commit d94f3d9c3ae8622870af47262131b38dcc004cde
parent df152796fe5358550e8839e3eabca05e9714d37e
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 17 Feb 2025 19:45:50 +0100
Use a gateway api tcp route setup for the mailserver
Diffstat:
2 files changed, 214 insertions(+), 77 deletions(-)
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -43,6 +43,55 @@ spec:
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
+ name: email-gateway
+ namespace: envoy-gateway
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+spec:
+ gatewayClassName: envoy-gateway-class
+ infrastructure:
+ annotations:
+ external-dns.alpha.kubernetes.io/access: public
+ load-balancer.hetzner.cloud/location: hel1
+ load-balancer.hetzner.cloud/name: email-envoy
+ load-balancer.hetzner.cloud/use-private-ip: "true"
+ load-balancer.hetzner.cloud/uses-proxyprotocol: "false"
+ # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
+ listeners:
+ - name: smtp
+ protocol: TCP
+ port: 25
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ - name: submissions
+ protocol: TCP
+ port: 465
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ - name: submission
+ protocol: TCP
+ port: 587
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ - name: imap
+ protocol: TCP
+ port: 143
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ - name: imaps
+ protocol: TCP
+ port: 993
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
name: envoy-gateway
namespace: envoy-gateway
annotations:
@@ -63,151 +112,152 @@ spec:
hostname: "mas.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: midnightthoughts.space-tls
- name: https-matrix-midnightthoughts
protocol: HTTPS
hostname: "matrix.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.midnightthoughts.space-tls
- name: https-draupnir-midnightthoughts
protocol: HTTPS
hostname: "draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: draupnir.midnightthoughts.space-tls
- name: https-matrix-draupnir-midnightthoughts
protocol: HTTPS
hostname: "matrix.draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.draupnir.midnightthoughts.space-tls
- name: https-docuseal-midnightthoughts
protocol: HTTPS
hostname: "docuseal.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: docuseal.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: docuseal.midnightthoughts.space-tls
- name: https-midnightthoughts-neoboard
protocol: HTTPS
hostname: "miro-export.neoboard.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: miro-export.neoboard.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: miro-export.neoboard.midnightthoughts.space-tls
- name: https-midnightthoughts-certs
protocol: HTTPS
hostname: "certs.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: certs.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: certs.midnightthoughts.space-tls
- name: https-midnightthoughts-root
protocol: HTTPS
hostname: "midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: midnightthoughts.space-tls
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-nordgedanken
protocol: HTTPS
hostname: "*.nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-mtrnord-blog-root
protocol: HTTPS
hostname: "mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: https-mtrnord-blog
protocol: HTTPS
hostname: "*.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: http
protocol: HTTP
port: 80
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
+
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/base/mailserver/release.yaml b/apps/base/mailserver/release.yaml
@@ -173,7 +173,7 @@ spec:
service:
annotations:
external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space
- type: NodePort
+ type: ClusterIP
nodePort:
smtp: 25
smtps: 465
@@ -219,7 +219,8 @@ spec:
dovecot.cf:
create: true
path: dovecot.cf
- data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
+ data:
+ "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
}}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n service
imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n
\ port = 993\n ssl = yes\n }\n\n inet_listener imap_proxy {\n haproxy
@@ -268,7 +269,8 @@ spec:
user-patches.sh:
create: true
path: user-patches.sh
- data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
+ data:
+ "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
>> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
\ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
@@ -284,3 +286,88 @@ spec:
\ -o smtpd_upstream_proxy_protocol=haproxy\n\n# Smtp with proxy\n12525 inet n - n -
\ 1 postscreen\n -o syslog_name=postfix/smtp-proxy\n -o postscreen_upstream_proxy_protocol=haproxy\n
\ -o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache\nEOS\n{{- end }}\n"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: mailserver-smtp
+ namespace: mailserver
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: email-gateway
+ namespace: envoy-gateway
+ sectionName: smtp
+ rules:
+ - backendRefs:
+ - name: mailserver-docker-mailserver
+ port: 25
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: mailserver-submissions
+ namespace: mailserver
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: email-gateway
+ namespace: envoy-gateway
+ sectionName: submissions
+ rules:
+ - backendRefs:
+ - name: mailserver-docker-mailserver
+ port: 465
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: mailserver-submission
+ namespace: mailserver
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: email-gateway
+ namespace: envoy-gateway
+ sectionName: submission
+ rules:
+ - backendRefs:
+ - name: mailserver-docker-mailserver
+ port: 587
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: mailserver-imap
+ namespace: mailserver
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: email-gateway
+ namespace: envoy-gateway
+ sectionName: imap
+ rules:
+ - backendRefs:
+ - name: mailserver-docker-mailserver
+ port: 143
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: mailserver-imaps
+ namespace: mailserver
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: email-gateway
+ namespace: envoy-gateway
+ sectionName: imaps
+ rules:
+ - backendRefs:
+ - name: mailserver-docker-mailserver
+ port: 993
