# Internal-only mail server. No public MX, no LoadBalancer.
# SMTP: cluster-internal (Mattermost relay)
# IMAP: via Tailscale proxy (port 993)
# HTTPS admin: via Tailscale proxy (port 443 → mail.fxhnt.ai)
# Outbound: not configured (add SCW TEM relay later if needed)
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: stalwart-data
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: stalwart
    app.kubernetes.io/part-of: foxhunt
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: scw-bssd
  resources:
    requests:
      storage: 5Gi
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: stalwart-config
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: stalwart
    app.kubernetes.io/part-of: foxhunt
data:
  config.toml: |
    [server]
    hostname = "mail.fxhnt.ai"

    [server.listener.smtp]
    bind = "[::]:25"
    protocol = "smtp"

    [server.listener.imaptls]
    bind = "[::]:993"
    protocol = "imap"
    tls.implicit = true

    [server.listener.https]
    bind = "[::]:443"
    protocol = "http"
    tls.implicit = true

    [storage]
    data = "rocksdb"
    blob = "rocksdb"
    fts = "rocksdb"
    lookup = "rocksdb"
    directory = "internal"

    [store.rocksdb]
    type = "rocksdb"
    path = "/opt/stalwart/data"

    [directory.internal]
    type = "internal"
    store = "rocksdb"

    [authentication.fallback-admin]
    user = "admin"
    secret = "%{env:ADMIN_SECRET}%"

    [certificate.default]
    cert = "%{file:/opt/stalwart/tls/tls.crt}%"
    private-key = "%{file:/opt/stalwart/tls/tls.key}%"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: stalwart
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: stalwart
    app.kubernetes.io/part-of: foxhunt
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: stalwart
  strategy:
    type: Recreate  # RWO PVC
  template:
    metadata:
      labels:
        app.kubernetes.io/name: stalwart
        app.kubernetes.io/part-of: foxhunt
    spec:
      nodeSelector:
        k8s.scaleway.com/pool-name: platform
      containers:
        - name: stalwart
          image: stalwartlabs/stalwart:latest
          env:
            - name: ADMIN_SECRET
              valueFrom:
                secretKeyRef:
                  name: stalwart-admin
                  key: password
          ports:
            - containerPort: 25
              name: smtp
            - containerPort: 993
              name: imaps
            - containerPort: 443
              name: https
          volumeMounts:
            - name: stalwart-data
              mountPath: /opt/stalwart/data
            - name: stalwart-config
              mountPath: /opt/stalwart/etc/config.toml
              subPath: config.toml
            - name: stalwart-tls
              mountPath: /opt/stalwart/tls
              readOnly: true
          readinessProbe:
            tcpSocket:
              port: 25
            initialDelaySeconds: 10
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
      volumes:
        - name: stalwart-data
          persistentVolumeClaim:
            claimName: stalwart-data
        - name: stalwart-config
          configMap:
            name: stalwart-config
        - name: stalwart-tls
          secret:
            secretName: stalwart-tls
---
apiVersion: v1
kind: Service
metadata:
  name: stalwart
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: stalwart
    app.kubernetes.io/part-of: foxhunt
spec:
  selector:
    app.kubernetes.io/name: stalwart
  ports:
    - port: 25
      targetPort: 25
      name: smtp
    - port: 993
      targetPort: 993
      name: imaps
    - port: 443
      targetPort: 443
      name: https
