Ronni Baslund
88ac5e620c
ci / changes (push) Successful in 4s
ci / tc_portal (push) Has been skipped
ci / tc_operator (push) Has been skipped
ci / tc_website (push) Has been skipped
ci / tc_booking (push) Has been skipped
ci / tc_platform_api (push) Successful in 21s
ci / build_portal (push) Has been skipped
ci / build_booking (push) Has been skipped
ci / build_operator (push) Has been skipped
ci / test_platform_api (push) Successful in 33s
ci / build_platform_api (push) Successful in 19s
ci / deploy (push) Failing after 9s
Outlook autodiscovers via POST https://autodiscover.<domain>/autodiscover/ autodiscover.xml and Thunderbird via autoconfig.<domain>/mail/ config-v1.1.xml — Stalwart serves both (verified, answers carry mail.dezky.eu:993/465) but its HTTP listener wasn't reachable from outside (the node's :443 is Traefik's). New exact-path-only Ingress routes JUST those discovery endpoints to host-Stalwart via a selectorless Service + Endpoints on the cni0 gateway; the admin/management surface stays internal, and there's no HTTPS-redirect middleware because Thunderbird probes plain HTTP and Outlook POSTs. Domains page now also lists the autoconfig/autodiscover CNAMEs under the autodiscovery slot (CNAME verified against the mail host; a bare A record warns instead of failing). Customer-domain autodiscovery (per-domain certs + automated Ingress) is a follow-up.
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
# Mail-client autodiscovery for dezky.eu — routes ONLY the discovery paths
|
|
# through Traefik to host-Stalwart's HTTP listener (10.42.0.1:8080):
|
|
#
|
|
# autodiscover.dezky.eu POST /autodiscover/autodiscover.xml (Outlook)
|
|
# autoconfig.dezky.eu GET /mail/config-v1.1.xml (Thunderbird)
|
|
#
|
|
# Everything else on these hostnames (Stalwart's /admin, /login, /jmap …)
|
|
# falls through to Traefik's 404 — the management surface stays internal.
|
|
# No HTTPS-redirect middleware on purpose: Thunderbird probes plain HTTP and
|
|
# Outlook POSTs, which doesn't survive a 301 in all clients; both schemes
|
|
# serve the same answer.
|
|
#
|
|
# DNS at simply.com: autoconfig + autodiscover CNAME → mail.dezky.eu (the
|
|
# records are listed on the portal's Domains page).
|
|
#
|
|
# Customer domains (autodiscover.<customer>.tld) need per-domain certs and an
|
|
# automated Ingress/Certificate per verified domain — follow-up feature.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: stalwart-http
|
|
labels:
|
|
app.kubernetes.io/name: stalwart-http
|
|
app.kubernetes.io/part-of: dezky
|
|
spec:
|
|
# No selector — Stalwart runs on the HOST, not in a pod. The Endpoints
|
|
# object below pins the cni0 gateway address pods/Traefik can reach.
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: 8080
|
|
---
|
|
apiVersion: v1
|
|
kind: Endpoints
|
|
metadata:
|
|
name: stalwart-http
|
|
subsets:
|
|
- addresses:
|
|
- ip: 10.42.0.1
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: mail-autodiscovery
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- autodiscover.dezky.eu
|
|
- autoconfig.dezky.eu
|
|
secretName: autodiscovery-dezky-eu-tls
|
|
rules:
|
|
- host: autodiscover.dezky.eu
|
|
http:
|
|
paths:
|
|
# Outlook probes both capitalizations.
|
|
- path: /autodiscover/autodiscover.xml
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
- path: /Autodiscover/Autodiscover.xml
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
- host: autoconfig.dezky.eu
|
|
http:
|
|
paths:
|
|
- path: /mail/config-v1.1.xml
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|