commit 6abe9986a60d75ae60e5dcc32568eb5944255f32
parent ba7409ebfd21f89395f6153444e7284d197bac48
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 17 Apr 2026 13:56:28 +0200
second try email direct-out
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
5 files changed, 160 insertions(+), 108 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/email_proxy.yaml b/apps/talos_cluster/envoy-gateway/email_proxy.yaml
@@ -0,0 +1,32 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+ name: email-direct-proxy
+spec:
+ ipFamily: DualStack
+ extraArgs:
+ - --use-dynamic-base-id
+ logging:
+ level:
+ default: info
+ routingType: Service
+ provider:
+ type: Kubernetes
+ kubernetes:
+ useListenerPortAsContainerPort: true
+ envoyService:
+ type: ClusterIP
+ envoyDaemonSet:
+ container:
+ securityContext:
+ runAsUser: 0
+ runAsNonRoot: false
+ allowPrivilegeEscalation: true
+ patch:
+ type: StrategicMerge
+ value:
+ spec:
+ template:
+ spec:
+ hostNetwork: true
+ dnsPolicy: ClusterFirstWithHostNet
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -25,6 +25,18 @@ spec:
name: custom-proxy-config
namespace: envoy-gateway
---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: GatewayClass
+metadata:
+ name: email-direct-class
+spec:
+ controllerName: gateway.envoyproxy.io/gatewayclass-controller
+ parametersRef:
+ group: gateway.envoyproxy.io
+ kind: EnvoyProxy
+ name: email-direct-proxy
+ namespace: envoy-gateway
+---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
@@ -32,15 +44,9 @@ metadata:
namespace: envoy-gateway
annotations:
cert-manager.io/cluster-issuer: letsencrypt-dns
+ external-dns.alpha.kubernetes.io/target: "65.21.7.19,157.180.84.123,138.199.144.31,46.225.148.120,116.203.40.165,46.225.115.168,2a01:4f9:c010:88a1::1,2a01:4f9:c012:96a5::1,2a01:4f8:c014:1a0e::1,2a01:4f8:c014:3000::1,2a01:4f8:1c0c:66d3::1,2a01:4f8:1c18:222e::1"
spec:
- gatewayClassName: envoy-gateway-class
- infrastructure:
- annotations:
- external-dns.alpha.kubernetes.io/access: public
- load-balancer.hetzner.cloud/location: hel1
- load-balancer.hetzner.cloud/name: email-envoy
- load-balancer.hetzner.cloud/use-private-ip: "true"
- load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+ gatewayClassName: email-direct-class
# no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
listeners:
- name: smtp
@@ -83,39 +89,21 @@ spec:
- kind: TCPRoute
namespaces:
from: All
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
- name: envoy-gateway
- namespace: envoy-gateway
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-dns
-spec:
- gatewayClassName: envoy-gateway-class
- infrastructure:
- annotations:
- external-dns.alpha.kubernetes.io/access: public
- load-balancer.hetzner.cloud/location: hel1
- load-balancer.hetzner.cloud/name: envoy
- load-balancer.hetzner.cloud/use-private-ip: "true"
- load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
- # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
- listeners:
- - name: ssh
- protocol: TCP
- port: 22
+ - name: https-stalwart-nordgedanken
+ protocol: HTTPS
+ hostname: "stalwart.nordgedanken.dev"
+ port: 443
allowedRoutes:
- kinds:
- - kind: TCPRoute
namespaces:
- from: Selector
- selector:
- matchLabels:
- app: cgit
- - name: https-talos-midnightthoughts
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stalwart.nordgedanken.dev-tls
+ - name: https-webmail-midnightthoughts
protocol: HTTPS
- hostname: "talos.midnightthoughts.space"
+ hostname: "webmail.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -124,10 +112,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: talos.midnightthoughts.space-tls
- - name: https-alertmanager-midnightthoughts
+ name: webmail.midnightthoughts.space-tls
+ - name: https-midnightthoughts-mta-sts
protocol: HTTPS
- hostname: "alertmanager.midnightthoughts.space"
+ hostname: "mta-sts.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -136,10 +124,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: alertmanager.midnightthoughts.space-tls
- - name: https-prometheus-midnightthoughts
+ name: mta-sts.midnightthoughts.space
+ - name: https-autoconfig-midnightthoughts
protocol: HTTPS
- hostname: "prometheus.midnightthoughts.space"
+ hostname: "autoconfig.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -148,10 +136,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: prometheus.midnightthoughts.space-tls
- - name: https-nordgedanken.dev
+ name: autoconfig.midnightthoughts.space-tls
+ - name: https-autodiscover-midnightthoughts
protocol: HTTPS
- hostname: "nordgedanken.dev"
+ hostname: "autodiscover.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -160,10 +148,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: nordgedanken.dev-tls
- - name: https-stalwart-nordgedanken
+ name: autodiscover.midnightthoughts.space-tls
+ - name: https-autoconfig-lists-midnightthoughts
protocol: HTTPS
- hostname: "stalwart.nordgedanken.dev"
+ hostname: "autoconfig.lists.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -172,10 +160,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: stalwart.nordgedanken.dev-tls
- - name: https-webmail-midnightthoughts
+ name: autoconfig.lists.midnightthoughts.space-tls
+ - name: https-autodiscover-lists-midnightthoughts
protocol: HTTPS
- hostname: "webmail.midnightthoughts.space"
+ hostname: "autodiscover.lists.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -184,10 +172,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: webmail.midnightthoughts.space-tls
- - name: https-autoconfig-midnightthoughts
+ name: autodiscover.lists.midnightthoughts.space-tls
+ - name: https-mta-sts-lists-midnightthoughts
protocol: HTTPS
