,data:whsSOcpMOH/lWnK4q3xzFvxgve0=,iv:EXsb+ldIcaF5QbS6cGPKPiE2sHTDE4CRgZZk1c4LwJI=,tag:17cyLNU/Ny8C98Uqq/GMtA==,type:str]
+ s3-secret-key: ENC[AES256_GCM,data:+HNyNaGLB/SkGoAOuYiNWCLJIJUmYkoJZEdZILyRpAzEoDT3OTF2Tw==,iv:B2STEns5vU1Tcm7gNWV6qli82ilVRpm9+p04kUUOSW4=,tag:xYZp7LgHS74WZaRxOGp4Hg==,type:str]
+ ldap-bind-password: ENC[AES256_GCM,data:3E3l2tXW3MSYzUE89CJugfYjJRy0rWq/4IAEU0NJhow0YD2wjuQXs6MS2u2bLu3upR0799Vr4Mhb3UucqRAY,iv:Uq0EkxuKsKxtX2B+Pp78rtf1sN1jscyGyxpUpuofqps=,tag:NVpZG7fq7Zs8bV8TvON/vA==,type:str]
+ admin-password: ENC[AES256_GCM,data:/CYbs9+y1zjU,iv:szd62SYYpwKPw8kS/MUOLHTyp4VTdlm5NzW5XGmuKxU=,tag:Vc1mJIJm7cGeVFfIrs4WtA==,type:str]
+ metrics-password: ENC[AES256_GCM,data:iXQ/ErlA2v7sJDWzatzkiD37/zT0dAgRTL6cowlpB6MnZ5W6hfWyJgm/M9ZGg/EzZ6fryhBJGLW/f24fIMVp,iv:Ns6+SPI66zgVsP9Icfef5IYs6J/fGrM7LYX6cc88Sdw=,tag:hlRzEnsZ+aCBaur71aOerg==,type:str]
+ metrics-username: ENC[AES256_GCM,data:mHWewXiPj7+sVQ==,iv:4+Kr+D7zE22K+eicvkwWBdEJDdl4yHZzYSOJohCniYE=,tag:wf2Ce5myTg6pjvmiLIyNRw==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuc3Y0OEpEVDFqdWE4QmRw
- eDhMckNITmlQUWlKRHFxczBsdHgzMW5ydTEwCmNJRVhNODE0dVZzZThGUDVKWlp4
- SHVmSEF5TG9Hb1dtc0ladmx0M3BpRGMKLS0tIHBGUkM5Ri9QWFVTeXRhV3N3cGp2
- WGgwdjM0R3ZmUFBkVklCRENuMXZXMEkKMUC9tg/123WhsdCiB5gq/W1LIYPiXo8m
- wwrag1l8VsHDhF8TpKSC0v3/5XY/OomZAUVz03+9kCBIERGTsR24SA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-03-23T14:10:33Z"
- mac: ENC[AES256_GCM,data:lxWrl7B78axl0rZ/dN9Ioxb4Hy1P6+LmreCmA5305mPUF56nmRFhs0yVH4gEoAoOAa52Nrx3Mzg7QBEE0XrY9Pit8tK5MMxIHqntTmq+7s2BGdvEDg5+vwF+DmkdXfNpAB0TFdLm2W6cjWMeVYo6k++f543C87/Fw81K2A/HEv0=,iv:HkndtOUxrxflkSzqC1QcPR4QWS6vg5spYiy2Vprz3FM=,tag:OmsRhWzxxRfUDsd1aJYgtw==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRYms5S2MwUVQ5VUdFVmIy
+ Y1VXTUd6SDJHa2VSSHB6WUFGd3JzQW8vZ3hzClZuRnZnNjVtL2dHRTAxS25RMkhG
+ aUVpREFNVTBnZmNOd1NWVlQ4RWRldW8KLS0tIFZWeGpzcDdmaGVzQ2lkeERxbjhs
+ eFluNVhORFRtWmxvQ0ZldlhZNUpoUWMKdcNA9iJYOGUCc7bDFOIAQ9vnlb68JSTM
+ FJmjZvh+vzw7NZpEVQgGkUxZJf0DvvNNOABhhDrSDArbk/89DvZjNg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-03-24T09:33:44Z"
+ mac: ENC[AES256_GCM,data:Hh/BaGYrN/5lPxWn88mseCudmywpxinXntKryTkBNgp0SuVLxO50/j11qgECjgzKOg59nOKFGmQJyImtotweugIPZPfPBdB/4CUCGCgJc7UL+XDAkDd3NpbAV8WHUbalMg78BK//uE7/xHBUapRsoG+9lYXlQm1Yjylh/dsUndg=,iv:YCNyNgQG/hErnq6YM0B50DSyp1cZ/kkjwP2DSe6jpU8=,tag:U8UOTtMxzPKsYhMjizAMrw==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/stalwart/servicemonitor-patch.yaml b/apps/talos_cluster/stalwart/servicemonitor-patch.yaml
@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+ name: stalwart-mail
+ namespace: stalwart
+spec:
+ endpoints:
+ - basicAuth:
+ password:
+ key: metrics-password
+ name: stalwart-secret
+ username:
+ key: metrics-username
+ name: stalwart-secret
+ path: /metrics/prometheus
+ port: http
