release.yaml (14222B)
1 apiVersion: helm.toolkit.fluxcd.io/v2 2 kind: HelmRelease 3 metadata: 4 name: mailserver 5 namespace: mailserver 6 spec: 7 releaseName: mailserver 8 interval: 60m 9 chart: 10 spec: 11 chart: docker-mailserver 12 sourceRef: 13 kind: HelmRepository 14 name: mailserver 15 values: 16 certificate: mail.midnightthoughts.space-tls 17 deployment: 18 env: 19 OVERRIDE_HOSTNAME: mail.midnightthoughts.space 20 # ----------------------------------------------- 21 # --- General Section --------------------------- 22 # ----------------------------------------------- 23 LOG_LEVEL: info 24 SUPERVISOR_LOGLEVEL: 25 DMS_VMAIL_UID: 26 DMS_VMAIL_GID: 27 ACCOUNT_PROVISIONER: 28 POSTMASTER_ADDRESS: postmaster@midnightthoughts.space 29 ENABLE_UPDATE_CHECK: 1 30 UPDATE_CHECK_INTERVAL: 1d 31 PERMIT_DOCKER: none 32 TZ: Europe/Berlin 33 NETWORK_INTERFACE: 34 TLS_LEVEL: 35 SPOOF_PROTECTION: 36 ENABLE_MTA_STS: 1 37 ENABLE_SRS: 0 38 ENABLE_OPENDKIM: 0 39 ENABLE_OPENDMARC: 0 40 ENABLE_POLICYD_SPF: 0 41 ENABLE_POP3: 0 42 ENABLE_IMAP: 1 43 ENABLE_CLAMAV: 0 44 ENABLE_RSPAMD: 1 45 ENABLE_RSPAMD_REDIS: 1 46 RSPAMD_LEARN: 1 47 RSPAMD_CHECK_AUTHENTICATED: 1 48 RSPAMD_GREYLISTING: 1 49 RSPAMD_HFILTER: 1 50 RSPAMD_HFILTER_HOSTNAME_UNKNOWN_SCORE: 3 51 RSPAMD_NEURAL: 0 52 ENABLE_AMAVIS: 0 53 AMAVIS_LOGLEVEL: 0 54 ENABLE_DNSBL: 0 55 # TODO: Setup proxy protocol in postfix and dovecot and envoy (See also https://docker-mailserver.github.io/docker-mailserver/latest/examples/tutorials/mailserver-behind-proxy/) 56 ENABLE_FAIL2BAN: 0 57 FAIL2BAN_BLOCKTYPE: drop 58 ENABLE_MANAGESIEVE: 59 POSTSCREEN_ACTION: enforce 60 SMTP_ONLY: 61 # These values are automatically set by the chart based on the certificate key 62 # SSL_TYPE: 63 # SSL_CERT_PATH: 64 # SSL_KEY_PATH: 65 SSL_ALT_CERT_PATH: 66 SSL_ALT_KEY_PATH: 67 VIRUSMAILS_DELETE_DELAY: 68 POSTFIX_DAGENT: 69 POSTFIX_MAILBOX_SIZE_LIMIT: 70 ENABLE_QUOTAS: 1 71 POSTFIX_MESSAGE_SIZE_LIMIT: 72 CLAMAV_MESSAGE_SIZE_LIMIT: 73 PFLOGSUMM_TRIGGER: 74 PFLOGSUMM_RECIPIENT: 75 PFLOGSUMM_SENDER: 76 LOGWATCH_INTERVAL: 77 LOGWATCH_RECIPIENT: 78 LOGWATCH_SENDER: 79 REPORT_RECIPIENT: 80 REPORT_SENDER: 81 LOGROTATE_COUNT: 4 82 LOGROTATE_INTERVAL: weekly 83 POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME: 0 84 POSTFIX_INET_PROTOCOLS: all 85 DOVECOT_INET_PROTOCOLS: all 86 # ----------------------------------------------- 87 # --- SpamAssassin Section ---------------------- 88 # ----------------------------------------------- 89 ENABLE_SPAMASSASSIN: 0 90 ENABLE_SPAMASSASSIN_KAM: 0 91 SPAMASSASSIN_SPAM_TO_INBOX: 1 92 MOVE_SPAM_TO_JUNK: 1 93 MARK_SPAM_AS_READ: 0 94 SA_TAG: 2.0 95 SA_TAG2: 6.31 96 SA_KILL: 10.0 97 SPAM_SUBJECT: "***SPAM*** " 98 # ----------------------------------------------- 99 # --- Fetchmail Section ------------------------- 100 # ----------------------------------------------- 101 ENABLE_FETCHMAIL: 0 102 FETCHMAIL_POLL: 300 103 FETCHMAIL_PARALLEL: 0 104 ENABLE_GETMAIL: 0 105 GETMAIL_POLL: 5 106 # ----------------------------------------------- 107 # --- LDAP Section ------------------------------ 108 # ----------------------------------------------- 109 LDAP_START_TLS: 110 LDAP_SERVER_HOST: 111 LDAP_SEARCH_BASE: 112 LDAP_BIND_DN: 113 LDAP_BIND_PW: 114 LDAP_QUERY_FILTER_USER: 115 LDAP_QUERY_FILTER_GROUP: 116 LDAP_QUERY_FILTER_ALIAS: 117 LDAP_QUERY_FILTER_DOMAIN: 118 # ----------------------------------------------- 119 # --- Dovecot Section --------------------------- 120 # ----------------------------------------------- 121 DOVECOT_TLS: 122 DOVECOT_USER_FILTER: 123 DOVECOT_PASS_FILTER: 124 DOVECOT_MAILBOX_FORMAT: maildir 125 DOVECOT_AUTH_BIND: 126 # ----------------------------------------------- 127 # --- Postgrey Section -------------------------- 128 # ----------------------------------------------- 129 ENABLE_POSTGREY: 0 130 POSTGREY_DELAY: 300 131 POSTGREY_MAX_AGE: 35 132 POSTGREY_TEXT: "Delayed by Postgrey" 133 POSTGREY_AUTO_WHITELIST_CLIENTS: 5 134 # ----------------------------------------------- 135 # --- SASL Section ------------------------------ 136 # ----------------------------------------------- 137 ENABLE_SASLAUTHD: 0 138 SASLAUTHD_MECHANISMS: 139 SASLAUTHD_MECH_OPTIONS: 140 SASLAUTHD_LDAP_SERVER: 141 SASLAUTHD_LDAP_BIND_DN: 142 SASLAUTHD_LDAP_PASSWORD: 143 SASLAUTHD_LDAP_SEARCH_BASE: 144 SASLAUTHD_LDAP_FILTER: 145 SASLAUTHD_LDAP_START_TLS: 146 SASLAUTHD_LDAP_TLS_CHECK_PEER: 147 SASLAUTHD_LDAP_TLS_CACERT_FILE: 148 SASLAUTHD_LDAP_TLS_CACERT_DIR: 149 SASLAUTHD_LDAP_PASSWORD_ATTR: 150 SASLAUTHD_LDAP_AUTH_METHOD: 151 SASLAUTHD_LDAP_MECH: 152 # ----------------------------------------------- 153 # --- SRS Section ------------------------------- 154 # ----------------------------------------------- 155 SRS_SENDER_CLASSES: envelope_sender 156 SRS_EXCLUDE_DOMAINS: 157 SRS_SECRET: 158 # ----------------------------------------------- 159 # --- Default Relay Host Section ---------------- 160 # ----------------------------------------------- 161 DEFAULT_RELAY_HOST: 162 # ----------------------------------------------- 163 # --- Multi-Domain Relay Section ---------------- 164 # ----------------------------------------------- 165 RELAY_HOST: 166 RELAY_PORT: 25 167 RELAY_USER: 168 RELAY_PASSWORD: 169 resources: 170 requests: 171 cpu: 249m 172 memory: 294Mi 173 limits: {} 174 service: 175 annotations: 176 external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 177 type: ClusterIP 178 nodePort: 179 smtp: 25 180 smtps: 465 181 submission: 587 182 imap: 143 183 imaps: 993 184 persistent_volume_claims: 185 mail-config: 186 accessModes: 187 - ReadWriteOnce 188 storageClass: ceph-filesystem 189 mail-data: 190 accessModes: 191 - ReadWriteOnce 192 storageClass: ceph-filesystem 193 mail-state: 194 accessModes: 195 - ReadWriteOnce 196 storageClass: ceph-filesystem 197 mail-log: 198 accessModes: 199 - ReadWriteOnce 200 storageClass: ceph-filesystem 201 rspamd: 202 ingress: 203 enabled: false 204 ingressClassName: traefik 205 annotations: 206 cert-manager.io/cluster-issuer: letsencrypt-dns 207 external-dns.alpha.kubernetes.io/hostname: midnightthoughts.space 208 host: rspamd.midnightthoughts.space 209 tls: 210 enabled: true 211 secret: rspamd.midnightthoughts.space-tls 212 proxyProtocol: 213 enabled: false 214 configMaps: 215 custom-commands.conf: 216 create: true 217 path: rspamd/custom-commands.conf 218 data: | 219 set-option-for-controller password "$2$q19y9w4kqeh1568zhy1ipszk6zx5usid$n3giktipbsr7pbef9b6n566jk4ggd147qrrhg5xtmauh6w4yoj5y" 220 dovecot.cf: 221 create: true 222 path: dovecot.cf 223 data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks }}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) 224 }}\n service imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n port = 993\n ssl = yes\n }\n\n inet_listener 225 imap_proxy {\n haproxy = yes\n port = 10143\n ssl = no\n }\n\n inet_listener imaps_proxy {\n haproxy = yes\n port = 10993\n ssl 226 = yes\n }\n } \n {{- end -}}\n\n {{- if and (.Values.deployment.env.ENABLE_POP3) (not .Values.deployment.env.SMTP_ONLY) }}\n service pop3-login {\n inet_listener pop3 {\n port 227 = 110\n }\n\n inet_listener pop3s {\n port = 995\n ssl = yes\n }\n\n inet_listener pop3_proxy {\n haproxy = yes\n port = 10110\n ssl 228 = no\n }\n\n inet_listener pop3s_proxy {\n haproxy = yes\n port = 10995\n ssl = yes\n } \n }\n {{- end -}}\n{{- end -}}\n" 229 fts-xapian-plugin.conf: 230 create: true 231 path: /etc/dovecot/conf.d/10-plugin.conf 232 data: | 233 {{- if .Values.dovecot.fullTextSearch.enabled }} 234 mail_plugins = $mail_plugins fts fts_xapian 235 236 plugin { 237 fts_decoder = decode2text 238 } 239 240 plugin { 241 fts = xapian 242 fts_xapian = partial=3 full=20 verbose={{ .Values.dovecot.fullTextSearch.verbose }} 243 244 fts_autoindex = yes 245 fts_enforced = yes 246 247 # Index attachements 248 fts_decoder = decode2text 249 } 250 251 service indexer-worker { 252 # limit size of indexer-worker RAM usage, ex: 512MB, 1GB, 2GB 253 vsz_limit = {{ .Values.dovecot.fullTextSearch.resources.memory }} 254 } 255 256 service decode2text { 257 executable = script /usr/lib/dovecot/decode2text.sh 258 user = dovecot 259 unix_listener decode2text { 260 mode = 0666 261 } 262 } 263 {{- end -}} 264 user-patches.sh: 265 create: true 266 path: user-patches.sh 267 data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat 268 <<EOS >> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - - smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n 269 \ -o smtpd_sasl_auth_enable=yes\n -o smtpd_sasl_type=dovecot\n -o smtpd_reject_unlisted_recipient=no\n -o smtpd_sasl_authenticated_header=yes\n -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n 270 \ -o smtpd_relay_restrictions=permit_sasl_authenticated,reject\n -o smtpd_sender_restrictions=\\$mua_sender_restrictions\n -o smtpd_discard_ehlo_keywords=\n -o milter_macro_daemon_name=ORIGINATING\n 271 \ -o cleanup_service_name=sender-cleanup\n -o smtpd_upstream_proxy_protocol=haproxy \n\n# Submissions with proxy\n10465 inet n - n - - smtpd\n -o syslog_name=postfix/submissions\n 272 \ -o smtpd_tls_wrappermode=yes\n -o smtpd_sasl_auth_enable=yes\n -o smtpd_sasl_type=dovecot\n -o smtpd_reject_unlisted_recipient=no\n -o smtpd_sasl_authenticated_header=yes\n -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n 