cluster

Infrastructure files for Nordgedanken and Midnightthoughts.
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.git
Log | Files | Refs | README

mta-sts-deployment.yaml (3827B)

      1 apiVersion: apps/v1
      2 kind: Deployment
      3 metadata:
      4   name: mta-sts-server
      5   namespace: mailserver
      6   labels:
      7     app: mta-sts-server
      8 spec:
      9   replicas: 1
     10   selector:
     11     matchLabels:
     12       app: mta-sts-server
     13   template:
     14     metadata:
     15       labels:
     16         app: mta-sts-server
     17     spec:
     18       containers:
     19         - name: nginx
     20           image: nginxinc/nginx-unprivileged:1.29-alpine
     21           ports:
     22             - containerPort: 8080
     23               name: http
     24           volumeMounts:
     25             - name: mta-sts-config
     26               mountPath: /etc/nginx/conf.d
     27               readOnly: true
     28             - name: mta-sts-content
     29               mountPath: /usr/share/nginx/html/.well-known
     30               readOnly: true
     31             - name: tmp
     32               mountPath: /tmp
     33             - name: var-cache-nginx
     34               mountPath: /var/cache/nginx
     35             - name: var-run
     36               mountPath: /var/run
     37           resources:
     38             requests:
     39               memory: "32Mi"
     40               cpu: "10m"
     41             limits:
     42               memory: "64Mi"
     43               cpu: "50m"
     44           livenessProbe:
     45             httpGet:
     46               path: /health
     47               port: 8080
     48             initialDelaySeconds: 10
     49             periodSeconds: 30
     50           readinessProbe:
     51             httpGet:
     52               path: /health
     53               port: 8080
     54             initialDelaySeconds: 5
     55             periodSeconds: 10
     56           securityContext:
     57             allowPrivilegeEscalation: false
     58             readOnlyRootFilesystem: true
     59             runAsNonRoot: true
     60             runAsUser: 101
     61             runAsGroup: 101
     62             capabilities:
     63               drop:
     64                 - ALL
     65             seccompProfile:
     66               type: RuntimeDefault
     67       volumes:
     68         - name: mta-sts-config
     69           configMap:
     70             name: mta-sts-nginx-config
     71         - name: mta-sts-content
     72           configMap:
     73             name: mta-sts-content
     74         - name: tmp
     75           emptyDir: {}
     76         - name: var-cache-nginx
     77           emptyDir: {}
     78         - name: var-run
     79           emptyDir: {}
     80       automountServiceAccountToken: false
     81       securityContext:
     82         fsGroup: 101
     83 ---
     84 apiVersion: v1
     85 kind: ConfigMap
     86 metadata:
     87   name: mta-sts-nginx-config
     88   namespace: mailserver
     89 data:
     90   default.conf:
     91     "server {\n    listen 8080;\n    server_name _;\n    \n    root /usr/share/nginx/html;\n    index index.html;\n\n    # Security headers\n    add_header X-Content-Type-Options nosniff;\n
     92     \   add_header X-Frame-Options DENY;\n    add_header X-XSS-Protection \"1; mode=block\";\n\n    # MTA-STS specific configuration\n    location /.well-known/mta-sts.txt {\n        add_header Content-Type
     93     \"text/plain; charset=utf-8\";\n        add_header Cache-Control \"max-age=604800\";\n        try_files $uri =404;\n    }\n\n    # Health check endpoint\n    location /health {\n        access_log off;\n
     94     \       return 200 \"healthy\\n\";\n        add_header Content-Type text/plain;\n    }\n\n    # Deny access to other locations\n    location / {\n        return 404;\n    }\n\n    # Disable server tokens\n
     95     \   server_tokens off;\n}\n"
     96 ---
     97 apiVersion: v1
     98 kind: Service
     99 metadata:
    100   name: mta-sts-server
    101   namespace: mailserver
    102   labels:
    103     app: mta-sts-server
    104 spec:
    105   selector:
    106     app: mta-sts-server
    107   ports:
    108     - name: http
    109       port: 8080
    110       targetPort: http
    111       protocol: TCP
    112   type: ClusterIP
    113 # ---
    114 # apiVersion: gateway.networking.k8s.io/v1
    115 # kind: HTTPRoute
    116 # metadata:
    117 #   name: mailserver-mta-sts
    118 #   namespace: mailserver
    119 # spec:
    120 #   parentRefs:
    121 #     - name: envoy-gateway
    122 #       namespace: envoy-gateway
    123 #   hostnames:
    124 #     - mta-sts.midnightthoughts.space
    125 #   rules:
    126 #     - backendRefs:
    127 #         - name: mta-sts-server
    128 #           port: 8080
    129 #       timeouts:
    130 #         request: 240s
    131 #         backendRequest: 0s