commit f1524430e20026817a8d909a7fd18c4f36090953
parent bdb86ba519e741f7bd09a87bcefac16dc71bf1df
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 1 Oct 2025 16:37:59 +0200
Meow
Diffstat:
4 files changed, 214 insertions(+), 216 deletions(-)
diff --git a/apps/talos_cluster/mailserver/kustomization.yaml b/apps/talos_cluster/mailserver/kustomization.yaml
@@ -14,14 +14,14 @@ configMapGenerator:
- name: mta-sts-content
namespace: mailserver
files:
- - mta-sts.txt=mta-sts.txt
+ - mta-sts.txt=mta-sts.txt
options:
- labels:
- app: mta-sts-server
+ labels:
+ app: mta-sts-server
- name: mailman-nginx
namespace: mailserver
files:
- - nginx.conf=mailman-nginx.conf
+ - nginx.conf=mailman-nginx.conf
options:
- labels:
- app: mailman
+ labels:
+ app: mailman
diff --git a/apps/talos_cluster/mailserver/mailman.yaml b/apps/talos_cluster/mailserver/mailman.yaml
@@ -1,4 +1,3 @@
----
apiVersion: apps/v1
kind: StatefulSet
metadata:
@@ -18,203 +17,202 @@ spec:
hostAliases:
- ip: 0.0.0.0
hostnames:
- - mailman.mailserver.svc.cluster.local
+ - mailman.mailserver.svc.cluster.local
- ip: 127.0.0.1
hostnames:
- - mailman-web
+ - mailman-web
containers:
- name: core
image: ghcr.io/mtrnord/mailman-core:rolling
imagePullPolicy: Always
ports:
- - name: api
- containerPort: 8001
- - name: lmtp
- containerPort: 8024
+ - name: api
+ containerPort: 8001
+ - name: lmtp
+ containerPort: 8024
env:
- - name: DATABASE_URL
- valueFrom:
- secretKeyRef:
- name: mailmancore
- key: url
- - name: DATABASE_TYPE
- value: postgres
- - name: DATABASE_CLASS
- value: mailman.database.postgresql.PostgreSQLDatabase
- - name: HYPERKITTY_API_KEY
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: apikey
- - name: MAILMAN_REST_USER
- value: restadm
- - name: MAILMAN_REST_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: restpassword
- - name: SMTP_HOST
- value: mail.midnightthoughts.space
- - name: SMTP_PORT
- value: "465"
- - name: SMTP_USE_TLS
- value: "true"
- - name: SMTP_USER
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_user
- - name: SMTP_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_password
- - name: MTA
- value: postfix
- - name: MM_HOSTNAME
- value: mailman.mailserver.svc.cluster.local
- - name: HYPERKITTY_URL
- value: http://localhost:8000/hyperkitty
+ - name: DATABASE_URL
+ valueFrom:
+ secretKeyRef:
+ name: mailmancore
+ key: url
+ - name: DATABASE_TYPE
+ value: postgres
+ - name: DATABASE_CLASS
+ value: mailman.database.postgresql.PostgreSQLDatabase
+ - name: HYPERKITTY_API_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: apikey
+ - name: MAILMAN_REST_USER
+ value: restadm
+ - name: MAILMAN_REST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: restpassword
+ - name: SMTP_HOST
+ value: mail.midnightthoughts.space
+ - name: SMTP_PORT
+ value: "465"
+ - name: SMTP_USE_TLS
+ value: "true"
+ - name: SMTP_USER
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_user
+ - name: SMTP_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_password
+ - name: MTA
+ value: postfix
+ - name: MM_HOSTNAME
+ value: mailman.mailserver.svc.cluster.local
+ - name: HYPERKITTY_URL
+ value: http://localhost:8000/hyperkitty
volumeMounts:
- - name: mailman-opt
- mountPath: /opt/mailman
- - name: mailman-extra
- mountPath: /opt/mailman/mailman-extra.cfg
- subPath: mailman-extra.cfg
- - name: mailman-extra
- mountPath: /usr/bin/chown
- subPath: chown
+ - name: mailman-opt
+ mountPath: /opt/mailman
+ - name: mailman-extra
+ mountPath: /opt/mailman/mailman-extra.cfg
+ subPath: mailman-extra.cfg
+ - name: mailman-extra
+ mountPath: /usr/bin/chown
+ subPath: chown
- name: web
image: ghcr.io/mtrnord/mailman-web:rolling
imagePullPolicy: Always
ports:
- - name: http
- containerPort: 8000
- - name: uwsgi
- containerPort: 8080
+ - name: http
+ containerPort: 8000
+ - name: uwsgi
+ containerPort: 8080
#command:
# - tail
#args:
# - -f
# - /dev/null
env:
- - name: DATABASE_URL
- valueFrom:
- secretKeyRef:
- name: mailmanweb
- key: url
- - name: DATABASE_TYPE
- value: postgres
- - name: DATABASE_CLASS
- value: mailman.database.postgresql.PostgreSQLDatabase
- - name: HYPERKITTY_API_KEY
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: apikey
- - name: MAILMAN_REST_USER
- value: restadm
- - name: MAILMAN_REST_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: restpassword
- - name: SECRET_KEY
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: websecretkey
- - name: POSTORIUS_TEMPLATE_BASE_URL
- value: http://localhost:8000/
- # serving static files by uwsgi
- - name: UWSGI_STATIC_MAP
- value: /static=/opt/mailman-web-data/static
- - name: MAILMAN_ADMIN_USER
- value: admin
- - name: MAILMAN_ADMIN_EMAIL
- value: mtrnord@nordgedanken.dev
- - name: MAILMAN_HOST_IP
- value: 127.0.0.1
- - name: MAILMAN_HOSTNAME
- value: localhost
- - name: SERVE_FROM_DOMAIN
- value: lists.midnightthoughts.space
- - name: MAILMAN_REST_URL # MAILMAN_REST_API_URL is set from this variable in settings.
