From 28471d2ab51b5352e79bf09669ad7ea98daedb04 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Thu, 12 Mar 2026 23:01:42 +0100
Subject: [PATCH] feat(stalwart): fallback-admin via K8s secret for reliable
 auth

Stalwart's --init only runs when config.toml is absent, but ours
is mounted from a ConfigMap so no admin account was ever created.
Use the fallback-admin config with %{env:ADMIN_SECRET}% referencing
a stalwart-admin K8s secret. This survives pod restarts without
depending on RocksDB-stored credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/stalwart/stalwart.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/infra/k8s/stalwart/stalwart.yaml b/infra/k8s/stalwart/stalwart.yaml
index aa40f67e9..c2e4e9b49 100644
--- a/infra/k8s/stalwart/stalwart.yaml
+++ b/infra/k8s/stalwart/stalwart.yaml
@@ -61,6 +61,10 @@ data:
     type = "internal"
     store = "rocksdb"
 
+    [authentication.fallback-admin]
+    user = "admin"
+    secret = "%{env:ADMIN_SECRET}%"
+
     [certificate.default]
     cert = "%{file:/opt/stalwart/tls/tls.crt}%"
     private-key = "%{file:/opt/stalwart/tls/tls.key}%"
@@ -91,6 +95,12 @@ spec:
       containers:
         - name: stalwart
           image: stalwartlabs/stalwart:latest
+          env:
+            - name: ADMIN_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: stalwart-admin
+                  key: password
           ports:
             - containerPort: 25
               name: smtp