commit 33265bc005d3a64d0aac1645aebf401a0319d117
parent 5b53a8bb04dac9839760b08242ae89e1ded194ed
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 15 Apr 2026 09:15:03 +0200
move to using host network or email
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
3 files changed, 227 insertions(+), 182 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/email_gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/email_gateway_settings.yaml
@@ -0,0 +1,216 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+ name: email-proxy-config
+ namespace: envoy-gateway
+spec:
+ provider:
+ type: Kubernetes
+ kubernetes:
+ useListenerPortAsContainerPort: true
+ envoyService:
+ type: ClusterIP
+ envoyDaemonSet:
+ patch:
+ type: StrategicMerge
+ value:
+ spec:
+ template:
+ spec:
+ hostNetwork: true
+ dnsPolicy: ClusterFirstWithHostNet
+ container:
+ securityContext:
+ runAsUser: 0
+ allowPrivilegeEscalation: true
+ logging:
+ level:
+ default: info
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: GatewayClass
+metadata:
+ name: email-gateway-class
+ namespace: envoy-gateway
+spec:
+ controllerName: gateway.envoyproxy.io/gatewayclass-controller
+ parametersRef:
+ group: gateway.envoyproxy.io
+ kind: EnvoyProxy
+ name: email-proxy-config
+ namespace: envoy-gateway
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+ name: email-gateway
+ namespace: envoy-gateway
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+spec:
+ gatewayClassName: email-gateway-class
+ infrastructure:
+ annotations:
+ external-dns.alpha.kubernetes.io/access: public
+ # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
+ listeners:
+ - name: smtp
+ protocol: TCP
+ port: 25
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: submissions
+ protocol: TCP
+ port: 465
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: submission
+ protocol: TCP
+ port: 587
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: imap
+ protocol: TCP
+ port: 143
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: imaps
+ protocol: TCP
+ port: 993
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: https-stalwart-nordgedanken
+ protocol: HTTPS
+ hostname: "stalwart.nordgedanken.dev"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stalwart.nordgedanken.dev-tls
+ - name: https-webmail-midnightthoughts
+ protocol: HTTPS
+ hostname: "webmail.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webmail.midnightthoughts.space-tls
+ - name: https-autoconfig-midnightthoughts
+ protocol: HTTPS
+ hostname: "autoconfig.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autoconfig.midnightthoughts.space-tls
+ - name: https-autodiscover-midnightthoughts
+ protocol: HTTPS
+ hostname: "autodiscover.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autodiscover.midnightthoughts.space-tls
+ - name: https-autoconfig-lists-midnightthoughts
+ protocol: HTTPS
+ hostname: "autoconfig.lists.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autoconfig.lists.midnightthoughts.space-tls
+ - name: https-autodiscover-lists-midnightthoughts
+ protocol: HTTPS
+ hostname: "autodiscover.lists.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autodiscover.lists.midnightthoughts.space-tls
+ - name: https-mta-sts-lists-midnightthoughts
+ protocol: HTTPS
+ hostname: "mta-sts.lists.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mta-sts.lists.midnightthoughts.space-tls
+ - name: https-autoconfig-phorge-mtrnord-blog
+ protocol: HTTPS
+ hostname: "autoconfig.phorge.mtrnord.blog"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autoconfig.phorge.mtrnord.blog-tls
+ - name: https-autodiscover-phorge-mtrnord-blog
+ protocol: HTTPS
+ hostname: "autodiscover.phorge.mtrnord.blog"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autodiscover.phorge.mtrnord.blog-tls
+ - name: https-mta-sts-phorge-mtrnord-blog
+ protocol: HTTPS
+ hostname: "mta-sts.phorge.mtrnord.blog"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mta-sts.phorge.mtrnord.blog-tls
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -1,90 +1,3 @@
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: EnvoyProxy
-metadata:
- name: custom-proxy-config
- namespace: envoy-gateway
-spec:
- provider:
- type: Kubernetes
- kubernetes:
- envoyDeployment:
- replicas: 3
- logging:
- level:
- default: info
----
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: GatewayClass
-metadata:
- name: envoy-gateway-class
- namespace: envoy-gateway
-spec:
- controllerName: gateway.envoyproxy.io/gatewayclass-controller
- parametersRef:
- group: gateway.envoyproxy.io
- kind: EnvoyProxy
- name: custom-proxy-config
- namespace: envoy-gateway
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
- name: email-gateway
- namespace: envoy-gateway
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-dns
-spec:
- gatewayClassName: envoy-gateway-class
- infrastructure:
- annotations:
- external-dns.alpha.kubernetes.io/access: public
- load-balancer.hetzner.cloud/location: hel1
- load-balancer.hetzner.cloud/name: email-envoy
- load-balancer.hetzner.cloud/use-private-ip: "true"
- load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
- # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
- listeners:
- - name: smtp
- protocol: TCP
- port: 25
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: submissions
- protocol: TCP
- port: 465
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: submission
- protocol: TCP
- port: 587
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: imap
- protocol: TCP
- port: 143
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: imaps
- protocol: TCP
- port: 993
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
----
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
@@ -162,90 +75,6 @@ spec:
certificateRefs:
- kind: Secret
name: nordgedanken.dev-tls
- - name: https-stalwart-nordgedanken
- protocol: HTTPS
- hostname: "stalwart.nordgedanken.dev"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: stalwart.nordgedanken.dev-tls
- - name: https-webmail-midnightthoughts
- protocol: HTTPS
- hostname: "webmail.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webmail.midnightthoughts.space-tls
- - name: https-autoconfig-midnightthoughts
- protocol: HTTPS
- hostname: "autoconfig.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autoconfig.midnightthoughts.space-tls
- - name: https-autodiscover-midnightthoughts
- protocol: HTTPS
- hostname: "autodiscover.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autodiscover.midnightthoughts.space-tls
- - name: https-autoconfig-lists-midnightthoughts
- protocol: HTTPS
- hostname: "autoconfig.lists.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autoconfig.lists.midnightthoughts.space-tls
- - name: https-autodiscover-lists-midnightthoughts
- protocol: HTTPS
- hostname: "autodiscover.lists.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autodiscover.lists.midnightthoughts.space-tls
- - name: https-mta-sts-lists-midnightthoughts
- protocol: HTTPS
- hostname: "mta-sts.lists.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.lists.midnightthoughts.space-tls
- name: https-wildcard-phorge-mtrnord-blog
protocol: HTTPS
hostname: "*.phorge.mtrnord.blog"
diff --git a/apps/talos_cluster/stalwart/ingress.yaml b/apps/talos_cluster/stalwart/ingress.yaml
@@ -5,37 +5,37 @@ metadata:
namespace: stalwart
spec:
parentRefs:
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-stalwart-nordgedanken
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-webmail-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-midnightthoughts-mta-sts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autoconfig-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autodiscover-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autoconfig-lists-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autodiscover-lists-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-mta-sts-lists-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autoconfig-phorge
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autodiscover-phorge
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-mta-sts-phorge
hostnames:
