commit 769b9328b7cd023e209df989b2e73d794118a920
parent 74feac965cc97a08ae7a35a0e2bac3d161b373bc
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 1 Oct 2025 20:13:47 +0200
Meow
Diffstat:
4 files changed, 374 insertions(+), 259 deletions(-)
diff --git a/apps/talos_cluster/mailserver/kustomization.yaml b/apps/talos_cluster/mailserver/kustomization.yaml
@@ -14,14 +14,21 @@ configMapGenerator:
- name: mta-sts-content
namespace: mailserver
files:
- - mta-sts.txt=mta-sts.txt
+ - mta-sts.txt=mta-sts.txt
options:
- labels:
- app: mta-sts-server
+ labels:
+ app: mta-sts-server
- name: mailman-nginx
namespace: mailserver
files:
- - nginx.conf=mailman-nginx.conf
+ - nginx.conf=mailman-nginx.conf
options:
- labels:
- app: mailman
+ labels:
+ app: mailman
+ - name: mailman-uwsgi
+ namespace: mailserver
+ files:
+ - uwsgi.ini=mailman-uwsgi.ini
+ options:
+ labels:
+ app: mailman
diff --git a/apps/talos_cluster/mailserver/mailman-secrets.yaml b/apps/talos_cluster/mailserver/mailman-secrets.yaml
@@ -5,11 +5,11 @@ metadata:
namespace: mailserver
type: Opaque
stringData:
- apikey: ENC[AES256_GCM,data:6hcmXgaze9UPlpL4a60VNK+ROz6JYHNoq+N5OkAnhotXIW0zIy5xk5SFcKzKBwwvr9ZhLBkH5yF7+zvnvpEFHA==,iv:kERRJIKjETOTH0HbqKEFk65nIC1hHcgakVbCW+b+Cg4=,tag:gpcdwGFvtDbowG4eF2BHjA==,type:str]
- restpassword: ENC[AES256_GCM,data:CQrSfuHKHWgpeYc6g1j8DSXqBfzsGBj+eXUx+T07PDU7/mA+UUP+iYnom+98VZ2/cmJGKs03RHjiQEf14E3q5w==,iv:OE7UKd3T6rqBWNTnalgjuXX9sGxqR1E82o6GKQrUljo=,tag:8HCCeAsqm/fpxwarFP7bZQ==,type:str]
- websecretkey: ENC[AES256_GCM,data:13MrKIW68a7aFutqq+KhKWH4hfSea3UPGRjXAus8nfsDpuB+UIx4AGulVVQfumyT7QcaSKPvYSK8Kwbope3ySA==,iv:MSD/tyY7WeaENRHjAzMGj1McJiS/CxJx+bqyTpPbBo4=,tag:4RGHwpev0Mmjj9iSOIiELw==,type:str]
- smtp_user: ENC[AES256_GCM,data:OJbPxcgMwfaJaBeRxAl0BMkHrwsoWZzuP7tJN5rC,iv:7vPcAx3lWfUS2qqHhg7CNcM6kMK7JRXWy4R5D2pT3lo=,tag:ds9MEA5Ad8ex+bHHAn/qzA==,type:str]
- smtp_password: ENC[AES256_GCM,data:V7jt5nrYaGuZ8Xy5f0s4pkimVuKPMwIdDx4kOfw72xY3DkFQNwkopLl2fvo6kb5pAviiI5ilHEcAED1KSez6IQ==,iv:bDw3yRoT8UeoW9at2JOnT3WaMklj1FAbqwbyM7TP8pA=,tag:al6hGowKvjPEudpsZy0pZA==,type:str]
+ apikey: ENC[AES256_GCM,data:GpZbYxp9NlsDe7J5idMG+HAlVUGvEDKHgX471tvylQHpQoPAPWG0AQ10/Zh6psYQmEP9NzqUcZX8FqhGdsQTsQ==,iv:c3YQxsErV5kYQ/N1/P5NkY7bUfD5Q6AWdi8nHXHJ9EM=,tag:4TND5VnKj2Lo4AUvd345sQ==,type:str]
+ restpassword: ENC[AES256_GCM,data:tBoYCKcDNHWnp1+i5alru1Mi8tC/a90v2estjjAJKkiJkAFxvOaLV2cm0F5ZadrWOTjDqbmvfAse5fKb9emomA==,iv:AX/TCm07PVT0n6h6R8Tyfoi2OlaRBOAS0rnwBeyz1r0=,tag:5shq07sClJbDcM+soSgNYQ==,type:str]
+ websecretkey: ENC[AES256_GCM,data:tx7j0+n3z2Xixz41M/8Ijrx/P82Fx/pRwM/xHos+3K9jPf0QhIkZI1pVkVws0D2FmtwsT3+f0C63O1R7B2IsvA==,iv:9R2r0NYC5ewqcZ8Y3Yq4QBsDiaBXzuw+KE5UCdufc6Q=,tag:fMklAM4Lu5Zt5m//h5Epgg==,type:str]
+ smtp_user: ENC[AES256_GCM,data:5ChqR4evH+KG0kJaKtVArPGPnV9T5xHyyrSlRqE/,iv:zlvuoHU1CcriRDH3UeVZr1J8BAzs1IjQWjmpldZx0cQ=,tag:mKaomzcfmGBW/IRyIH3d/A==,type:str]
+ smtp_password: ENC[AES256_GCM,data:GK7mIN8zEl+ZXva+bJ68ak/ViAPeeTESldo3lMslXjs4WT2mSHdXsp3HgSk/qfMvXynAGiiiZv3/GcdycEek0g==,iv:BpAPhVSN2w1WIWKlaVPFtBIMmPIVvpVe29jFFiTeD/g=,tag:gWH1igGC5/HBXdGpZ6ps4Q==,type:str]
sops:
kms: []
gcp_kms: []
@@ -19,14 +19,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrblpCb1BlSm44dHYyTlE5
- U0ZVZzFiMnpFUkNER3p5RXpHaStqMnJ6QXowCisxaWhnaWs3VVJsZ25jUUdvNHBM
- UFVFMGhiZjZvREpxd0JyMnozVW1YV1UKLS0tIE91QjZhdjRGYUNKUmozY3R0NFNv
- bUN2dWNGM1EyNDJZZ0hHZDEyanpudmMKjXXuuQBSm90Nur725aXvhNY/b6E77Xeu
- NiQszbEDsGJyAisEnTCTn/xtlmLARjIlZ8ut3nKSry27U/PCb71nDA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNENucnY3UnFkREYvZGZj
+ NklpamZJUkkyN3QzWkcrKzBLZGNHY0c0YlhFClR4NU1RblBaQTdzWnFaTzRYMGl6
+ bGU4YXRtOTUxRWhYNGs5VE03akYvN2cKLS0tIG9QMGZVY1ViSDhMUmNCOFdhRS9h
+ QU55RGpGdHhBZ1RUQlh5bHhWUFhoRXMK6qESXuW42StjnKy9rxNUIaEoYODv4Atn
+ n7ibn0iQtLtryO5XbIHNBKC9kc4+1eSCefV8FQagEKJtjbCJpOxo7w==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-10-01T17:48:35Z"
- mac: ENC[AES256_GCM,data:ko1/OeJMtip+6FcQqFYFi0tYyiUxozUvPYMjqziXNPwfBacEFEPjbMpFBQBkaPVC+2TjArdJDmBR7vi3ElBH68j0YnQY4R65Zjq7C2kwDaVOTHLh+LyVB7+7sJd1U4XacOhIWx77anCwVuMjI46gSns2YDmbi22QVryHiKhVIaM=,iv:b0CC7gVCk1ERpsry8l52sP/3qyM9nRpmUd6ZLOW8eNE=,tag:LlJheHarMLvIIhnPU2+yJw==,type:str]
+ lastmodified: "2025-10-01T18:13:45Z"
+ mac: ENC[AES256_GCM,data:YgKCyIXN/sAYoXAZ61JA5mMg3kJaYknt4E2ggkS4rUANkLvXKWEOUtAp+Ek2MHrwd2e9tKR5Acj9qvp5gI35gyier+0oP+4COTYWarKun0MhEK6MsbXQz8td01eVgr+kEK4BP+K6RDRlJjCEpdNZv4inudF+6Gun06+hw7L6Dww=,iv:KRaQDxRDyLI4kK457ybX6ZoZHGeQrVNA9WPCPMngeQU=,tag:MasIHjaoTCRGbuxAOcjw4g==,type:str]
pgp: []
encrypted_regex: ^(harborAdminPassword|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
@@ -38,9 +38,9 @@ metadata:
namespace: mailserver
type: Opaque
stringData:
- mailman-extra.cfg: ENC[AES256_GCM,data:Ayes7SIkNzeJtua3nmu5BQ1aGfd0kfRSi/jm/342Dzq9MQJmqPLpulrGKq67kXBPO759TA==,iv:brwd6nf8XXzs4gM9JmAY6/N1Vqpg9BPtmp+wcNDjkuM=,tag:pPtbhQGp5IRKLd4GGG8wJg==,type:str]
- settings_local.py: ENC[AES256_GCM,data:taYMGztSgu9UeriXbCrcmAa9GBZhhwAMuO1O6AxbnIRZRSOsC4laxXUFjUwFukXjZl6xAvOJOpCw1pPiAzSbEwe9sy+CWVE7MzX4rEM4ICGpF7M99kXQm0z92cmSgy4n4LQZRhwHjL3PQegdsAwAHuWiZmpnEIjp9VYGgp/tMmMGwBVZ6p9qP+il49itiNN3RcBCfM9g6JY7Dj7ByAIyoy0KMqfMVY7bfGo30n3ty+WQgK5L9ls/V/x/r5ssBOnT3nSFFRENHlyuSH7xXdlRIwdT352eKEedgFItBsI/xFY1btN3JQjA6s0+rWf1DY9hBl1FdxYJSZbIIJIQdBQMk5wzIZCrt5rEi+wxj08SnMlctMZHAH4Fur88CmuS8YQWyFHBpf4HOngbcqMp7eLn7sKpWy1gm8jwuNAY8GnQeeWFJDvCrg9jjWCKQQUUAszkRfqgbdWXyjpeZN5qmm3hUfp3GBnEBoNAQdaFIOPa6X/xXRSZBORrKF6tOazxe+xEn/gEvih0v5VKG2CRxb3GpJypEnlDsWH78ZEYa4cipHokDr4XAWwUoum1gMdxe1xXhTJUtQS754F3UQnrPTtuudQPOBa8cXf3lC3uGNwttsNlLTlB2DYx3Us=,iv:Qk1/nGnXDV6xFVYPf3xmQgcyljvUJ6I9MUe/wumboF8=,tag:+qEbJyKxir+OudXbl5wmyQ==,type:str]
- chown: ENC[AES256_GCM,data:ugRnwrzXWn+cbAJEfQjnBUzjw6IMNSwVFrIa0d9u9Y4ASDo=,iv:trhxB8Pl5OGpdxD4BWbTZ2XMhJPdS8kR1XIVfl+tECE=,tag:AssuIAxkGJVieRZCSOCngg==,type:str]
+ mailman-extra.cfg: ENC[AES256_GCM,data:KHTumnny54+u0oCljkcm9GRPzx77CYBUbVJx3cctqAwB7PcjNGz117iHudXK41UnthqR9A==,iv:CwmBzpSHmk/T17LzsK2Fd6jFu0DL2x0eOCzsG3y8e+s=,tag:CAsC8CQnWNriAq3XS61kLQ==,type:str]
