commit f2d2cdb2f761e7ed735b12d321bfce0911561e47
parent f98a98ac7967885970e25f86e5e37203e11d55f3
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 15 Apr 2026 12:12:11 +0200
Revert email on nodes
This reverts commit f98a98ac7967885970e25f86e5e37203e11d55f3.
Revert "meow?"
This reverts commit c2a625a047f70f18441b81c1bb324091af357140.
Revert "more fixes"
This reverts commit 8fb760f68ad11f957e0db50ef2b3f5a695b0131a.
Revert "more"
This reverts commit d394f96b49ad85ed676af7cb25a1be74ba77465e.
Revert "fixes"
This reverts commit 641614f4f4f74258209097776f97af4cb3f52152.
Revert "more!"
This reverts commit e79a0b2c1775d5f9d3274678a1e8ce799ba4cb80.
Revert "more fixes?"
This reverts commit 68bcfbd3793de5674355d1570825e353c566f660.
Revert "fixes"
This reverts commit e57a27402296d8f4d35e45c2b1805703ab500ba9.
Revert "maybe more fixes?"
This reverts commit 9a395210fa808240a361028c8a79d12613647ed1.
Revert "fixes"
This reverts commit 50f432a9530ba5265bf6e0699f24534f0a0ad900.
Revert "fixes"
This reverts commit 1a696243287a57a0e829601a6a7e307f41b35dea.
Revert "more fixes"
This reverts commit d5b2eee86f2bf7ea554fb704eb516a1c26cefe0f.
Revert "try to fix issues with dns"
This reverts commit 05204c923a00f8384f4fea8eeadb2a88069dd38c.
Revert "meow"
This reverts commit 096ab90221e8fb038ebfa7aba23d6f2bfff18840.
Revert "even more fixes"
This reverts commit 261dce5cb28748585303c5b2d1a9b6b493f83512.
Revert "more fixes"
This reverts commit 7a75b2dc71e19432cf91036761ea897160515880.
Revert "fix issues"
This reverts commit ccc40f15b77986416d8a1b3bd762a98d22104fde.
Revert "fix gatewayclass"
This reverts commit f966a99ee550f83b1e684e161b1a1f53bd2ac0ca.
Revert "move to using host network or email"
This reverts commit 33265bc005d3a64d0aac1645aebf401a0319d117.
Diffstat:
6 files changed, 265 insertions(+), 366 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/email_gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/email_gateway_settings.yaml
@@ -1,279 +0,0 @@
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: EnvoyProxy
-metadata:
- name: email-proxy-config
- namespace: envoy-gateway
-spec:
- ipFamily: DualStack
- routingType: Service
- extraArgs:
- - --use-dynamic-base-id
- provider:
- type: Kubernetes
- kubernetes:
- useListenerPortAsContainerPort: true
- envoyService:
- type: LoadBalancer
- patch:
- type: StrategicMerge
- value:
- spec:
- ipFamilyPolicy: DualStack
- ipFamilies:
- - IPv4
- - IPv6
- externalIPs:
- - 65.21.7.19
- - 2a01:4f9:c010:88a1::1
- - 157.180.84.123
- - 2a01:4f9:c012:96a5::1
- - 46.225.115.168
- - 2a01:4f8:1c18:222e::1
- - 116.203.40.165
- - 2a01:4f8:1c0c:66d3::1
- - 46.225.148.120
- - 2a01:4f8:c014:3000::1
- - 138.199.144.31
- - 2a01:4f8:c014:1a0e::1
- envoyDaemonSet:
- patch:
- type: StrategicMerge
- value:
- spec:
- updateStrategy:
- type: OnDelete
- template:
- spec:
- hostNetwork: true
- dnsPolicy: ClusterFirstWithHostNet
- container:
- securityContext:
- runAsUser: 0
- allowPrivilegeEscalation: true
- logging:
- level:
- default: info
----
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: GatewayClass
-metadata:
- name: email-gateway-class
-spec:
- controllerName: gateway.envoyproxy.io/gatewayclass-controller
- parametersRef:
- group: gateway.envoyproxy.io
- kind: EnvoyProxy
- name: email-proxy-config
- namespace: envoy-gateway
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
- name: email-gateway
- namespace: envoy-gateway
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-dns
-spec:
- # addresses:
- # - type: IPAddress
- # value: 65.21.7.19
- # - type: IPAddress
- # value: 2a01:4f9:c010:88a1::1
- # - type: IPAddress
- # value: 157.180.84.123
- # - type: IPAddress
- # value: 2a01:4f9:c012:96a5::1
- # - type: IPAddress
- # value: 46.225.115.168
- # - type: IPAddress
- # value: 2a01:4f8:1c18:222e::1
- # - type: IPAddress
- # value: 116.203.40.165
- # - type: IPAddress
- # value: 2a01:4f8:1c0c:66d3::1
- # - type: IPAddress
- # value: 46.225.148.120
- # - type: IPAddress
- # value: 2a01:4f8:c014:3000::1
- # - type: IPAddress
- # value: 138.199.144.31
- # - type: IPAddress
- # value: 2a01:4f8:c014:1a0e::1
- gatewayClassName: email-gateway-class
- infrastructure:
- annotations:
- external-dns.alpha.kubernetes.io/hostname: stalwart.nordgedanken.dev,webmail.midnightthoughts.space,mta-sts.midnightthoughts.space,autoconfig.midnightthoughts.space,autodiscover.midnightthoughts.space,autoconfig.lists.midnightthoughts.space,autodiscover.lists.midnightthoughts.space,mta-sts.lists.midnightthoughts.space,autoconfig.phorge.mtrnord.blog,autodiscover.phorge.mtrnord.blog,mta-sts.phorge.mtrnord.blog
- # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
- listeners:
- - name: smtp
- protocol: TCP
- port: 25
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: submissions
- protocol: TCP
- port: 465
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: submission
- protocol: TCP
- port: 587
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: imap
- protocol: TCP
- port: 143
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: imaps
- protocol: TCP
- port: 993
- allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
- - name: https-stalwart-nordgedanken
- protocol: HTTPS
- hostname: "stalwart.nordgedanken.dev"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: stalwart.nordgedanken.dev-tls
- - name: https-webmail-midnightthoughts
- protocol: HTTPS
- hostname: "webmail.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webmail.midnightthoughts.space-tls
- - name: https-autoconfig-midnightthoughts
- protocol: HTTPS
- hostname: "autoconfig.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autoconfig.midnightthoughts.space-tls
- - name: https-autodiscover-midnightthoughts
- protocol: HTTPS
- hostname: "autodiscover.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autodiscover.midnightthoughts.space-tls
- - name: https-autoconfig-lists-midnightthoughts
- protocol: HTTPS
- hostname: "autoconfig.lists.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autoconfig.lists.midnightthoughts.space-tls
- - name: https-autodiscover-lists-midnightthoughts
- protocol: HTTPS
- hostname: "autodiscover.lists.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autodiscover.lists.midnightthoughts.space-tls
- - name: https-mta-sts-lists-midnightthoughts
- protocol: HTTPS
- hostname: "mta-sts.lists.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.lists.midnightthoughts.space-tls
- - name: https-autoconfig-phorge-mtrnord-blog
- protocol: HTTPS
- hostname: "autoconfig.phorge.mtrnord.blog"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autoconfig.phorge.mtrnord.blog-tls
- - name: https-autodiscover-phorge-mtrnord-blog
- protocol: HTTPS
- hostname: "autodiscover.phorge.mtrnord.blog"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: autodiscover.phorge.mtrnord.blog-tls
- - name: https-mta-sts-phorge-mtrnord-blog
- protocol: HTTPS
- hostname: "mta-sts.phorge.mtrnord.blog"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.phorge.mtrnord.blog-tls