- value: http://127.0.0.1:8001
- - name: MAILMAN_REST_API_USER
- value: restadm
- - name: MAILMAN_REST_API_PASS
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: restpassword
- - name: SMTP_HOST
- value: mail.midnightthoughts.space
- - name: SMTP_PORT
- value: "465"
- - name: SMTP_USE_TLS
- value: "true"
- - name: SMTP_USER
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_user
- - name: SMTP_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mailman-passwords
- key: smtp_password
- # otherwise django cannot find the mysql driver.
- #- name: DYLD_LIBRARY_PATH
- # value: /usr/local/mysql/lib/
+ - name: DATABASE_URL
+ valueFrom:
+ secretKeyRef:
+ name: mailmanweb
+ key: url
+ - name: DATABASE_TYPE
+ value: postgres
+ - name: DATABASE_CLASS
+ value: mailman.database.postgresql.PostgreSQLDatabase
+ - name: HYPERKITTY_API_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: apikey
+ - name: MAILMAN_REST_USER
+ value: restadm
+ - name: MAILMAN_REST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: restpassword
+ - name: SECRET_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: websecretkey
+ - name: POSTORIUS_TEMPLATE_BASE_URL
+ value: http://localhost:8000/
+ # serving static files by uwsgi
+ - name: UWSGI_STATIC_MAP
+ value: /static=/opt/mailman-web-data/static
+ - name: MAILMAN_ADMIN_USER
+ value: admin
+ - name: MAILMAN_ADMIN_EMAIL
+ value: mtrnord@nordgedanken.dev
+ - name: MAILMAN_HOST_IP
+ value: 127.0.0.1
+ - name: MAILMAN_HOSTNAME
+ value: localhost
+ - name: SERVE_FROM_DOMAIN
+ value: lists.midnightthoughts.space
+ - name: MAILMAN_REST_URL # MAILMAN_REST_API_URL is set from this variable in settings.
+ value: http://127.0.0.1:8001
+ - name: MAILMAN_REST_API_USER
+ value: restadm
+ - name: MAILMAN_REST_API_PASS
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: restpassword
+ - name: SMTP_HOST
+ value: mail.midnightthoughts.space
+ - name: SMTP_PORT
+ value: "465"
+ - name: SMTP_USE_TLS
+ value: "true"
+ - name: SMTP_USER
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_user
+ - name: SMTP_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mailman-passwords
+ key: smtp_password
+ # otherwise django cannot find the mysql driver.
+ #- name: DYLD_LIBRARY_PATH
+ # value: /usr/local/mysql/lib/
volumeMounts:
- - name: mailman-web
- mountPath: /opt/mailman-web-data
- - name: mailman-extra
- mountPath: /opt/mailman-web-data/settings_local.py
- subPath: settings_local.py
- - name: mailman-extra
- mountPath: /usr/bin/chown
- subPath: chown
+ - name: mailman-web
+ mountPath: /opt/mailman-web-data
+ - name: mailman-extra
+ mountPath: /opt/mailman-web-data/settings_local.py
+ subPath: settings_local.py
+ - name: mailman-extra
+ mountPath: /usr/bin/chown
+ subPath: chown
- name: nginx
image: ghcr.io/nginx/nginx-unprivileged:stable-alpine
imagePullPolicy: IfNotPresent
ports:
- - name: http
- containerPort: 9090
+ - name: http
+ containerPort: 9090
volumeMounts:
- - name: mailman-web
- mountPath: /opt/mailman-web-data
- readOnly: true
- - name: nginx-config
- mountPath: /etc/nginx/nginx.conf
- subPath: nginx.conf
- readOnly: true
- - name: tmp
- mountPath: /tmp
- readOnly: false
- - name: tmp-client-body
- mountPath: /tmp/nginx/client_body
- readOnly: false
- - name: tmp-cgi
- mountPath: /tmp/nginx/fastcgi
- readOnly: false
- - name: tmp-cgi
- mountPath: /tmp/nginx/uwsgi
- readOnly: false
- - name: tmp-cgi
- mountPath: /tmp/nginx/scgi
- readOnly: false
-
+ - name: mailman-web
+ mountPath: /opt/mailman-web-data
+ readOnly: true
+ - name: nginx-config
+ mountPath: /etc/nginx/nginx.conf
+ subPath: nginx.conf
+ readOnly: true
+ - name: tmp
+ mountPath: /tmp
+ readOnly: false
+ - name: tmp-client-body
+ mountPath: /tmp/nginx/client_body
+ readOnly: false
+ - name: tmp-cgi
+ mountPath: /tmp/nginx/fastcgi
+ readOnly: false
+ - name: tmp-cgi
+ mountPath: /tmp/nginx/uwsgi
+ readOnly: false
+ - name: tmp-cgi
+ mountPath: /tmp/nginx/scgi
+ readOnly: false
volumes:
- name: mailman-extra
secret:
- secretName: mailman-extra
- defaultMode: 0555
+ secretName: mailman-extra