+ settings_local.py: ENC[AES256_GCM,data:vek/jMKAlK2s2exMM4JEftEpzUxrjfa+KcziZFpwfen6p2nHLD724RQol3Yc9l81N3Q16gLbbOe2niY5L7NUs0XxU5xvubIzEM6sMD7PqB3bb28Y4dbz72g1N9dhk9IZiQ6KhWRnO/E4cJcO/ieY3PKW7IFMo2znyCPYPwf0LB8ntBWd4yQCWYq/vUhTaOGRNHmTDyW5qY0ADhGeB8/Y2/Nf1WbP4obifXYUp96nPPUXWFZu38g+DgkMmk84+zTNYyKdknINaCt8+Yh6Ry/HpLCxUE9FiNZtbWFRBJ5twG15EOG7oPh2PcPWMYJhDRToW2ONajwyu5x+kY8EfTOFNOGw7O0BqDPCDfyEkofw4LiObqTkRjgV6caviCBOknfhkPJkylxGut0r09mhrv4MmURxJJ0d+Ik7pAa9FSm7vrl4qM6higALcbZfSOgxJdJTJ+ELtBM0mgddtjNnZvEGQW8i/W+1A5hIihukMkmCdSup1DbQVNkRBCIc6RBvdHWZGApiLAqU6GP1UYpu2sDtPh7utObR4Y1qqR3QyQn5/j0tcbBKIUvRnQ5xFXjsFoKqM2XJBk7bvaRXcQecNZylV+WCbBCjWt1d8AuSJFXh+1CMIaABizoCjEbp2srjaOfFQxKanaEZ6aCaH/sigAwW7/PbZJ3bZ9Sx/zh/WqdYYAR9yu2MchKqfNqJtfNL7K6DpgqRV4n/ciTKyq6XYkKXnQLfSeJ64gdZOnUnKcUdAQj9oeyrfnFxD1tWR3/ErJQon0mIDYhn3b/f2JTniTndRg2zcGnCFyX8Lvf5z0bBXO9gfYzeV2xkHnHf/t1ELil31aEXQ57AitPNoPv1dkzfZRtSzwoKVn0nTTftdc5vc3PLdpYEelvdFFuRwpzUk1q/SUFy/isMCIN25msYZ138GNZYmfNGNQvrqFqH0gTLKOqI4dNUEQPdPY0iTi15+8txwS+ybwKCbK/gpZsqlBhIvXUDPwPYvdG5DEP2f/2hUF0kbzDNdwTnkwBuRzQe4He40xuu6tsvxqz1VIdP2Qkct4lE0JNFuRqLEdx+DwzLrycHVTrefFVGlaDx1kKTIpLjjdg5jCQRhMQMRhbywzhGZW8XbUboUhNjwFxTPtIp46afIf96rNZw3dT3KKwJMcdMwkCRX1jzhLOiTktbPtJBof/P0BaRskvQ5BPn6v3fEdFdEX6L07zYTc6MwFbHTVidOWT4gG3VXB4V7KOYBdF5J6LerfJE2E2K+N+Yr6rAHErcVvyY0UU9BmFMkyYwa42kZISMSgvS1UVtlHi7sxZZ7TBpd+n2PeFXV16431pJgzUk4zwcjQ+7TpU3LOYas+j4eYh65t5BM3xNlAcQdq/WE5LqUIJvWzyC73IrA3dKSAoaPg14TSDkd4DWWqcoPY82fl+Qs3x+/xX7q8+VuI7XdN54EiyzdPpfz9aHfBl+/P5oXW/3lDhDEihnMX1odthgx9pgdMMB2U8xZ4uasTVrXz5rdItpvTzTnHtRLOGHcNA0+YD+9N/lAECPA08btHR3JtI5FhxfBm6YOWvrCIYTqcE+KW3bAcAPwFfmoKJBCegJI0mvblyY3wK0E1PSWX7lQb9LoHCbQTT27zA2Cswg3BZP7xay/64GaMg/ikMwdYYuerOVHvITe5G3ZHVkemWwtnnShxEqnZAsnXPeOaHboh4jBP5zgJzIFWwod6fKEcOFgvpuPBizfMxrVml7RalUG0+Jau6UbxXLaXZnLtozZQjWnQ1t3WCMosj1gOGXgu+fjGLtW8GuqYkaM8+HiUNhh6CxGz/2qoNasfgc8cEpDQH1wwtkO24m7tyCUxgw79pquJV+iGbdANplYqkFSwReuvryWwEdCNjCqqLiJawbjMC/ieAHMPm3gIR++8Q7V5FAQUndM/DndWu5ZYgQZJSeJzD1e6Twhx8dL1ydB47zRCNk+o5v7Sr5CRwxyU3s8xILCxLTzBWFjkvG5sCJx7X0ZtjctEWyEOBMrAkaHqDQYM6QrxiREbh+GuIMsJ0lQqhZKNr6pV2BV9jgSP1vzBNX9L156wdhv1w4vDiggzdU2QMA/NhkOXkrhh76wSoxrNvDYusPl2D45fIKQxet2XlXjMyN4IQC8HWF+oZ29NnAO62/w/crkrfTD6sogLqvjdmmAb11O+6jlbRxTKpCTwC0BKQiMU3sbWRIicIs0JTMTvCYSEDJsuIbog8hgDOys5M7aqJyFwg6paBnqrCIWZmycqkiyRja79QKXCnLRV1bR2nD6LbISy4/8fG7c6Rcpexyf+R50avY4VQ6d3+dhEMuz07B0AvahGEKHJ5tdfoUs97JKLUqMFqKJl4/RLNkUMuROKMLHdiaWoEcs6cCinOBq+rZHOwlbsI5/kVKE3wSpChfpGsrTNjfkA0ER+woWjzvWxxFIQdBQhr5RR/Hfr4F/djgEc0z/zBGq9zY0zFcJA/qmLiOEmamuy5i0U7x3seqyeeT+oiEe8EY0Pizw9BGwVwe++Ctdw9a5pFfVsOolfIZ25IrF4gJ4deGZ7O68MVnb2Rt0NEjQvFX6UggFJWo0GrsUtRUxIiBwKTMIpsqucpUgIl4IIdrGp4d0U+13+ZTAhZ1I7fKneNDXhoF8c+zhKGiVWh1/UoGXnr7aHjOUEuUtz8XZcetufs/AlsHkWAquAMPgDpih5gBtwQjUaCK4EDvRDClKypOdQ1qAQDuPRnJGunjcMPLLYRWlP2sRbzyfL03f99RGU7ZBxT569+FcQYN68AcGvU8/VD2OIfUPX7TNcOyURVGmedD9P5Hx87Ub0+fbnQ1pJHt3KKQ9SyWiS/6/2p9EJShZn