Stalwart's --init only runs when config.toml is absent, but ours
is mounted from a ConfigMap so no admin account was ever created.
Use the fallback-admin config with %{env:ADMIN_SECRET}% referencing
a stalwart-admin K8s secret. This survives pod restarts without
depending on RocksDB-stored credentials.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Stalwart v0.15.5 requires %{file:path}% macros to read cert/key
from disk — bare paths were treated as literal content, causing
"No certificates found" errors.
Added HTTPS egress to NetworkPolicy so Stalwart can download the
webadmin bundle and spam/geo databases from GitHub/CDN on boot.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Image renamed from stalwartlabs/mail-server to stalwartlabs/stalwart.
Volume mounts updated from /opt/stalwart-mail/ to /opt/stalwart/
to match the actual container filesystem layout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add Stalwart all-in-one mail server: SMTP (cluster-internal relay for
Mattermost), IMAP + HTTPS admin via Tailscale proxy. RocksDB storage,
self-signed TLS (stalwart-tls secret). No public MX, no outbound SMTP.
SCW TEM relay noted in NetworkPolicy comments for future use.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