+ defaultMode: 0555
- name: nginx-config
configMap:
- name: mailman-nginx
+ name: mailman-nginx
- name: tmp
emptyDir: {}
- name: tmp-client-body
@@ -225,27 +223,27 @@ spec:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: mailman-opt
- namespace: mailserver
+ name: mailman-opt
+ namespace: mailserver
spec:
- storageClassName: longhorn
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 10Gi
+ storageClassName: longhorn
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: mailman-web
- namespace: mailserver
+ name: mailman-web
+ namespace: mailserver
spec:
- storageClassName: longhorn
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 10Gi
+ storageClassName: longhorn
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 10Gi
---
apiVersion: v1
kind: Service
@@ -281,8 +279,8 @@ spec:
- lists.midnightthoughts.space
rules:
- backendRefs:
- - name: mailman
- port: 9090
+ - name: mailman
+ port: 9090
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
diff --git a/apps/talos_cluster/mailserver/release.yaml b/apps/talos_cluster/mailserver/release.yaml
@@ -377,4 +377,4 @@ spec:
extraVolumes:
- name: mailman-opt
persistentVolumeClaim:
- claimName: mailman-opt-mailman-0
+ claimName: mailman-opt-mailman-0
diff --git a/infrastructure_talos/configs/cnpg-cluster.yaml b/infrastructure_talos/configs/cnpg-cluster.yaml
@@ -112,7 +112,7 @@ spec:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
- barmanObjectName: hetzner-base-backup
+ barmanObjectName: hetzner-base-backup
managed:
roles:
- name: freshrss
@@ -120,128 +120,128 @@ spec:
login: true
superuser: false
passwordSecret:
- name: freshrss
+ name: freshrss
- name: meowlnir
ensure: present
login: true
comment: Read Only Access for synapse required but RW to meowlnir db
superuser: false
passwordSecret:
- name: meowlnir
+ name: meowlnir
- name: connectivity-tester-stage
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester-stage
+ name: connectivity-tester-stage
- name: connectivity-tester
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester
+ name: connectivity-tester
- name: draupnir_synapse
ensure: present
login: true
superuser: false
passwordSecret:
- name: draupnir-synapse
+ name: draupnir-synapse
- name: authentik
ensure: present
login: true
superuser: false
passwordSecret:
- name: authentik
+ name: authentik
- name: ejabberd
ensure: present
login: true
superuser: false
passwordSecret:
- name: ejabberd
+ name: ejabberd
- name: vaultwarden
ensure: present
login: true
superuser: false
passwordSecret:
- name: vaultwarden
+ name: vaultwarden
- name: mastodon
ensure: present
login: true
superuser: false
passwordSecret:
- name: mastodon
+ name: mastodon
- name: openproject
ensure: present
login: true
superuser: false
passwordSecret:
- name: openproject
+ name: openproject
- name: plausible
ensure: present
login: true
superuser: false
passwordSecret:
- name: plausible
+ name: plausible
- name: coder
ensure: present
login: true
superuser: false
passwordSecret:
- name: coder
+ name: coder
- name: matrix_auth
ensure: present
login: true
superuser: false
passwordSecret:
- name: matrix-auth
+ name: matrix-auth
- name: cachet
ensure: present
login: true
superuser: false
passwordSecret:
- name: cachet
+ name: cachet
- name: docuseal
ensure: present
login: true
superuser: false
passwordSecret:
- name: docuseal
+ name: docuseal
- name: bugzilla
ensure: present
login: true
superuser: false
passwordSecret:
- name: bugzilla
+ name: bugzilla
- name: rundeck
ensure: present
login: true
superuser: false
passwordSecret:
- name: rundeck
+ name: rundeck
- name: plane
ensure: present
login: true
superuser: false
passwordSecret:
- name: plane
+ name: plane
- name: gotosocial
ensure: present
login: true
superuser: false
passwordSecret:
- name: gotosocial
+ name: gotosocial
- name: grafana-ro
ensure: present
login: true
superuser: false
passwordSecret:
- name: grafana-ro
+ name: grafana-ro
- name: mailman
ensure: present
login: true
superuser: false
passwordSecret:
- name: mailman
+ name: mailman
storage:
storageClass: hcloud-volumes
size: 15Gi