7KSbJhezSJ8jBjIoJ3JdTNI1+IXxYPsjLynGn2h84yR1hpCe9PCBvi6DTIhIKK7/+2h70cKIvEK69d3KHiv5CxplNAm0UQT2YUQvRvEIFKGZgVp8MBKHk1Cm5KQMWzd14hVNJ7snQPkUgWU9jz1gR3CKy/Pdqpgro+M16zRDgs4MfmofzWseAjvHo/Kefp4sn2uwZ2laRl6sQCihFuADn0fmurbncHBMQ0iu3p4/dTjmqDBcceexMYW64h9HXaTOsI/Vnzob/Ke54AujMI7VhubI5p3XqHXVKfton55BcxtybAMPmaK4SJavlV+YYKHewmh/FJLxNAmB8FQXuYkSH1JivuvjmQSGEgotnwX/XLytPx6vCYwr1SHuGdF81EEzPiCfbNrw8MvO21K8LRFl0YolDBCPnB3pt5d/bzz+YBMu/E9dU6PkWJQUhyPIgMdryvZ9PSxk7A8kdVNJxheNRb32tSRN4UDRcAQSoY6yg4wBFhQTvs8INe6grhx2pBDI8QyGgrARFchi8yQxxtIn6e0KK6RIm0ik821hpZxPNPX+mevjexNnZQI3cGfjF2j/IGPH3SiAYswwcsEMnaqWf6GTA2/wLzBdzhs816AbWv3Rejoa6wqqyOAkeH5zVlOFUpcpPacJ87DDJ2KcDrrkz29WI2JM9iFAvP9Ry74Ib5VFTm6C3w,iv:DjPBXUMiK4hGewP7c6+fPCDE61A5WdvXOJudooueR/M=,tag:w9zTqXV7qSXQwQXvdYtgyA==,type:str]
+ chown: ENC[AES256_GCM,data:nm0msj7u/MNJ8A7o8+lO6ayk3nueZnu0ZJACWHfDXXv5GWo=,iv:bj0VS4cGLrXx+gxs2/kXoeVCIwLCM+OqEo0sOQsDW8E=,tag:ScjCef3aWlOW64f4PnvA/Q==,type:str]
sops:
kms: []
gcp_kms: []
@@ -50,14 +50,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrblpCb1BlSm44dHYyTlE5
- U0ZVZzFiMnpFUkNER3p5RXpHaStqMnJ6QXowCisxaWhnaWs3VVJsZ25jUUdvNHBM
- UFVFMGhiZjZvREpxd0JyMnozVW1YV1UKLS0tIE91QjZhdjRGYUNKUmozY3R0NFNv
- bUN2dWNGM1EyNDJZZ0hHZDEyanpudmMKjXXuuQBSm90Nur725aXvhNY/b6E77Xeu
- NiQszbEDsGJyAisEnTCTn/xtlmLARjIlZ8ut3nKSry27U/PCb71nDA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNENucnY3UnFkREYvZGZj
+ NklpamZJUkkyN3QzWkcrKzBLZGNHY0c0YlhFClR4NU1RblBaQTdzWnFaTzRYMGl6
+ bGU4YXRtOTUxRWhYNGs5VE03akYvN2cKLS0tIG9QMGZVY1ViSDhMUmNCOFdhRS9h
+ QU55RGpGdHhBZ1RUQlh5bHhWUFhoRXMK6qESXuW42StjnKy9rxNUIaEoYODv4Atn
+ n7ibn0iQtLtryO5XbIHNBKC9kc4+1eSCefV8FQagEKJtjbCJpOxo7w==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-10-01T17:48:35Z"
- mac: ENC[AES256_GCM,data:ko1/OeJMtip+6FcQqFYFi0tYyiUxozUvPYMjqziXNPwfBacEFEPjbMpFBQBkaPVC+2TjArdJDmBR7vi3ElBH68j0YnQY4R65Zjq7C2kwDaVOTHLh+LyVB7+7sJd1U4XacOhIWx77anCwVuMjI46gSns2YDmbi22QVryHiKhVIaM=,iv:b0CC7gVCk1ERpsry8l52sP/3qyM9nRpmUd6ZLOW8eNE=,tag:LlJheHarMLvIIhnPU2+yJw==,type:str]
+ lastmodified: "2025-10-01T18:13:45Z"
+ mac: ENC[AES256_GCM,data:YgKCyIXN/sAYoXAZ61JA5mMg3kJaYknt4E2ggkS4rUANkLvXKWEOUtAp+Ek2MHrwd2e9tKR5Acj9qvp5gI35gyier+0oP+4COTYWarKun0MhEK6MsbXQz8td01eVgr+kEK4BP+K6RDRlJjCEpdNZv4inudF+6Gun06+hw7L6Dww=,iv:KRaQDxRDyLI4kK457ybX6ZoZHGeQrVNA9WPCPMngeQU=,tag:MasIHjaoTCRGbuxAOcjw4g==,type:str]
pgp: []
encrypted_regex: ^(harborAdminPassword|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
@@ -69,7 +69,7 @@ metadata:
namespace: mailserver
type: Opaque
stringData:
- url: ENC[AES256_GCM,data:bV2DYSmEnQs7YI1u1hWVogrLqASd+aQ5JgEdhHmMSvwDwGdcE5r6ZIazahItjNpJuuiYMisMNln6Op2xWNhubh3zrAtlulcGzVEOfMVp7aC+kC8P6uEU1TeQLLgxXNRIFQmN6/I/O7C69Nk3jVQ6EjyK3eHqwcjhfxiJ2+JlUNP3GggpBAO9zhgPR5HbKDV4FA==,iv:L4HiTQUDM3W8OMhw4OOJMF4YRrVYQTFyhOrVK7seEkw=,tag:7lQHpqsx1TL4KTBqO55+aw==,type:str]
+ url: ENC[AES256_GCM,data:+6xAXI/k+GZl0xjqk6gi61fzvrgifMekAv3/MleQM+7DybSEZpVGPgzfZf9XHrswGl+MhZ/ZWItO6bqLBhJYbLmUh4PW6Kv+D+lOkxNr6qSc1bP35Wa5vco1jgy7tohdzeUemiQAl2Hxyp1Bugc7yv7gBck52sHcUt7qdO1mAmVuoAZNtuEniFsM1gYTtcJKzQ==,iv:i7Ix61/7HX0eTFIWgp1NwaynxI6sUddVITuH1+qJ4nI=,tag:CrWDYa5aWQP7i5cXpDcipw==,type:str]
sops:
kms: []
gcp_kms: []
@@ -79,14 +79,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrblpCb1BlSm44dHYyTlE5
- U0ZVZzFiMnpFUkNER3p5RXpHaStqMnJ6QXowCisxaWhnaWs3VVJsZ25jUUdvNHBM
- UFVFMGhiZjZvREpxd0JyMnozVW1YV1UKLS0tIE91QjZhdjRGYUNKUmozY3R0NFNv
- bUN2dWNGM1EyNDJZZ0hHZDEyanpudmMKjXXuuQBSm90Nur725aXvhNY/b6E77Xeu
- NiQszbEDsGJyAisEnTCTn/xtlmLARjIlZ8ut3nKSry27U/PCb71nDA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNENucnY3UnFkREYvZGZj
+ NklpamZJUkkyN3QzWkcrKzBLZGNHY0c0YlhFClR4NU1RblBaQTdzWnFaTzRYMGl6
+ bGU4YXRtOTUxRWhYNGs5VE03akYvN2cKLS0tIG9QMGZVY1ViSDhMUmNCOFdhRS9h
+ QU55RGpGdHhBZ1RUQlh5bHhWUFhoRXMK6qESXuW42StjnKy9rxNUIaEoYODv4Atn
+ n7ibn0iQtLtryO5XbIHNBKC9kc4+1eSCefV8FQagEKJtjbCJpOxo7w==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-10-01T17:48:35Z"
- mac: ENC[AES256_GCM,data:ko1/OeJMtip+6FcQqFYFi0tYyiUxozUvPYMjqziXNPwfBacEFEPjbMpFBQBkaPVC+2TjArdJDmBR7vi3ElBH68j0YnQY4R65Zjq7C2kwDaVOTHLh+LyVB7+7sJd1U4XacOhIWx77anCwVuMjI46gSns2YDmbi22QVryHiKhVIaM=,iv:b0CC7gVCk1ERpsry8l52sP/3qyM9nRpmUd6ZLOW8eNE=,tag:LlJheHarMLvIIhnPU2+yJw==,type:str]
+ lastmodified: "2025-10-01T18:13:45Z"
+ mac: ENC[AES256_GCM,data:YgKCyIXN/sAYoXAZ61JA5mMg3kJaYknt4E2ggkS4rUANkLvXKWEOUtAp+Ek2MHrwd2e9tKR5Acj9qvp5gI35gyier+0oP+4COTYWarKun0MhEK6MsbXQz8td01eVgr+kEK4BP+K6RDRlJjCEpdNZv4inudF+6Gun06+hw7L6Dww=,iv:KRaQDxRDyLI4kK457ybX6ZoZHGeQrVNA9WPCPMngeQU=,tag:MasIHjaoTCRGbuxAOcjw4g==,type:str]
pgp: []
encrypted_regex: ^(harborAdminPassword|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
@@ -98,7 +98,7 @@ metadata:
namespace: mailserver
type: Opaque
stringData:
- url: ENC[AES256_GCM,data:WigfCNe6M+vUf80BzwlUIC5x7iIHdAQdjJHo3LOlSJt+Y6ES2tuib639UA1Dqmvl9vRffI969cKAt3YnrVOIjhc5nit6TM4/4ids/VeMZqMuEMTX7QreM1KHIluIvHUic7SmzJO25B8Hb2sOM27MHl3dSwCiD797XOSsw49zKR/ZSrZK5aRwnUKvtCGj12LJ3g==,iv:dBheHaQ0uwZikaeBxEtBSZ6NQkOH0wkGTkB+E4XBuKo=,tag:1KWxA7YciH6J3AiFPX86Dg==,type:str]
+ url: ENC[AES256_GCM,data:ue2a3m8DzSPj0Nu+keQM7Drm7+uqylcY1yksZs2vA6shseCD6yjfU8D9CwiwEpAAJldGq2W7GKvc4P/a5TQGceo3TJAo/B0SdfV1mqcWFBJwlEbdFKGwOHwr8CgFBsc1ZPuqtwczgNzAXeeqHkc/wsujAzAsqAQP1MIWomEaFCAesxtyJ5i3VPPtLDE7xCtoXg==,iv:g9eIxwz6oQRhAopEnqDnDLjsCmn8WSyy0cwIei+5SCo=,tag:aK0QF5JeIej2AvcBhMc3Nw==,type:str]
sops:
kms: []
gcp_kms: []
@@ -108,14 +108,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrblpCb1BlSm44dHYyTlE5
- U0ZVZzFiMnpFUkNER3p5RXpHaStqMnJ6QXowCisxaWhnaWs3VVJsZ25jUUdvNHBM
- UFVFMGhiZjZvREpxd0JyMnozVW1YV1UKLS0tIE91QjZhdjRGYUNKUmozY3R0NFNv
- bUN2dWNGM1EyNDJZZ0hHZDEyanpudmMKjXXuuQBSm90Nur725aXvhNY/b6E77Xeu
- NiQszbEDsGJyAisEnTCTn/xtlmLARjIlZ8ut3nKSry27U/PCb71nDA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNENucnY3UnFkREYvZGZj
+ NklpamZJUkkyN3QzWkcrKzBLZGNHY0c0YlhFClR4NU1RblBaQTdzWnFaTzRYMGl6
+ bGU4YXRtOTUxRWhYNGs5VE03akYvN2cKLS0tIG9QMGZVY1ViSDhMUmNCOFdhRS9h
