Page MenuHomePhorge
Files F117751667

No OneTemporary
Actions

Authored By
Unknown
Size
21 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/helm/templates/imap-deployment.yaml b/helm/templates/imap-deployment.yaml
index e27a540..032fb14 100644
--- a/helm/templates/imap-deployment.yaml
+++ b/helm/templates/imap-deployment.yaml
@@ -1,185 +1,189 @@
{{- if and .Values.imap.enabled -}}
apiVersion: apps/v1
{{- if .Values.imap.murder.enabled }}
kind: StatefulSet
{{- else }}
kind: Deployment
{{- end }}
metadata:
annotations:
alpha.image.policy.openshift.io/resolve-names: '*'
labels:
app: imap
app.kubernetes.io/name: imap
app.kubernetes.io/part-of: kolab-app
name: imap
spec:
replicas: {{ .Values.imap.replicas }}
{{- if .Values.imap.murder.enabled }}
serviceName: imap-headless
{{- end }}
revisionHistoryLimit: 10
selector:
matchLabels:
app: imap
{{- if .Values.imap.murder.enabled }}
updateStrategy:
type: RollingUpdate
# # We only hold cached data
# persistentVolumeClaimRetentionPolicy:
# whenDeleted: Delete
# whenScaled: Delete
# volumeClaimTemplates:
# - metadata:
# name: imap-lib
# spec:
# accessModes:
# - ReadWriteOnce
# storageClassName: {{ .Values.imap.volumes.lib.storageClassName }}
# resources:
# requests:
# storage: {{ .Values.imap.volumes.lib.capacity }}
{{- else }}
strategy:
type: Recreate
{{- end }}
template:
metadata:
annotations:
- checksum/config: {{ include (print $.Template.BasePath "/kolab-configmap.yaml") . | sha256sum }}
checksum/secret: {{ include (print $.Template.BasePath "/kolab-admin-secret.yaml") . | sha256sum }}
{{- range $key, $value := .Values.imap.podAnnotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
labels:
app: imap
spec:
{{- if .Values.openshift }}
serviceAccountName: imapserviceaccount
{{- end }}
volumes:
{{- if not .Values.imap.murder.enabled }}
- name: imap-spool
persistentVolumeClaim:
claimName: imap-spool
- name: imap-lib
persistentVolumeClaim:
claimName: imap-lib
{{- else }}
- name: imap-lib
emptyDir: {}
{{- end }}
- name: kolab-cert
secret:
{{- $secretName := include "kolab.tlsSecretName" . }}
secretName: {{ default .Values.imap.tlsSecretName $secretName }}
{{- if .Values.image.pullSecret }}
imagePullSecrets:
- name: registry-pull-secret
{{- end }}
containers:
- name: imap
image: {{ .Values.image.imapImage }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
resources:
{{- toYaml .Values.imap.resources | nindent 10 }}
securityContext:
runAsNonRoot: false
runAsUser: 0
startupProbe:
exec:
command:
- /bin/sh
- -c
- test -e /run/saslauthd/mux && test -e /var/run/master.pid && kill -0 $(cat /var/run/master.pid)
periodSeconds: 2
failureThreshold: 600
# When we authentication requests time auth saslauthd ends up in a zombie/defunct state, which we detect via grep
livenessProbe:
exec:
command:
- /bin/sh
- -c
- test -e /run/saslauthd/mux && kill -0 $(cat /var/run/master.pid) && (echo > /dev/tcp/127.0.0.1/11080) && grep -vq "(saslauthd) Z" /proc/$(cat /var/run/saslauthd/saslauthd.pid)/stat
