From d2bdaa658356d6f2114c8a326895bff4afc3ded1 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Thu, 12 Mar 2026 18:27:18 +0100
Subject: [PATCH] fix(stalwart): TLS cert %{file} macros, HTTPS egress for
 webadmin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stalwart v0.15.5 requires %{file:path}% macros to read cert/key
from disk — bare paths were treated as literal content, causing
"No certificates found" errors.

Added HTTPS egress to NetworkPolicy so Stalwart can download the
webadmin bundle and spam/geo databases from GitHub/CDN on boot.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 infra/k8s/network-policies/stalwart.yaml | 4 ++++
 infra/k8s/stalwart/stalwart.yaml         | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/infra/k8s/network-policies/stalwart.yaml b/infra/k8s/network-policies/stalwart.yaml
index 88a224659..01fdf2e4c 100644
--- a/infra/k8s/network-policies/stalwart.yaml
+++ b/infra/k8s/network-policies/stalwart.yaml
@@ -36,6 +36,10 @@ spec:
           protocol: UDP
         - port: 53
           protocol: TCP
+    # HTTPS out — webadmin bundle + spam model downloads from GitHub
+    - ports:
+        - port: 443
+          protocol: TCP
     # No outbound SMTP — internal-only for now.
     # To add SCW TEM relay later:
     #   - ports:
diff --git a/infra/k8s/stalwart/stalwart.yaml b/infra/k8s/stalwart/stalwart.yaml
index db22eb60c..aa40f67e9 100644
--- a/infra/k8s/stalwart/stalwart.yaml
+++ b/infra/k8s/stalwart/stalwart.yaml
@@ -62,8 +62,8 @@ data:
     store = "rocksdb"
 
     [certificate.default]
-    cert = "/opt/stalwart/tls/tls.crt"
-    private-key = "/opt/stalwart/tls/tls.key"
+    cert = "%{file:/opt/stalwart/tls/tls.crt}%"
+    private-key = "%{file:/opt/stalwart/tls/tls.key}%"
 ---
 apiVersion: apps/v1
 kind: Deployment