Ronni Baslund
77898c5027
ci / changes (push) Successful in 4s
ci / tc_booking (push) Has been skipped
ci / tc_operator (push) Has been skipped
ci / tc_website (push) Has been skipped
ci / tc_platform_api (push) Successful in 23s
ci / tc_portal (push) Successful in 26s
ci / build_booking (push) Has been skipped
ci / build_operator (push) Has been skipped
ci / test_platform_api (push) Successful in 33s
ci / build_portal (push) Successful in 43s
ci / build_platform_api (push) Successful in 16s
ci / deploy (push) Successful in 43s
DAV was internal-only (the node's :443 is Traefik's). New mail-dav Ingress routes /.well-known/caldav, /.well-known/carddav and /dav on mail.dezky.eu through to Stalwart — with the HTTPS-redirect middleware (safe for DAV's GET/PROPFIND; kept OFF the autodiscover Ingress whose POSTs don't survive redirects). The _caldavs/_carddavs SRV records are now legitimate, so the Domains page surfaces them, and the Apple .mobileconfig gains CalDAV + CardDAV payloads: one install sets up Mail, Calendar and Contacts on Mac/iPhone. Stalwart's STALWART_PUBLIC_URL is set to https://mail.dezky.eu on the host (discovery documents).
111 lines
3.8 KiB
YAML
111 lines
3.8 KiB
YAML
# Mail-client autodiscovery for dezky.eu — routes ONLY the discovery paths
|
|
# through Traefik to host-Stalwart's HTTP listener (10.42.0.1:8080):
|
|
#
|
|
# autodiscover.dezky.eu POST /autodiscover/autodiscover.xml (Outlook)
|
|
# autoconfig.dezky.eu GET /mail/config-v1.1.xml (Thunderbird)
|
|
#
|
|
# Everything else on these hostnames (Stalwart's /admin, /login, /jmap …)
|
|
# falls through to Traefik's 404 — the management surface stays internal.
|
|
# No HTTPS-redirect middleware on purpose: Thunderbird probes plain HTTP and
|
|
# Outlook POSTs, which doesn't survive a 301 in all clients; both schemes
|
|
# serve the same answer.
|
|
#
|
|
# DNS at simply.com: autoconfig + autodiscover CNAME → mail.dezky.eu (the
|
|
# records are listed on the portal's Domains page).
|
|
#
|
|
# Customer domains (autodiscover.<customer>.tld) need per-domain certs and an
|
|
# automated Ingress/Certificate per verified domain — follow-up feature.
|
|
#
|
|
# NB: the ci-deployer Role carries explicit Endpoints write — the namespaced
|
|
# 'admin' role stopped granting it (CVE-2021-25740 hardening).
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: stalwart-http
|
|
labels:
|
|
app.kubernetes.io/name: stalwart-http
|
|
app.kubernetes.io/part-of: dezky
|
|
spec:
|
|
# No selector — Stalwart runs on the HOST, not in a pod. The Endpoints
|
|
# object below pins the cni0 gateway address pods/Traefik can reach.
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: 8080
|
|
---
|
|
apiVersion: v1
|
|
kind: Endpoints
|
|
metadata:
|
|
name: stalwart-http
|
|
subsets:
|
|
- addresses:
|
|
- ip: 10.42.0.1
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: mail-autodiscovery
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- autodiscover.dezky.eu
|
|
- autoconfig.dezky.eu
|
|
secretName: autodiscovery-dezky-eu-tls
|
|
rules:
|
|
- host: autodiscover.dezky.eu
|
|
http:
|
|
paths:
|
|
# Outlook probes both capitalizations.
|
|
- path: /autodiscover/autodiscover.xml
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
- path: /Autodiscover/Autodiscover.xml
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
- host: autoconfig.dezky.eu
|
|
http:
|
|
paths:
|
|
- path: /mail/config-v1.1.xml
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
---
|
|
# CalDAV/CardDAV for mail.dezky.eu — Apple Calendar/Contacts, Thunderbird and
|
|
# every other DAV client. Separate Ingress from the autodiscovery one because
|
|
# DAV gets the HTTPS-redirect middleware (safe for GET/PROPFIND; the
|
|
# autodiscover Ingress must stay redirect-free for Outlook's POST). Only the
|
|
# well-knowns + /dav are routed — the admin surface stays internal.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: mail-dav
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
|
|
traefik.ingress.kubernetes.io/router.middlewares: dezky-apps-redirect-https@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- mail.dezky.eu
|
|
secretName: mail-dezky-eu-traefik-tls
|
|
rules:
|
|
- host: mail.dezky.eu
|
|
http:
|
|
paths:
|
|
- path: /.well-known/caldav
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
- path: /.well-known/carddav
|
|
pathType: Exact
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|
|
- path: /dav
|
|
pathType: Prefix
|
|
backend: { service: { name: stalwart-http, port: { number: 8080 } } }
|