periodSeconds: 5
timeoutSeconds: 5
# Recovery during startup can take a long time, the socket will only become available once complete.
readinessProbe:
tcpSocket:
port: 11143
periodSeconds: 5
- envFrom:
- - configMapRef:
- name: kolab-config
env:
+ - name: APP_SERVICES_DOMAIN
+ value: "{{ .Values.kolab.servicesService}}"
+ - name: SERVICES_PORT
+ value: "80"
+ - name: MAXLOGINS_PER_USER
+ value: "50"
- name: SSL_CERTIFICATE
value: /etc/certs/tls.crt
- name: SSL_CERTIFICATE_KEY
value: /etc/certs/tls.key
+ - name: IMAP_ADMIN_LOGIN
+ value: "{{ .Values.imap.adminLogin }}"
- name: IMAP_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
key: IMAP_ADMIN_PASSWORD
name: kolab-admin-secret
- name: WITH_TAGS
value: "true"
- name: EXPIRY_DELAY
value: "{{ .Values.imap.expiryDelay }}"
{{- if .Values.imap.murder.enabled }}
- name: TLS_SERVER_CA_FILE
value: /etc/certs/ca.cert
- name: MUPDATE
value: {{ .Values.imap.murder.externalMaster }}
- name: SERVERLIST
value: {{ .Values.imap.murder.externalBackends }}
- name: ROLE
value: "frontend"
- name: WITH_TLS
value: "true"
- name: SERVERNAME
valueFrom:
fieldRef:
fieldPath: metadata.name
{{- end }}
{{- if .Values.imap.replica.enabled }}
- name: SYNC_HOST
value: "imap-replica"
{{- end }}
{{- if .Values.imap.enableLegacySyncServer }}
- name: WITH_LEGACY_SYNC_SERVER
value: "true"
{{- end }}
{{- if .Values.imap.skipChown }}
- name: SKIP_CHOWN
value: "true"
{{- end }}
ports:
- containerPort: 11993
protocol: TCP
- containerPort: 11143
protocol: TCP
- containerPort: 11080
protocol: TCP
- containerPort: 11443
protocol: TCP
- containerPort: 4190
protocol: TCP
- containerPort: 11024
protocol: TCP
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
{{- if not .Values.imap.murder.enabled }}
- name: imap-spool
mountPath: /var/spool/imap
{{- end }}
- name: imap-lib
mountPath: /var/lib/imap
- name: kolab-cert
readOnly: true
mountPath: /etc/certs
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30
{{- end }}
diff --git a/helm/templates/kolab-configmap.yaml b/helm/templates/kolab-configmap.yaml
index 13894f8..7cdf9b7 100644
--- a/helm/templates/kolab-configmap.yaml
+++ b/helm/templates/kolab-configmap.yaml
@@ -1,105 +1,104 @@
{{- if .Values.kolab.enabled -}}
kind: ConfigMap
apiVersion: v1
metadata:
name: kolab-config
immutable: false
data:
APP_DOMAIN: "{{ template "kolab.emailDomain" . }}"
APP_WEBSITE_DOMAIN: "{{ template "kolab.websiteDomain" .}}"
APP_SERVICES_DOMAIN: "{{ .Values.kolab.servicesService}}"
APP_SERVICES_ALLOWED_DOMAINS: "kolab,services.{{ template "kolab.websiteDomain" . }},{{ .Values.kolab.servicesService}}"
- SERVICES_PORT: "80"
ASSET_URL: "https://{{ template "kolab.websiteDomain" . }}"
APP_NAME: "{{ .Values.kolab.name }}"
APP_URL: "https://{{ template "kolab.websiteDomain" . }}"
APP_PUBLIC_URL: "https://{{ template "kolab.websiteDomain" . }}"
APP_WITH_SERVICES: 'true'
APP_WITH_WALLET: '{{ .Values.kolab.withWallet }}'
APP_WITH_SIGNUP: '{{ .Values.kolab.withSignup }}'
APP_WITH_FILES: '{{ .Values.kolab.withFiles }}'
APP_WITH_DISTLISTS: '{{ .Values.kolab.withDistlists }}'
APP_WITH_SHARED_FOLDERS: '{{ .Values.kolab.withSharedFolders }}'
APP_WITH_RESOURCES: '{{ .Values.kolab.withResources }}'
APP_WITH_MEET: '{{ .Values.kolab.withMeet }}'
APP_WITH_COMPANION_APP: '{{ .Values.kolab.withCompanionApp }}'
APP_WITH_ADMIN: 'true'
APP_WITH_DELEGATION: '{{ .Values.kolab.withDelegation }}'
APP_WITH_LOGINAS: '{{ .Values.kolab.withLoginas }}'
APP_WITH_MAILFILTER: '{{ .Values.kolab.withMailfilter }}'
APP_WITH_USER_SEARCH: '{{ .Values.kolab.withUserSearch }}'
APP_IMAP: 'true'
APP_DEBUG: '{{ .Values.kolab.debug }}'
APP_ENV: "production"
{{- if .Values.minio.enabled }}
FILESYSTEM_DISK: "minio"
MINIO_USER: "{{ .Values.minio.rootUser }}"
MINIO_BUCKET: "{{ .Values.minio.bucketName }}"
{{- end }}
LOG_CHANNEL: "stdout"
LOG_SLOW_REQUESTS: "5"
LOG_LEVEL: "debug"
QUEUE_CONNECTION: "redis"
IMAP_URI: "{{ .Values.imap.uri }}"
IMAP_HOST: "{{ .Values.imap.host }}"
IMAP_PORT: "{{ .Values.imap.port }}"
IMAP_PROXY_PROTOCOL: 'false'
IMAP_ADMIN_LOGIN: "{{ .Values.imap.adminLogin }}"
IMAP_VERIFY_HOST: 'false'
IMAP_VERIFY_PEER: 'false'
IMAP_WITH_GROUPWARE_DEFAULT_FOLDERS: '{{ .Values.kolab.kolabObjectCompatMode }}'
{{- if .Values.kolab.davEnabled }}
# The trailing slash is currently required
DAV_URI: "http://proxy/dav/"
DAV_VERIFY: 'false'
DAV_WITH_DEFAULT_FOLDERS: 'true'
{{- end }}
{{- if or .Values.ldap.enabled .Values.ldap.host }}
APP_LDAP: 'true'
LDAP_DOMAIN_BASE_DN: "{{ .Values.ldap.domainBaseDn }}"
LDAP_HOSTS: "{{ .Values.ldap.host }}"
LDAP_PORT: "{{ .Values.ldap.port }}"
LDAP_USE_SSL: "0"
LDAP_USE_TLS: "0"
# Administrative
LDAP_ADMIN_ROOT_DN: "{{ .Values.ldap.adminRootDn }}"
LDAP_ADMIN_BIND_DN: "{{ .Values.ldap.adminBindDn }}"
# Hosted (public registration)
LDAP_HOSTED_ROOT_DN: "{{ .Values.ldap.hostedRootDn }}"
{{- else }}
APP_LDAP: 'false'
{{- end }}
REDIS_HOST: "{{ .Values.redis.host }}"
REDIS_PORT: "6379"
TRUSTED_PROXIES: "{{ .Values.trustedProxies }}"
WEBMAIL_URL: "{{ .Values.kolab.webmailUrl }}"
# This is used for the NGINX proxy
SMTP_HOST: "{{ .Values.postfix.externalSubmissionHost }}"
SMTP_PORT: "{{ .Values.postfix.externalSubmissionPort }}"
MAIL_MAILER: "smtp"
# This is used to send email
MAIL_HOST: "{{ .Values.postfix.smtpHost }}"
MAIL_PORT: "{{ .Values.postfix.smtpPort }}"
MAIL_ENCRYPTION: "{{ .Values.postfix.smtpEncryption }}"
{{- if .Values.postfix.submissionUsername }}
MAIL_USERNAME: "{{ tpl .Values.postfix.submissionUsername . }}"
{{- end }}
MAIL_FROM_ADDRESS: "noreply@{{ template "kolab.emailDomain" . }}"
MAIL_FROM_NAME: "{{ template "kolab.emailDomain" . }}"
MAIL_REPLYTO_ADDRESS: "noreply@{{ template "kolab.emailDomain" . }}"
MAIL_REPLYTO_NAME: 'null'
MAIL_VERIFY_PEER: 'false'
RATELIMIT_WHITELIST: "noreply@{{ template "kolab.emailDomain" . }}"
APP_HEADER_CSP: "connect-src 'self' wss://{{ template "kolab.websiteDomain" . }}/; child-src 'self'; font-src 'self'; form-action 'self' data:; frame-ancestors 'self'; img-src blob: data: 'self' *; media-src 'self'; object-src 'self'; script-src 'self' https://{{ template "kolab.websiteDomain" . }} 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://{{ template "kolab.websiteDomain" . }} 'unsafe-eval' 'unsafe-inline'; default-src 'self';"
APP_HEADER_XFO: sameorigin
{{- if .Values.kolab.company }}
COMPANY_NAME: '{{ .Values.kolab.company.name }}'
COMPANY_ADDRESS: '{{ .Values.kolab.company.address }}'
COMPANY_COPYRIGHT: '{{ .Values.kolab.company.address }}'
COMPANY_DETAILS: '{{ .Values.kolab.company.details }}'
COMPANY_EMAIL: '{{ .Values.kolab.company.email }}'
COMPANY_FOOTER: '{{ .Values.kolab.company.footer }}'
COMPANY_LOGO: '{{ .Values.kolab.company.logo }}'
{{- end }}
VAT_MODE: "0"
{{- end }}
diff --git a/helm/templates/postfix-deployment.yaml b/helm/templates/postfix-deployment.yaml
index ef6259b..9b1e670 100644
--- a/helm/templates/postfix-deployment.yaml
+++ b/helm/templates/postfix-deployment.yaml
@@ -1,306 +1,306 @@
{{- if .Values.postfix.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
annotations:
alpha.image.policy.openshift.io/resolve-names: '*'
labels:
app: postfix
app.kubernetes.io/name: postfix
app.kubernetes.io/part-of: kolab-app
name: postfix
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: postfix