- hostname: "autoconfig.midnightthoughts.space"
+ hostname: "mta-sts.lists.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -196,10 +184,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: autoconfig.midnightthoughts.space-tls
- - name: https-autodiscover-midnightthoughts
+ name: mta-sts.lists.midnightthoughts.space-tls
+ - name: https-autoconfig-phorge
protocol: HTTPS
- hostname: "autodiscover.midnightthoughts.space"
+ hostname: "autoconfig.phorge.mtrnord.blog"
port: 443
allowedRoutes:
namespaces:
@@ -208,10 +196,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: autodiscover.midnightthoughts.space-tls
- - name: https-autoconfig-lists-midnightthoughts
+ name: wildcard.phorge.mtrnord.blog-tls
+ - name: https-autodiscover-phorge
protocol: HTTPS
- hostname: "autoconfig.lists.midnightthoughts.space"
+ hostname: "autodiscover.phorge.mtrnord.blog"
port: 443
allowedRoutes:
namespaces:
@@ -220,10 +208,10 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: autoconfig.lists.midnightthoughts.space-tls
- - name: https-autodiscover-lists-midnightthoughts
+ name: wildcard.phorge.mtrnord.blog-tls
+ - name: https-mta-sts-phorge
protocol: HTTPS
- hostname: "autodiscover.lists.midnightthoughts.space"
+ hostname: "mta-sts.phorge.mtrnord.blog"
port: 443
allowedRoutes:
namespaces:
@@ -232,10 +220,40 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: autodiscover.lists.midnightthoughts.space-tls
- - name: https-mta-sts-lists-midnightthoughts
+ name: wildcard.phorge.mtrnord.blog-tls
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+ name: envoy-gateway
+ namespace: envoy-gateway
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+spec:
+ gatewayClassName: envoy-gateway-class
+ infrastructure:
+ annotations:
+ external-dns.alpha.kubernetes.io/access: public
+ load-balancer.hetzner.cloud/location: hel1
+ load-balancer.hetzner.cloud/name: envoy
+ load-balancer.hetzner.cloud/use-private-ip: "true"
+ load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+ # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
+ listeners:
+ - name: ssh
+ protocol: TCP
+ port: 22
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: Selector
+ selector:
+ matchLabels:
+ app: cgit
+ - name: https-talos-midnightthoughts
protocol: HTTPS
- hostname: "mta-sts.lists.midnightthoughts.space"
+ hostname: "talos.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -244,10 +262,22 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: mta-sts.lists.midnightthoughts.space-tls
- - name: https-wildcard-phorge-mtrnord-blog
+ name: talos.midnightthoughts.space-tls
+ - name: https-alertmanager-midnightthoughts
+ protocol: HTTPS
+ hostname: "alertmanager.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: alertmanager.midnightthoughts.space-tls
+ - name: https-prometheus-midnightthoughts
protocol: HTTPS
- hostname: "*.phorge.mtrnord.blog"
+ hostname: "prometheus.midnightthoughts.space"
port: 443
allowedRoutes:
namespaces:
@@ -256,7 +286,19 @@ spec:
mode: Terminate
certificateRefs:
- kind: Secret
- name: wildcard.phorge.mtrnord.blog-tls
+ name: prometheus.midnightthoughts.space-tls
+ - name: https-nordgedanken.dev
+ protocol: HTTPS
+ hostname: "nordgedanken.dev"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-openpgpkey.nordgedanken.dev
protocol: HTTPS
hostname: "openpgpkey.nordgedanken.dev"
@@ -532,18 +574,6 @@ spec:
certificateRefs:
- kind: Secret
name: morg-statistics.midnightthoughts.space
- - name: https-midnightthoughts-mta-sts
- protocol: HTTPS
- hostname: "mta-sts.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.midnightthoughts.space
- name: https-midnightthoughts-lists
protocol: HTTPS
hostname: "lists.midnightthoughts.space"
@@ -690,19 +720,6 @@ spec:
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
- name: email-policy
- namespace: envoy-gateway
-spec:
- targetRefs:
- - group: gateway.networking.k8s.io
- kind: Gateway
- name: email-gateway
- # WARNING: Cilium 1.17+ only supports the correct ipMode magic for this to work. Hence it currently fails
- enableProxyProtocol: true
----
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: ClientTrafficPolicy
-metadata:
name: enable-proxy-protocol-policy
namespace: envoy-gateway
spec:
diff --git a/apps/talos_cluster/envoy-gateway/kustomization.yaml b/apps/talos_cluster/envoy-gateway/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
- repository.yaml
- release.yaml
- gateway_settings.yaml
+ - email_proxy.yaml
diff --git a/apps/talos_cluster/namespaces/envoy.yaml b/apps/talos_cluster/namespaces/envoy.yaml
@@ -2,3 +2,5 @@ apiVersion: v1
kind: Namespace
metadata:
name: envoy-gateway
+ labels:
+ pod-security.kubernetes.io/enforce: privileged
diff --git a/apps/talos_cluster/stalwart/ingress.yaml b/apps/talos_cluster/stalwart/ingress.yaml
@@ -5,37 +5,37 @@ metadata:
namespace: stalwart
spec:
parentRefs:
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-stalwart-nordgedanken
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-webmail-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-midnightthoughts-mta-sts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autoconfig-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autodiscover-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autoconfig-lists-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autodiscover-lists-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-mta-sts-lists-midnightthoughts
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autoconfig-phorge
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-autodiscover-phorge
- - name: envoy-gateway
+ - name: email-gateway
namespace: envoy-gateway
sectionName: https-mta-sts-phorge
hostnames:
