commit 5652570d6efd9136d393f768fa01efa285f46b0f
parent ba466667edd09bde57d65409dbd3b79566940906
Author: MTRNord <mtrnord1@gmail.com>
Date: Tue, 15 Apr 2025 14:09:17 +0200
Update network policy
Diffstat:
4 files changed, 54 insertions(+), 49 deletions(-)
diff --git a/apps/base/mailserver/release.yaml b/apps/base/mailserver/release.yaml
@@ -220,8 +220,7 @@ spec:
dovecot.cf:
create: true
path: dovecot.cf
- data:
- "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
+ data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
}}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n service
imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n
\ port = 993\n ssl = yes\n }\n\n inet_listener imap_proxy {\n haproxy
@@ -270,8 +269,7 @@ spec:
user-patches.sh:
create: true
path: user-patches.sh
- data:
- "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
+ data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
>> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
\ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
@@ -302,8 +300,8 @@ spec:
sectionName: smtp
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 25
+ - name: mailserver-docker-mailserver
+ port: 25
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -319,8 +317,8 @@ spec:
sectionName: submissions
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 465
+ - name: mailserver-docker-mailserver
+ port: 465
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -336,8 +334,8 @@ spec:
sectionName: submission
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 587
+ - name: mailserver-docker-mailserver
+ port: 587
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -353,8 +351,8 @@ spec:
sectionName: imap
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 143
+ - name: mailserver-docker-mailserver
+ port: 143
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -370,8 +368,8 @@ spec:
sectionName: imaps
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 993
+ - name: mailserver-docker-mailserver
+ port: 993
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
@@ -386,8 +384,8 @@ spec:
- rspamd.midnightthoughts.space
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 11334
+ - name: mailserver-docker-mailserver
+ port: 11334
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
diff --git a/apps/base/matrix/networkpolicies/matrix.yaml b/apps/base/matrix/networkpolicies/matrix.yaml
@@ -39,6 +39,13 @@ spec:
- ports:
- port: "9000"
- toEndpoints:
+ - matchLabels:k8s:
+ app: rspamd-matrix
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "11334"
+ - toEndpoints:
- matchLabels:
k8s:app: draupnir-synapse-keydb
io.kubernetes.pod.namespace: matrix
diff --git a/apps/base/matrix/synapse/kustomization.yaml b/apps/base/matrix/synapse/kustomization.yaml
@@ -10,7 +10,7 @@ configMapGenerator:
- name: rspamd-config
namespace: matrix
files:
- - greylist.conf=rspamd-config/local.d/greylist.conf
- - classifier-bayes.conf=rspamd-config/local.d/classifier-bayes.conf
- - options.inc=rspamd-config/local.d/options.inc
- - worker-controller.inc=rspamd-config/local.d/worker-controller.inc
+ - greylist.conf=rspamd-config/local.d/greylist.conf
+ - classifier-bayes.conf=rspamd-config/local.d/classifier-bayes.conf
+ - options.inc=rspamd-config/local.d/options.inc
+ - worker-controller.inc=rspamd-config/local.d/worker-controller.inc
diff --git a/apps/base/matrix/synapse/rspamd.yaml b/apps/base/matrix/synapse/rspamd.yaml
@@ -34,36 +34,36 @@ spec:
- name: rspamd-matrix
image: ghcr.io/rspamd/rspamd-docker:latest
resources:
- limits:
- memory: "1000Mi"
- cpu: "500m"
+ limits:
+ memory: "1000Mi"
+ cpu: "500m"
ports:
- - containerPort: 11333
- name: normal-worker
- - containerPort: 11334
- name: control-worker
+ - containerPort: 11333
+ name: normal-worker
+ - containerPort: 11334
+ name: control-worker
volumeMounts:
- - name: rspamd-matrix
- mountPath: /var/lib/rspamd
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/greylist.conf
- subPath: greylist.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/classifier-bayes.conf
- subPath: classifier-bayes.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/options.inc
- subPath: options.inc
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/worker-controller.inc
- subPath: worker-controller.inc
+ - name: rspamd-matrix
+ mountPath: /var/lib/rspamd
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/greylist.conf
+ subPath: greylist.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/classifier-bayes.conf
+ subPath: classifier-bayes.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/options.inc
+ subPath: options.inc
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/worker-controller.inc
+ subPath: worker-controller.inc
volumes:
- name: rspamd-matrix
persistentVolumeClaim:
- claimName: rspamd-matrix
+ claimName: rspamd-matrix
- name: rspamd-config
configMap:
- name: rspamd-config
+ name: rspamd-config
---
apiVersion: v1
kind: Service
@@ -95,8 +95,8 @@ spec:
- rspamd.matrix.midnightthoughts.space
rules:
- backendRefs:
- - name: rspamd-matrix
- port: 11334
+ - name: rspamd-matrix
+ port: 11334
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