strategy:
type: Recreate
template:
metadata:
annotations:
- checksum/config: {{ include (print $.Template.BasePath "/kolab-configmap.yaml") . | sha256sum }}
- checksum/secret: {{ include (print $.Template.BasePath "/kolab-secret.yaml") . | sha256sum }}
+ checksum/secret: {{ include (print $.Template.BasePath "/mariadb-secret.yaml") . | sha256sum }}
labels:
app: postfix
spec:
# Allows to run as root
{{- if .Values.openshift }}
serviceAccountName: postfixserviceaccount
{{- end }}
volumes:
- name: postfix-spool
persistentVolumeClaim:
claimName: postfix-spool
- name: postfix-lib
persistentVolumeClaim:
claimName: postfix-lib
- name: kolab-cert
secret:
{{- $secretName := include "kolab.tlsSecretName" . }}
secretName: {{ default .Values.postfix.tlsSecretName $secretName }}
- name: amavis-spool
persistentVolumeClaim:
claimName: amavis-spool
- name: spamassassin-lib
persistentVolumeClaim:
claimName: spamassassin-lib
- name: clamav-lib
persistentVolumeClaim:
claimName: clamav-lib
- name: dkim-cert
secret:
secretName: dkim-cert
- name: postfix-scripts
configMap:
name: postfix-scripts
defaultMode: 0777
{{- if .Values.image.pullSecret }}
imagePullSecrets:
- name: registry-pull-secret
{{- end }}
containers:
- name: postfix
image: {{ .Values.image.postfixImage }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
resources:
{{- toYaml .Values.postfix.resources | nindent 10 }}
securityContext:
runAsNonRoot: false
# Postfix insists on running as root
runAsUser: 0
startupProbe:
exec:
command:
- /bin/sh
- -c
- test -e /run/saslauthd/mux && kill -0 $(cat /var/spool/postfix/pid/master.pid)
periodSeconds: 2
failureThreshold: 60
# When we authentication requests time auth saslauthd ends up in a zombie/defunct state, which we detect via grep
livenessProbe:
exec:
command:
- /bin/sh
- -c
- test -e /run/saslauthd/mux && kill -0 $(cat /var/spool/postfix/pid/master.pid) && grep -vq "(saslauthd) Z" /proc/$(cat /var/run/saslauthd/saslauthd.pid)/stat
periodSeconds: 10
- envFrom:
- - configMapRef:
- name: kolab-config
- - secretRef:
- name: kolab-config-secret
env:
+ - name: APP_DOMAIN
+ value: "{{ template "kolab.emailDomain" . }}"
+ - name: APP_SERVICES_DOMAIN
+ value: "{{ .Values.kolab.servicesService }}"
+ - name: SERVICES_PORT
+ value: "80"
- name: DB_HOST
valueFrom:
secretKeyRef:
key: database-host
name: mariadb
- name: DB_USERNAME
valueFrom:
secretKeyRef:
key: kolab-database-user
name: mariadb
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
key: kolab-database-password
name: mariadb
- name: DB_DATABASE
valueFrom:
secretKeyRef:
key: kolab-database-name
name: mariadb
- name: SSL_CERTIFICATE
value: /etc/certs/tls.crt
- name: SSL_CERTIFICATE_KEY
value: /etc/certs/tls.key
- name: LMTP_DESTINATION
value: imap:11024
- name: AMAVIS_HOST
value: "127.0.0.1"
- name: MESSAGE_SIZE_LIMIT
value: "{{ .Values.postfix.messageSizeLimit }}"
- name: MYNETWORKS
{{- if .Values.postfix.mynetworks }}
value: "{{ .Values.postfix.mynetworks }}"
{{- else }}
value: "127.0.0.0/8"
{{- end }}
- name: WITH_CONTENTFILTER
value: '{{ .Values.kolab.withMailfilter }}'
- name: WITH_PROXY_PROTOCOL
value: '{{ .Values.postfix.withProxyProtocol }}'
{{- if .Values.postfix.blockOutgoingEmails }}
- name: BLOCK_OUTGOING_EMAILS
value: "true"
{{- end }}
{{- if .Values.postfix.holdIncomingEmails }}
- name: HOLD_INCOMING_EMAILS
value: "true"
{{- end }}
ports:
# SMTP
- containerPort: 10025
protocol: TCP
# Internal submission
- containerPort: 10587
protocol: TCP
# External
- containerPort: 11465
protocol: TCP
- containerPort: 11587
protocol: TCP
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /var/spool/postfix