+ QU55RGpGdHhBZ1RUQlh5bHhWUFhoRXMK6qESXuW42StjnKy9rxNUIaEoYODv4Atn
+ n7ibn0iQtLtryO5XbIHNBKC9kc4+1eSCefV8FQagEKJtjbCJpOxo7w==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-10-01T17:48:35Z"
- mac: ENC[AES256_GCM,data:ko1/OeJMtip+6FcQqFYFi0tYyiUxozUvPYMjqziXNPwfBacEFEPjbMpFBQBkaPVC+2TjArdJDmBR7vi3ElBH68j0YnQY4R65Zjq7C2kwDaVOTHLh+LyVB7+7sJd1U4XacOhIWx77anCwVuMjI46gSns2YDmbi22QVryHiKhVIaM=,iv:b0CC7gVCk1ERpsry8l52sP/3qyM9nRpmUd6ZLOW8eNE=,tag:LlJheHarMLvIIhnPU2+yJw==,type:str]
+ lastmodified: "2025-10-01T18:13:45Z"
+ mac: ENC[AES256_GCM,data:YgKCyIXN/sAYoXAZ61JA5mMg3kJaYknt4E2ggkS4rUANkLvXKWEOUtAp+Ek2MHrwd2e9tKR5Acj9qvp5gI35gyier+0oP+4COTYWarKun0MhEK6MsbXQz8td01eVgr+kEK4BP+K6RDRlJjCEpdNZv4inudF+6Gun06+hw7L6Dww=,iv:KRaQDxRDyLI4kK457ybX6ZoZHGeQrVNA9WPCPMngeQU=,tag:MasIHjaoTCRGbuxAOcjw4g==,type:str]
pgp: []
encrypted_regex: ^(harborAdminPassword|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/apps/talos_cluster/mailserver/mailman-uwsgi.ini b/apps/talos_cluster/mailserver/mailman-uwsgi.ini
@@ -0,0 +1,64 @@
+[uwsgi]
+# Port on which uwsgi will be listening.
+uwsgi-socket = 0.0.0.0:8080
+http-socket = 0.0.0.0:8000
+
+# Enable threading for python
+enable-threads = true
+
+buffer-size = 32768
+listen = 1000 # Socket backlog
+socket-timeout = 30
+http-timeout = 30
+
+# Move to the directory where the django files are.
+chdir = /opt/mailman-web
+
+# Use the wsgi file provided with the django project.
+wsgi-file = wsgi.py
+
+# Setup default number of processes and threads per process.
+master = true
+processes = 4
+threads = 4
+lazy-apps = true
+thunder-lock = true
+
+# Memory and connection management
+max-requests = 1000 # Restart workers after 1000 requests
+max-requests-delta = 100
+harakiri = 60 # Kill requests taking longer than 60s
+harakiri-verbose = true
+reload-on-rss = 512 # Restart if worker uses >512MB RAM
+
+# Drop privileges and don't run as root.
+uid = mailman
+gid = mailman
+
+# Setup the django_q related worker processes.
+attach-daemon = ./manage.py qcluster
+
+# Setup hyperkitty's cron jobs.
+# 'minutely' jobs are run hourly for perf reasons.
+# See https://github.com/maxking/docker-mailman/issues/327
+unique-cron = 0 -1 -1 -1 -1 ./manage.py runjobs minutely
+unique-cron = -15 -1 -1 -1 -1 ./manage.py runjobs quarter_hourly
+unique-cron = 0 -1 -1 -1 -1 ./manage.py runjobs hourly
+unique-cron = 0 0 -1 -1 -1 ./manage.py runjobs daily
+unique-cron = 0 0 1 -1 -1 ./manage.py runjobs monthly
+unique-cron = 0 0 -1 -1 0 ./manage.py runjobs weekly
+unique-cron = 0 0 1 1 -1 ./manage.py runjobs yearly
+
+# Setup the request log.
+req-logger = file:/opt/mailman-web-data/logs/uwsgi.log
+
+# Log cron seperately.
+logger = cron file:/opt/mailman-web-data/logs/uwsgi-cron.log
+log-route = cron uwsgi-cron
+
+# Log qcluster commands seperately.
+logger = qcluster file:/opt/mailman-web-data/logs/uwsgi-qcluster.log
+log-route = qcluster uwsgi-daemons
+
+# Last log and it logs the rest of the stuff.
+logger = file:/opt/mailman-web-data/logs/uwsgi-error.log
diff --git a/apps/talos_cluster/mailserver/mailman.yaml b/apps/talos_cluster/mailserver/mailman.yaml
@@ -18,238 +18,278 @@ spec:
hostAliases:
- ip: 0.0.0.0
hostnames:
- - mailman.mailserver.svc.cluster.local
+ - mailman.mailserver.svc.cluster.local
- ip: 127.0.0.1
hostnames:
- - mailman-web
+ - mailman-web
containers:
- name: core
image: ghcr.io/mtrnord/mailman-core:rolling
imagePullPolicy: Always
ports:
- - name: api
- containerPort: 8001
- - name: lmtp
- containerPort: 8024
+ - name: api
+ containerPort: 8001
+ - name: lmtp
+ containerPort: 8024
env:
- - name: DATABASE_URL
- valueFrom:
- secretKeyRef:
- name: mailmancore
- key: url
- - name: DATABASE_TYPE
- value: postgres
- - name: DATABASE_CLASS
- value: mailman.database.postgresql.PostgreSQLDatabase
- - name: HYPERKITTY_API_KEY
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: apikey
- - name: MAILMAN_REST_USER
- value: restadm
- - name: MAILMAN_REST_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: restpassword
- - name: SMTP_HOST
- value: mail.midnightthoughts.space
- - name: SMTP_PORT
- value: "465"
- - name: SMTP_USE_SSL
- value: "true"
- - name: SMTP_SECURE_MODE
- value: "smtps"
- - name: SMTP_HOST_USER
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_user
- - name: SMTP_HOST_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_password
- - name: MTA
- value: postfix
- - name: MM_HOSTNAME
- value: mailman.mailserver.svc.cluster.local
- - name: HYPERKITTY_URL
- value: http://localhost:8000/hyperkitty
+ - name: DATABASE_URL
+ valueFrom:
+ secretKeyRef:
+ name: mailmancore
+ key: url
+ - name: DATABASE_TYPE
+ value: postgres
+ - name: DATABASE_CLASS
+ value: mailman.database.postgresql.PostgreSQLDatabase
+ - name: HYPERKITTY_API_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: apikey
+ - name: MAILMAN_REST_USER
+ value: restadm
+ - name: MAILMAN_REST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: restpassword
+ - name: SMTP_HOST
+ value: mail.midnightthoughts.space
+ - name: SMTP_PORT
+ value: "465"
+ - name: SMTP_USE_SSL
+ value: "true"
+ - name: SMTP_SECURE_MODE
+ value: "smtps"
+ - name: SMTP_HOST_USER
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_user
+ - name: SMTP_HOST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_password
+ - name: MTA
+ value: postfix
+ - name: MM_HOSTNAME
+ value: mailman.mailserver.svc.cluster.local
+ - name: HYPERKITTY_URL
+ value: http://localhost:8000/hyperkitty
volumeMounts:
- - name: mailman-opt
- mountPath: /opt/mailman
- - name: mailman-extra
- mountPath: /opt/mailman/mailman-extra.cfg
- subPath: mailman-extra.cfg
- - name: mailman-extra
- mountPath: /usr/bin/chown
- subPath: chown
+ - name: mailman-opt
+ mountPath: /opt/mailman
+ - name: mailman-extra
+ mountPath: /opt/mailman/mailman-extra.cfg
+ subPath: mailman-extra.cfg
+ - name: mailman-extra
+ mountPath: /usr/bin/chown
+ subPath: chown
+ - name: mailman-uwsgi
+ mountPath: /opt/mailman-web/uwsgi.ini
+ subPath: uwsgi.ini
- name: web
image: ghcr.io/mtrnord/mailman-web:rolling
imagePullPolicy: Always
ports:
- - name: http
- containerPort: 8000
- - name: uwsgi
- containerPort: 8080
+ - name: http
+ containerPort: 8000
+ - name: uwsgi
+ containerPort: 8080
#command:
# - tail
#args:
# - -f
# - /dev/null
env:
- - name: DATABASE_URL
- valueFrom:
- secretKeyRef:
- name: mailmanweb
- key: url
- - name: DATABASE_TYPE
- value: postgres
- - name: DATABASE_CLASS
- value: mailman.database.postgresql.PostgreSQLDatabase
- - name: HYPERKITTY_API_KEY
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: apikey
- - name: MAILMAN_REST_USER
- value: restadm
- - name: MAILMAN_REST_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: restpassword
- - name: SECRET_KEY
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: websecretkey
- - name: POSTORIUS_TEMPLATE_BASE_URL
- value: http://localhost:8000/
- # serving static files by uwsgi
- - name: UWSGI_STATIC_MAP
- value: /static=/opt/mailman-web-data/static
- - name: MAILMAN_ADMIN_USER
- value: admin
- - name: MAILMAN_ADMIN_EMAIL
- value: mtrnord@nordgedanken.dev
- - name: MAILMAN_HOST_IP
- value: 127.0.0.1
- - name: MAILMAN_HOSTNAME
- value: localhost
- - name: SERVE_FROM_DOMAIN
- value: lists.midnightthoughts.space
- - name: MAILMAN_REST_URL # MAILMAN_REST_API_URL is set from this variable in settings.
- value: http://127.0.0.1:8001
- - name: MAILMAN_REST_API_USER
- value: restadm
- - name: MAILMAN_REST_API_PASS
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: restpassword
- - name: SMTP_HOST
- value: mail.midnightthoughts.space
- - name: SMTP_PORT
- value: "465"
- - name: SMTP_USE_SSL
- value: "true"
- - name: SMTP_HOST_USER
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_user
- - name: SMTP_HOST_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_password
+ - name: DATABASE_URL
+ valueFrom:
+ secretKeyRef:
+ name: mailmanweb
+ key: url
+ - name: DATABASE_TYPE
+ value: postgres
+ - name: DATABASE_CLASS
+ value: mailman.database.postgresql.PostgreSQLDatabase
+ - name: HYPERKITTY_API_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: apikey
+ - name: MAILMAN_REST_USER
+ value: restadm
+ - name: MAILMAN_REST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: restpassword
+ - name: SECRET_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: websecretkey
+ - name: POSTORIUS_TEMPLATE_BASE_URL
+ value: http://localhost:8000/
+ # serving static files by uwsgi
+ - name: UWSGI_STATIC_MAP
+ value: /static=/opt/mailman-web-data/static
+ - name: MAILMAN_ADMIN_USER
+ value: admin
+ - name: MAILMAN_ADMIN_EMAIL
+ value: mtrnord@nordgedanken.dev
+ - name: MAILMAN_HOST_IP
+ value: 127.0.0.1
+ - name: MAILMAN_HOSTNAME
+ value: localhost
+ - name: SERVE_FROM_DOMAIN
+ value: lists.midnightthoughts.space
+ - name: MAILMAN_REST_URL # MAILMAN_REST_API_URL is set from this variable in settings.
