proxy DAV (2cb9519)
proxy_pass $backend_url; with a variable in the URI causes nginx to drop the original request URI and send everything to the bare upstream path (effectively /dav). Switched to proxy_pass $backend_url$request_uri; so the path is preserved, and dropped the /dav/ suffix that would otherwise be doubled.
Also fully qualified the dav upstream with .<namespace>.svc.cluster.local since nginx's internal resolver doesn't support search domains.
IMAPReplicaOutOfSync alert (cab1a5e)
Expression was inverted (== 0 would only fire when in sync). Flipped to != 0.
Alertmanager SMTP (8ef7684)
Point smtp_smarthost at external-smtp:25 instead of postfix:587. The submission endpoint on postfix lacks the permit_mynetworks overrides, so alertmanager submissions were rejected; port 25 on external-smtp accepts them. Also needed smtp_tls_config.insecure_skip_verify: true.
Prometheus blackbox probes (d577c0c)
The IMAP pod no longer listens on 993, so the probe was failing. Switched to plaintext IMAP on 143 with the tcp module.
Loosened the SMTP query_response regexes from ^250- to ^250[- ] so the final EHLO line (which uses a space, not a dash) matches.
cert-issuer (0c87849)
Added ingressClassName: haproxy alongside the legacy class: haproxy field on the cert-manager HTTP-01 solver, which is the recommended method on newer cert-manager.