273 \ -o smtpd_relay_restrictions=permit_sasl_authenticated,reject\n -o smtpd_sender_restrictions=\\$mua_sender_restrictions\n -o smtpd_discard_ehlo_keywords=\n -o milter_macro_daemon_name=ORIGINATING\n 274 \ -o cleanup_service_name=sender-cleanup\n -o smtpd_upstream_proxy_protocol=haproxy\n\n# Smtp with proxy\n12525 inet n - n - 1 postscreen\n -o syslog_name=postfix/smtp-proxy\n 275 \ -o postscreen_upstream_proxy_protocol=haproxy\n -o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache\nEOS\n{{- end }}\n" 276 --- 277 apiVersion: gateway.networking.k8s.io/v1alpha2 278 kind: TCPRoute 279 metadata: 280 name: mailserver-smtp 281 namespace: mailserver 282 annotations: 283 external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 284 spec: 285 parentRefs: 286 - name: email-gateway 287 namespace: envoy-gateway 288 sectionName: smtp 289 rules: 290 - backendRefs: 291 - name: mailserver-docker-mailserver 292 port: 25 293 --- 294 apiVersion: gateway.networking.k8s.io/v1alpha2 295 kind: TCPRoute 296 metadata: 297 name: mailserver-submissions 298 namespace: mailserver 299 annotations: 300 external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 301 spec: 302 parentRefs: 303 - name: email-gateway 304 namespace: envoy-gateway 305 sectionName: submissions 306 rules: 307 - backendRefs: 308 - name: mailserver-docker-mailserver 309 port: 465 310 --- 311 apiVersion: gateway.networking.k8s.io/v1alpha2 312 kind: TCPRoute 313 metadata: 314 name: mailserver-submission 315 namespace: mailserver 316 annotations: 317 external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 318 spec: 319 parentRefs: 320 - name: email-gateway 321 namespace: envoy-gateway 322 sectionName: submission 323 rules: 324 - backendRefs: 325 - name: mailserver-docker-mailserver 326 port: 587 327 --- 328 apiVersion: gateway.networking.k8s.io/v1alpha2 329 kind: TCPRoute 330 metadata: 331 name: mailserver-imap 332 namespace: mailserver 333 annotations: 334 external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 335 spec: 336 parentRefs: 337 - name: email-gateway 338 namespace: envoy-gateway 339 sectionName: imap 340 rules: 341 - backendRefs: 342 - name: mailserver-docker-mailserver 343 port: 143 344 --- 345 apiVersion: gateway.networking.k8s.io/v1alpha2 346 kind: TCPRoute 347 metadata: 348 name: mailserver-imaps 349 namespace: mailserver 350 annotations: 351 external-dns.alpha.kubernetes.io/hostname: mail.midnightthoughts.space 352 spec: 353 parentRefs: 354 - name: email-gateway 355 namespace: envoy-gateway 356 sectionName: imaps 357 rules: 358 - backendRefs: 359 - name: mailserver-docker-mailserver 360 port: 993 361 --- 362 apiVersion: gateway.networking.k8s.io/v1 363 kind: HTTPRoute 364 metadata: 365 name: mailserver-docker-mailserver-rspamd 366 namespace: mailserver 367 spec: 368 parentRefs: 369 - name: envoy-gateway 370 namespace: envoy-gateway 371 hostnames: 372 - rspamd.midnightthoughts.space 373 rules: 374 - backendRefs: 375 - name: mailserver-docker-mailserver 376 port: 11334 377 timeouts: 378 request: 240s 379 backendRequest: 0s