name: postfix-spool
- mountPath: /var/lib/postfix
name: postfix-lib
- name: kolab-cert
readOnly: true
mountPath: /etc/certs
- name: amavis
image: {{ .Values.image.amavisImage }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
resources:
{{- toYaml .Values.amavis.resources | nindent 10 }}
securityContext:
runAsNonRoot: false
# Amavis insists on running as root
runAsUser: 0
startupProbe:
exec:
command:
- /bin/sh
- -c
- test -e /var/run/amavisd/amavisd.pid
periodSeconds: 5
failureThreshold: 60
livenessProbe:
exec:
command:
- /bin/sh
- -c
# - test -e /var/run/amavisd/amavisd.pid && kill -0 $(cat /var/run/amavisd/amavisd.pid) && kill -0 $(cat /var/run/amavisd/clamd.pid)
- test -e /var/run/amavisd/amavisd.pid && kill -0 $(cat /var/run/amavisd/amavisd.pid)
periodSeconds: 10
envFrom:
- configMapRef:
name: kolab-config
env:
# Perl can't deal with a searchlist like we have on openshift in /etc/resolv.conf
# We can override it like this and make dns requests by sa-update work
- name: RES_SEARCHLIST
value: ""
- name: POSTFIX_HOST
value: "127.0.0.1"
- name: DKIM_IDENTIFIER
value: {{ .Values.amavis.dkim.identifier }}
- name: CLAMD
value: "{{ .Values.amavis.clamd.enabled }}"
- name: SPAM_DETECT_LEVEL
value: "{{ .Values.amavis.spam.detectLevel }}"
- name: SPAM_KILL_LEVEL
value: "{{ .Values.amavis.spam.killLevel }}"
- name: SPAM_KILL_ACTION
{{- if .Values.amavis.spam.forwardToInbox }}
value: "D_PASS"
{{- else }}
value: "D_DISCARD"
{{- end }}
- name: DB_HOST
valueFrom:
secretKeyRef:
key: database-host
name: mariadb
- name: DB_USERNAME
valueFrom:
secretKeyRef:
key: kolab-database-user
name: mariadb
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
key: kolab-database-password
name: mariadb
- name: DB_DATABASE
valueFrom:
secretKeyRef:
key: kolab-database-name
name: mariadb
- name: REDIS_HOST
value: "{{ .Values.redis.host }}"
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
key: database-password
name: redis
ports:
- containerPort: 13025
protocol: TCP
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /var/spool/amavisd
name: amavis-spool
- mountPath: /var/lib/spamassassin
name: spamassassin-lib
- mountPath: /var/lib/clamav
name: clamav-lib
- name: dkim-cert
mountPath: /var/dkim
- name: metricsexporter
image: {{ .Values.image.postfixImage }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
command: ['sh', '-c', 'while true; do /postfix-scripts/collectmetrics.sh; sleep 20; done']
volumeMounts:
- mountPath: /var/spool/postfix
name: postfix-spool
- mountPath: /postfix-scripts
name: postfix-scripts
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: ConfigMap
metadata:
name: postfix-scripts
data:
collectmetrics.sh: |
#!/bin/bash
HOST="postfix-metrics"
EPOCH=$(date +"%s")
METRICS=$(
cat <<EOF
kolab_mx_metrics_timestamp $EPOCH
# HELP kolab_mx_queue_length Queue length
# TYPE kolab_mx_queue_length gauge
EOF
)
queues="active bounce corrupt deferred flush hold incoming maildrop"
spool_dir=/var/spool/postfix
for queue in ${queues}; do
test -d ${spool_dir}/${queue} || continue
COUNT=$(find "${spool_dir}/${queue}" -type f -print | wc -l)
# TODO once we have more than one instance, we should seaprate accordingly
METRICS+=$(
cat <<EOF
kolab_mx_queue_length{host="$HOST", queue="$queue", instance="postfix"} $COUNT
EOF
)
done
echo "$METRICS"
echo "$METRICS" | curl -k --data-binary @- http://pushgateway:9091/metrics/job/postfixmetrics/host/$HOST
{{- end }}

File Metadata

Mime Type
text/x-diff
Expires
Sat, Apr 4, 3:20 AM (1 d, 9 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
18822383
Default Alt Text
(21 KB)

Event Timeline