+ value: http://127.0.0.1:8001
+ - name: MAILMAN_REST_API_USER
+ value: restadm
+ - name: MAILMAN_REST_API_PASS
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: restpassword
+ - name: SMTP_HOST
+ value: mail.midnightthoughts.space
+ - name: SMTP_PORT
+ value: "465"
+ - name: SMTP_USE_SSL
+ value: "true"
+ - name: SMTP_HOST_USER
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_user
+ - name: SMTP_HOST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_password
# otherwise django cannot find the mysql driver.
#- name: DYLD_LIBRARY_PATH
# value: /usr/local/mysql/lib/
volumeMounts:
- - name: mailman-web
- mountPath: /opt/mailman-web-data
- - name: mailman-extra
- mountPath: /opt/mailman-web-data/settings_local.py
- subPath: settings_local.py
- - name: mailman-extra
- mountPath: /usr/bin/chown
- subPath: chown
+ - name: mailman-web
+ mountPath: /opt/mailman-web-data
+ - name: mailman-extra
+ mountPath: /opt/mailman-web-data/settings_local.py
+ subPath: settings_local.py
+ - name: mailman-extra
+ mountPath: /usr/bin/chown
+ subPath: chown
+ - name: redis
+ image: redis:7-alpine
+ imagePullPolicy: IfNotPresent
+ ports:
+ - name: redis
+ containerPort: 6379
+ command:
+ - redis-server
+ - --appendonly
+ - "yes"
+ - --maxmemory
+ - "256mb"
+ - --maxmemory-policy
+ - "allkeys-lru"
+ resources:
+ requests:
+ memory: "128Mi"
+ cpu: "50m"
+ limits:
+ memory: "512Mi"
+ cpu: "200m"
+ livenessProbe:
+ tcpSocket:
+ port: 6379
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ readinessProbe:
+ tcpSocket:
+ port: 6379
+ initialDelaySeconds: 5
+ periodSeconds: 5
+ volumeMounts:
+ - name: redis-data
+ mountPath: /data
- name: nginx
image: ghcr.io/nginx/nginx-unprivileged:stable-alpine
imagePullPolicy: IfNotPresent
ports:
- - name: http
- containerPort: 9090
+ - name: http
+ containerPort: 9090
startupProbe:
- httpGet:
- path: /mailman3/lists/
- port: 9090
- httpHeaders:
- - name: Host
- value: lists.midnightthoughts.space
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 5
- failureThreshold: 24
+ httpGet:
+ path: /mailman3/lists/
+ port: 9090
+ httpHeaders:
+ - name: Host
+ value: lists.midnightthoughts.space
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 5
+ failureThreshold: 24
livenessProbe:
- httpGet:
- path: /mailman3/lists/
- port: 9090
- httpHeaders:
- - name: Host
- value: lists.midnightthoughts.space
- periodSeconds: 30
- timeoutSeconds: 5
- failureThreshold: 3
+ httpGet:
+ path: /mailman3/lists/
+ port: 9090
+ httpHeaders:
+ - name: Host
+ value: lists.midnightthoughts.space
+ periodSeconds: 30
+ timeoutSeconds: 5
+ failureThreshold: 3
readinessProbe:
- httpGet:
- path: /mailman3/lists/
- port: 9090
- httpHeaders:
- - name: Host
- value: lists.midnightthoughts.space
- periodSeconds: 10
- timeoutSeconds: 3
- failureThreshold: 3
+ httpGet:
+ path: /mailman3/lists/
+ port: 9090
+ httpHeaders:
+ - name: Host
+ value: lists.midnightthoughts.space
+ periodSeconds: 10
+ timeoutSeconds: 3
+ failureThreshold: 3
volumeMounts:
- - name: mailman-web
- mountPath: /opt/mailman-web-data
- readOnly: true
- - name: nginx-config
- mountPath: /etc/nginx/nginx.conf
- subPath: nginx.conf
- readOnly: true
- - name: tmp
- mountPath: /tmp
- readOnly: false
- - name: tmp-client-body
- mountPath: /tmp/nginx/client_body
- readOnly: false
- - name: tmp-cgi
- mountPath: /tmp/nginx/fastcgi
- readOnly: false
- - name: tmp-cgi
- mountPath: /tmp/nginx/uwsgi
- readOnly: false
- - name: tmp-cgi
- mountPath: /tmp/nginx/scgi
- readOnly: false
- - name: tmp-proxy
- mountPath: /tmp/nginx/proxy
- readOnly: false
+ - name: mailman-web
+ mountPath: /opt/mailman-web-data
+ readOnly: true
+ - name: nginx-config
+ mountPath: /etc/nginx/nginx.conf
+ subPath: nginx.conf
+ readOnly: true
+ - name: tmp
+ mountPath: /tmp
+ readOnly: false
+ - name: tmp-client-body
+ mountPath: /tmp/nginx/client_body
+ readOnly: false
+ - name: tmp-cgi
+ mountPath: /tmp/nginx/fastcgi
+ readOnly: false
+ - name: tmp-cgi
+ mountPath: /tmp/nginx/uwsgi
+ readOnly: false
+ - name: tmp-cgi
+ mountPath: /tmp/nginx/scgi
+ readOnly: false
+ - name: tmp-proxy
+ mountPath: /tmp/nginx/proxy
+ readOnly: false
volumes:
- name: mailman-extra
secret:
- secretName: mailman-extra
- defaultMode: 0555
+ secretName: mailman-extra
+ defaultMode: 0555
- name: nginx-config
configMap:
- name: mailman-nginx
+ name: mailman-nginx
+ - name: mailman-uwsgi
+ configMap:
+ name: mailman-uwsgi
- name: tmp
emptyDir: {}
- name: tmp-client-body
@@ -258,31 +298,33 @@ spec:
emptyDir: {}
- name: tmp-proxy
emptyDir: {}
+ - name: redis-data
+ emptyDir: {}
volumeClaimTemplates:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: mailman-opt
- namespace: mailserver
+ name: mailman-opt
+ namespace: mailserver
spec:
- storageClassName: longhorn
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 10Gi
+ storageClassName: longhorn
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: mailman-web
- namespace: mailserver
+ name: mailman-web
+ namespace: mailserver
spec:
- storageClassName: longhorn
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 10Gi
+ storageClassName: longhorn
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
---
apiVersion: v1
kind: Service
@@ -304,6 +346,8 @@ spec:
port: 8080
- name: nginx
port: 9090
+ - name: redis
+ port: 6379
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
@@ -318,8 +362,8 @@ spec:
- lists.midnightthoughts.space
rules:
- backendRefs:
- - name: mailman
- port: 9090
+ - name: mailman
+ port: 9090
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
