commit 4b420fcd7183e18d3c6a7ac0b40ed39e2c83e4e0
parent 121c45f301fd2f42fd2150c7bead4c5357805d76
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 10 Mar 2025 21:35:04 +0100
meow
Diffstat:
2 files changed, 43 insertions(+), 39 deletions(-)
diff --git a/apps/base/mailserver/release.yaml b/apps/base/mailserver/release.yaml
@@ -52,6 +52,7 @@ spec:
ENABLE_AMAVIS: 0
AMAVIS_LOGLEVEL: 0
ENABLE_DNSBL: 0
+ # TODO: Setup proxy protocol in postfix and dovecot and envoy (See also https://docker-mailserver.github.io/docker-mailserver/latest/examples/tutorials/mailserver-behind-proxy/)
ENABLE_FAIL2BAN: 0
FAIL2BAN_BLOCKTYPE: drop
ENABLE_MANAGESIEVE:
@@ -219,7 +220,8 @@ spec:
dovecot.cf:
create: true
path: dovecot.cf
- data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
+ data:
+ "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
}}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n service
imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n
\ port = 993\n ssl = yes\n }\n\n inet_listener imap_proxy {\n haproxy
@@ -268,7 +270,8 @@ spec:
user-patches.sh:
create: true
path: user-patches.sh
- data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
+ data:
+ "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
>> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
\ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
@@ -299,8 +302,8 @@ spec:
sectionName: smtp
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 25
+ - name: mailserver-docker-mailserver
+ port: 25
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -316,8 +319,8 @@ spec:
sectionName: submissions
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 465
+ - name: mailserver-docker-mailserver
+ port: 465
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -333,8 +336,8 @@ spec:
sectionName: submission
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 587
+ - name: mailserver-docker-mailserver
+ port: 587
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -350,8 +353,8 @@ spec:
sectionName: imap
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 143
+ - name: mailserver-docker-mailserver
+ port: 143
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -367,5 +370,5 @@ spec:
sectionName: imaps
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 993
+ - name: mailserver-docker-mailserver
+ port: 993
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -97,12 +97,13 @@ spec:
modules:
- module: matrix_invitee_server_blocker.InviteeServerBlocker
config:
- broken_servers:
- #- matrix.org
- - matrix.im
- - funami.tech
- - suicideserver.net
- - cuteness-overdose.com
+ broken_servers:
+ #- matrix.org
+ - matrix.im
+ - funami.tech
+ - suicideserver.net
+ - cuteness-overdose.com
+ - xmr.se
persistence:
enabled: true
size: 20Gi
@@ -166,11 +167,11 @@ spec:
modules:
- module: matrix_invitee_server_blocker.InviteeServerBlocker
config:
- broken_servers:
- #- matrix.org
- - matrix.im
- - funami.tech
- - suicideserver.net
+ broken_servers:
+ #- matrix.org
+ - matrix.im
+ - funami.tech
+ - suicideserver.net
federation_reader:
resources:
requests:
@@ -396,16 +397,16 @@ spec:
- matrix.midnightthoughts.space
csPaths:
- backendRefs:
- - kind: Service
- name: mas
- port: 8080
+ - kind: Service
+ name: mas
+ port: 8080
matches:
- - path:
- type: RegularExpression
- value: /_matrix/client/.*/(login|logout|refresh).*
- - path:
- type: RegularExpression
- value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
+ - path:
+ type: RegularExpression
+ value: /_matrix/client/.*/(login|logout|refresh).*
+ - path:
+ type: RegularExpression
+ value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
ingress:
enabled: false
sops:
@@ -416,13 +417,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNnU2QzQxaDRUSzZweitZ
- cGRqZ2tVbzcyaDgxK25YR3VBd05vdjErTzBzCnhoUUtLQjJNUFcvS3gwZWFHQTRX
- SlRYbktmZHB3NUZVTGkraVpGbDFuRGsKLS0tIEhzUVp0eGFpS0x3b0Iwa0wyblha
- aVpTQ3NvSmNTaUlkRGRBZyt3NTFIOVUKfMOuzBi39ih3KEp1e8AYxMyBFs/lfoAT
- tBfnztH7yg4wKeey33TVfutV9fOOBsh8jH3qxPHbByqRZJUFJPWkQw==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNnU2QzQxaDRUSzZweitZ
+ cGRqZ2tVbzcyaDgxK25YR3VBd05vdjErTzBzCnhoUUtLQjJNUFcvS3gwZWFHQTRX
+ SlRYbktmZHB3NUZVTGkraVpGbDFuRGsKLS0tIEhzUVp0eGFpS0x3b0Iwa0wyblha
+ aVpTQ3NvSmNTaUlkRGRBZyt3NTFIOVUKfMOuzBi39ih3KEp1e8AYxMyBFs/lfoAT
+ tBfnztH7yg4wKeey33TVfutV9fOOBsh8jH3qxPHbByqRZJUFJPWkQw==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-01-18T14:02:39Z"
mac: ENC[AES256_GCM,data:cqQ7aC03mgh+oBcOYywJo+gqAY+SybgqRmgbCgbZ1mDs0boNfLEAVV4PjuaEutA5Wcq2046rE4gedcUDqxZJpznJquQ0Pcf1oH2pQ/qWSIiOKPf7deeWF5QjClKsg6s+LObdpHpg2QTuOzzwm45guvf40kqlwQQCSi5WVTRlu5g=,iv:lnT8jDGhm1UfrwHp11s5y1W5zkNEoddRn+j/xSq38Io=,tag:K7NfHNUev8C2KjY81QOE4g==,type:str]
pgp: []