- - name: https-midnightthoughts-mta-sts
- protocol: HTTPS
- hostname: "mta-sts.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.midnightthoughts.space-tls
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -4,11 +4,11 @@ metadata:
name: custom-proxy-config
namespace: envoy-gateway
spec:
- ipFamily: DualStack
provider:
type: Kubernetes
kubernetes:
- envoyDaemonSet:
+ envoyDeployment:
+ replicas: 3
logging:
level:
default: info
@@ -17,6 +17,7 @@ apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
name: envoy-gateway-class
+ namespace: envoy-gateway
spec:
controllerName: gateway.envoyproxy.io/gatewayclass-controller
parametersRef:
@@ -28,6 +29,65 @@ spec:
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
+ name: email-gateway
+ namespace: envoy-gateway
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+spec:
+ gatewayClassName: envoy-gateway-class
+ infrastructure:
+ annotations:
+ external-dns.alpha.kubernetes.io/access: public
+ load-balancer.hetzner.cloud/location: hel1
+ load-balancer.hetzner.cloud/name: email-envoy
+ load-balancer.hetzner.cloud/use-private-ip: "true"
+ load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+ # no wildcards due to Envoy bug: https://github.com/envoyproxy/gateway/issues/2675#issuecomment-1960449002
+ listeners:
+ - name: smtp
+ protocol: TCP
+ port: 25
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: submissions
+ protocol: TCP
+ port: 465
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: submission
+ protocol: TCP
+ port: 587
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: imap
+ protocol: TCP
+ port: 143
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+ - name: imaps
+ protocol: TCP
+ port: 993
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
name: envoy-gateway
namespace: envoy-gateway
annotations:
@@ -102,6 +162,90 @@ spec:
certificateRefs:
- kind: Secret
name: nordgedanken.dev-tls
+ - name: https-stalwart-nordgedanken
+ protocol: HTTPS
+ hostname: "stalwart.nordgedanken.dev"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stalwart.nordgedanken.dev-tls
+ - name: https-webmail-midnightthoughts
+ protocol: HTTPS
+ hostname: "webmail.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webmail.midnightthoughts.space-tls
+ - name: https-autoconfig-midnightthoughts
+ protocol: HTTPS
+ hostname: "autoconfig.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autoconfig.midnightthoughts.space-tls
+ - name: https-autodiscover-midnightthoughts
+ protocol: HTTPS
+ hostname: "autodiscover.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autodiscover.midnightthoughts.space-tls
+ - name: https-autoconfig-lists-midnightthoughts
+ protocol: HTTPS
+ hostname: "autoconfig.lists.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autoconfig.lists.midnightthoughts.space-tls
+ - name: https-autodiscover-lists-midnightthoughts
+ protocol: HTTPS
+ hostname: "autodiscover.lists.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: autodiscover.lists.midnightthoughts.space-tls
+ - name: https-mta-sts-lists-midnightthoughts
+ protocol: HTTPS
+ hostname: "mta-sts.lists.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mta-sts.lists.midnightthoughts.space-tls
- name: https-wildcard-phorge-mtrnord-blog
protocol: HTTPS
hostname: "*.phorge.mtrnord.blog"
@@ -389,6 +533,18 @@ spec:
certificateRefs:
- kind: Secret
name: morg-statistics.midnightthoughts.space
+ - name: https-midnightthoughts-mta-sts
+ protocol: HTTPS
+ hostname: "mta-sts.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mta-sts.midnightthoughts.space
- name: https-midnightthoughts-lists
protocol: HTTPS
hostname: "lists.midnightthoughts.space"
diff --git a/apps/talos_cluster/envoy-gateway/kustomization.yaml b/apps/talos_cluster/envoy-gateway/kustomization.yaml
@@ -5,4 +5,3 @@ resources:
- repository.yaml
- release.yaml
- gateway_settings.yaml
- - email_gateway_settings.yaml
diff --git a/apps/talos_cluster/externaldns/release2.yaml b/apps/talos_cluster/externaldns/release2.yaml
@@ -1,82 +1,80 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
- name: external-dns-pdns
- namespace: kube-system
+ name: external-dns-pdns
+ namespace: kube-system
spec:
- releaseName: external-dns-pdns
- chart:
- spec:
- chart: external-dns
- sourceRef:
- kind: HelmRepository
- name: external-dns
- interval: 50m
- values:
- logLevel: debug
- extraArgs:
- - ENC[AES256_GCM,data:UOXZ87TvD01RmCSqZ6Pac4KvdNq1ln0qnLGgn/hCpZFuJ9I7lA==,iv:J/uHmh4xyrJ9f6cRtEUNql6Ex8C1cu8HQHneHTcuvs4=,tag:dnpode3dQ+4XIRJ7VVHkWg==,type:str]
- - ENC[AES256_GCM,data:lT7F/X6foTo5ZzdhKPQc0rlcrUcHcsxVl51Q//uJo7fJisZlOr3Na3C+tek9+iksULvFkSx2zYjKPQZJiJHlCa7iBXlxdaySusroRSOBzA==,iv:9r2919TFgmx3FrtiF/EZLrBRMJz1wJAm57wFCH7JMFI=,tag:ZbhXiyFg05xKuHhMCxS3DQ==,type:str]
- - ENC[AES256_GCM,data:vPqO4wLzPONE4JClRvWuacsGP1axiXMap623h5djoEobq+GFfmNhyk8Jp2CkO1DRBZAy0c/R4Dr+TJlanXSQFn35kpCTZzfMkfO4m+8Z+fn9,iv:uiIoPOctczJUpwQ3LKcQ619IVH4Zz+pOr/QeaO73eVs=,tag:kUJ8KBR/UKeLjCSLZJ7+Cg==,type:str]
- - ENC[AES256_GCM,data:ASXNyXBh1LO8fDfrxAbgIy6aiyFkZ6MrikYk9QsX,iv:mD37PE6/aNpHkSr2TTeOlaapB0V21dtyXjTVK+F2LdA=,tag:aFjkANeTUo7t9wd+swoIjQ==,type:str]
- provider:
- name: pdns
- sources:
- - gateway-httproute
- - gateway-grpcroute
- - gateway-tcproute
- - gateway-tlsroute
- - gateway-udproute
- - pod
- #- service
- rbac:
- additionalPermissions:
- - apiGroups:
- - ""
- resources:
- - namespaces
- verbs:
- - get
- - watch
- - list
- - apiGroups:
- - gateway.networking.k8s.io
- resources:
- - gateways
- - httproutes
- - grpcroutes
- - tlsroutes
- - tcproutes
- - udproutes
- verbs:
- - get
- - watch
- - list
- - apiGroups:
- - ""
- resources:
- - services
- verbs:
- - get
- - watch
- - list
+ releaseName: external-dns-pdns
+ chart:
+ spec:
+ chart: external-dns
+ sourceRef:
+ kind: HelmRepository
+ name: external-dns
+ interval: 50m
+ values:
+ logLevel: debug
+ extraArgs:
+ - ENC[AES256_GCM,data:gq62c+D+QKc6Yih8nLC/DjKaJpwnsH7XYx5oeJo8kikBgDKgIQ==,iv:EoRMQgmZBkaC3+KhHPGh+pkYx29P47SpM9wr1l9+1xo=,tag:FPqYQ9FxxkWXeDf9jdoqJQ==,type:str]
+ - ENC[AES256_GCM,data:6szm6kCZsJP7YTIqWbxM3USyT/JPgvpOzzqjj4XrcFOX9xwbcHvI/6BCB8hQPNGVeDEN5YllKMxl5O9kIAJswaOFJ3BSrta8sDCldcwdfw==,iv:WrgOzTPjAqnjJuvOH0Hw09QcfiICsJ11U03sI9oVdH8=,tag:SzknV3BFt8xUs5CkCfuqtA==,type:str]
+ - ENC[AES256_GCM,data:fJoZyefyEkaRSQJtmcWh00BJmO5JnrmUQvG6hh7J1w==,iv:dvzSvR3uvhrrAA9+Js68m3bp3mHz35q6CMtMaLqWj7A=,tag:hRdOFYYwGzLhAuLDUtovvg==,type:str]
+ provider:
+ name: pdns
+ sources:
+ - gateway-httproute
+ - gateway-grpcroute
+ - gateway-tcproute
+ - gateway-tlsroute
+ - gateway-udproute
+ #- service
+ rbac:
+ additionalPermissions:
+ - apiGroups:
+ - ""
+ resources:
+ - namespaces
+ verbs:
+ - get
+ - watch
+ - list
+ - apiGroups:
+ - gateway.networking.k8s.io
+ resources:
+ - gateways
+ - httproutes
+ - grpcroutes
+ - tlsroutes
+ - tcproutes
+ - udproutes
+ verbs:
+ - get
+ - watch
+ - list
+ - apiGroups:
+ - ""
+ resources:
+ - services
+ verbs:
+ - get
+ - watch
+ - list
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDaVFoOHkyVWFPT0V3Tjgw
- MlBRcFV2b1A5QS9FSDhVTTEwQTNGajJvalVVCnUrNHNiY2tQc2QzZkRNUFBSeFdu
- djM3VGFWekh5SjViVXM5SjlORlBmMXMKLS0tIFZ1aVhnQWFzRmY2Y3M0blFzaFVx
- Q1ZWT2ZKbFRpSmtKK0JsMXhFWmFFemcKbZ1NrHzpUVE5a7iFJiD09lp1KfqeiYD9
- 8HthiyNEv9L2pRqhJgV1/6Id1SnTumTvZIM/b8Y1ak2oPjHrPjc8LA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-04-15T08:19:32Z"
- mac: ENC[AES256_GCM,data:wy9i0KWs0mKCNy81bKL4JPwLni7grCYAAG92Lj/kH8qeHr28pORTP5m1kdN3EsQhiY5+WHvbcQVEWWs4F8Qs87KXF9pRpqqQ9ixPtZaQ8xH/vpMLxoTymp9PRIrCdyViEITwniw2bWYoVlpHMMhDjPi3kK51eyZ9Y2iL2aHLZzg=,iv:rJqPbn7gSDBtzmYEeOeftyw96E4QNWyup6e0mQuCjRo=,tag:pe7C7/BhldXoQpc9jwOkSQ==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials||pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret|content)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnNXFoaE55UUl3V1RpMjI4
+ SkJuRXZDTkNSd3c4MU56WTMraFBpcUcxYjJZClhrdGJHM2RUMURmZnd6cE5SVGtx
+ THZyUlVwQnM3dFE5blR2MVlHQ0tCYkEKLS0tIGRaMEhKWktCNHAzTzByUlRRaWNx
+ NmJrTHRkd3ZSYmozaWx3NnN4blhuWkUK0gHw8+6g+fxsD5hNcQmPFFEG/YBBfzsx
+ qMLOzKx3Ph7AbelMzkJcMSqKz6eqz8uETscv8lDUCyD7cWq9UbzJkg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-11-18T14:37:05Z"
+ mac: ENC[AES256_GCM,data:dD3ss+HxuIGZqFb9VTaD2yUbC0HMUptETG/pi1SiwCzoM5YRpcuBzfPN/dm9rwE8X7ihGp1z9JOWsXOp2DSQDZF/hCAZiVHRnU4Esx7GCgDV41x/HlcsMZlEGwNhvqBgBTjyehgpkQ8hz8MRqXj5xsBey9l4/dDuGS0JHLnZong=,iv:Jp3R03iGP8Q13o/L/EkCHWmUoc+kQRJxTA2bG32Rxto=,tag:V2iANOtO5GM6cGHdPa/J9w==,type:str]
+ pgp: []
+ encrypted_regex: ^(extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/namespaces/envoy.yaml b/apps/talos_cluster/namespaces/envoy.yaml
@@ -2,7 +2,3 @@ apiVersion: v1
kind: Namespace
metadata:
name: envoy-gateway
- labels:
- pod-security.kubernetes.io/audit: privileged
- pod-security.kubernetes.io/enforce: privileged
- pod-security.kubernetes.io/warn: privileged
diff --git a/apps/talos_cluster/stalwart/ingress.yaml b/apps/talos_cluster/stalwart/ingress.yaml
@@ -3,12 +3,41 @@ kind: HTTPRoute
metadata:
name: stalwart-admin
namespace: stalwart
- annotations:
- external-dns.alpha.kubernetes.io/hostname: stalwart.nordgedanken.dev,webmail.midnightthoughts.space,mta-sts.midnightthoughts.space,autoconfig.midnightthoughts.space,autodiscover.midnightthoughts.space,autoconfig.lists.midnightthoughts.space,autodiscover.lists.midnightthoughts.space,mta-sts.lists.midnightthoughts.space,autoconfig.phorge.mtrnord.blog,autodiscover.phorge.mtrnord.blog,mta-sts.phorge.mtrnord.blog
spec:
parentRefs:
- - name: email-gateway
+ - name: envoy-gateway
namespace: envoy-gateway
+ sectionName: https-stalwart-nordgedanken
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-webmail-midnightthoughts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-midnightthoughts-mta-sts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-autoconfig-midnightthoughts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-autodiscover-midnightthoughts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-autoconfig-lists-midnightthoughts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-autodiscover-lists-midnightthoughts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-mta-sts-lists-midnightthoughts
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-autoconfig-phorge
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-autodiscover-phorge
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: https-mta-sts-phorge
hostnames:
- stalwart.nordgedanken.dev
- webmail.midnightthoughts.space
