commit b70624b54df6367e554f7b02ce58c18c28c75d63
parent a45fe38e091d3d0d746dc391d119c5da92f757b0
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 8 Aug 2025 12:09:51 +0200
Proxy protocol maybe?
Diffstat:
3 files changed, 49 insertions(+), 43 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -385,16 +385,26 @@ spec:
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
- name: enable-proxy-protocol-policy
+ name: email-policy
namespace: envoy-gateway
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
- name: envoy-gateway
+ name: email-gateway
+ # WARNING: Cilium 1.17+ only supports the correct ipMode magic for this to work. Hence it currently fails
+ enableProxyProtocol: true
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+ name: enable-proxy-protocol-policy
+ namespace: envoy-gateway
+spec:
+ targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
- name: email-gateway
+ name: envoy-gateway
# WARNING: Cilium 1.17+ only supports the correct ipMode magic for this to work. Hence it currently fails
enableProxyProtocol: true
# Alternative to enableProxyProtocol: true
diff --git a/apps/talos_cluster/mailserver/release.yaml b/apps/talos_cluster/mailserver/release.yaml
@@ -225,8 +225,7 @@ spec:
dovecot.cf:
create: true
path: dovecot.cf
- data:
- "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
+ data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
}}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n service
imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n
\ port = 993\n ssl = yes\n }\n\n inet_listener imap_proxy {\n haproxy
@@ -275,8 +274,7 @@ spec:
user-patches.sh:
create: true
path: user-patches.sh
- data:
- "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
+ data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
>> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
\ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
@@ -307,8 +305,8 @@ spec:
sectionName: smtp
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 25
+ - name: mailserver-docker-mailserver
+ port: 25
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -324,8 +322,8 @@ spec:
sectionName: submissions
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 465
+ - name: mailserver-docker-mailserver
+ port: 465
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -341,8 +339,8 @@ spec:
sectionName: submission
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 587
+ - name: mailserver-docker-mailserver
+ port: 587
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -358,8 +356,8 @@ spec:
sectionName: imap
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 143
+ - name: mailserver-docker-mailserver
+ port: 143
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -375,9 +373,8 @@ spec:
sectionName: imaps
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 993
-
+ - name: mailserver-docker-mailserver
+ port: 993
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
@@ -417,8 +414,8 @@ spec:
- rspamd.midnightthoughts.space
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 11334
+ - name: mailserver-docker-mailserver
+ port: 11334
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
diff --git a/infrastructure_talos/configs/cnpg-cluster.yaml b/infrastructure_talos/configs/cnpg-cluster.yaml
@@ -1,4 +1,3 @@
----
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
@@ -113,7 +112,7 @@ spec:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
- barmanObjectName: hetzner-base-backup
+ barmanObjectName: hetzner-base-backup
managed:
roles:
- name: freshrss
@@ -121,116 +120,116 @@ spec:
login: true
superuser: false
passwordSecret:
- name: freshrss
+ name: freshrss
- name: meowlnir
ensure: present
login: true
comment: Read Only Access for synapse required but RW to meowlnir db
superuser: false
passwordSecret:
- name: meowlnir
+ name: meowlnir
- name: connectivity-tester-stage
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester-stage
+ name: connectivity-tester-stage
- name: connectivity-tester
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester
+ name: connectivity-tester
- name: draupnir_synapse
ensure: present
login: true
superuser: false
passwordSecret:
- name: draupnir-synapse
+ name: draupnir-synapse
- name: authentik
ensure: present
login: true
superuser: false
passwordSecret:
- name: authentik
+ name: authentik
- name: ejabberd
ensure: present
login: true
superuser: false
passwordSecret:
- name: ejabberd
+ name: ejabberd
- name: vaultwarden
ensure: present
login: true
superuser: false
passwordSecret:
- name: vaultwarden
+ name: vaultwarden
- name: mastodon
ensure: present
login: true
superuser: false
passwordSecret:
- name: mastodon
+ name: mastodon
- name: openproject
ensure: present
login: true
superuser: false
passwordSecret:
- name: openproject
+ name: openproject
- name: plausible
ensure: present
login: true
superuser: false
passwordSecret:
- name: plausible
+ name: plausible
- name: coder
ensure: present
login: true
superuser: false
passwordSecret:
- name: coder
+ name: coder
- name: matrix_auth
ensure: present
login: true
superuser: false
passwordSecret:
- name: matrix-auth
+ name: matrix-auth
- name: cachet
ensure: present
login: true
superuser: false
passwordSecret:
- name: cachet
+ name: cachet
- name: docuseal
ensure: present
login: true
superuser: false
passwordSecret:
- name: docuseal
+ name: docuseal
- name: bugzilla
ensure: present
login: true
superuser: false
passwordSecret:
- name: bugzilla
+ name: bugzilla
- name: rundeck
ensure: present
login: true
superuser: false
passwordSecret:
- name: rundeck
+ name: rundeck
- name: plane
ensure: present
login: true
superuser: false
passwordSecret:
- name: plane
+ name: plane
- name: gotosocial
ensure: present
login: true
superuser: false
passwordSecret:
- name: gotosocial
+ name: gotosocial
storage:
storageClass: hcloud-volumes
size: 15Gi
