Adding wildduck for testing

2023-08-09 21:28:31 +02:00
parent b65ae759c1
commit f32fb8d9a8
10 changed files with 1570 additions and 0 deletions
--- a/share/wildduck/wildduck.tf
+++ b/share/wildduck/wildduck.tf
@@ -0,0 +1,402 @@
+locals {
+  wildduck-labels = merge(local.common-labels, {
+    "app.kubernetes.io/component" = "wildduck"
+  })
+}
+
+resource "kubectl_manifest" "wildduck_deploy" {
+  yaml_body  = <<-EOF
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: "${var.instance}-wildduck"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.wildduck-labels)}
+    spec:
+      replicas: 1
+      selector:
+        matchLabels: ${jsonencode(local.wildduck-labels)}
+      template:
+        metadata:
+          labels: ${jsonencode(local.wildduck-labels)}
+        spec:
+          securityContext:
+            fsGroup: 1000
+          containers:
+          - name: wildduck
+            securityContext:
+              capabilities:
+                drop:
+                - ALL
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true
+              runAsUser: 1000
+            image: "${var.images.wildduck.registry}/${var.images.wildduck.repository}:${var.images.wildduck.tag}"
+            imagePullPolicy: "${var.images.wildduck.pullPolicy}"
+            ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+            - name: imap
+              containerPort: 1430
+              protocol: TCP
+            - name: pop3
+              containerPort: 1100
+              protocol: TCP
+            livenessProbe:
+              httpGet:
+                path: /users
+                port: http
+                scheme: HTTP
+                httpHeaders:
+                - name: X-Access-Token
+                  value:  wildduck1234
+            readinessProbe:
+              httpGet:
+                path: /users
+                port: http
+                scheme: HTTP
+                httpHeaders:
+                - name: X-Access-Token
+                  value:  wildduck1234
+            resources:
+              {}
+            volumeMounts:
+            - name: wildduck-config-volume
+              mountPath: /wildduck/config
+        volumes:
+        - name: config
+          configMap:
+            name: "${var.instance}-wildduck"
+  EOF
+}
+
+resource "kubectl_manifest" "wildduck_config" {
+  yaml_body  = <<-EOF
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: "${var.instance}-wildduck"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.wildduck-labels)}
+    data:
+      default.toml: |-
+        # Uncomment if you start the app as root and want to downgrade
+        # once all privileged actions are completed
+        # If you do not use privileged ports then you can start the app already under required user account
+        #user="wildduck"
+        #group="wildduck"
+        # process title
+        ident="wildduck"
+        # how many processes to start
+        processes=1
+        # default quota storage in MB (can be overriden per user)
+        maxStorage=1024
+        # default smtp recipients for 24h (can be overriden per user)
+        maxRecipients=2000
+        # default forwarded messages for 24h (can be overriden per user)
+        maxForwards=2000
+        # If usernames are not email addresses then use this domain as hostname part
+        #emailDomain="mydomain.info"
+        [dbs]
+        # @include "dbs.toml"
+        [totp]
+            # If enabled then encrypt TOTP seed tokens with the secret password. By default TOTP seeds
+            # are not encrypted and stored as cleartext. Once set up do not change these values,
+            # otherwise decrypting totp seeds is going to fail
+            cipher="aes192"
+            secret="${local.secrets.totp}"
+        [u2f]
+            # Fully qualified URL of your website (must use HTTPS!)
+            appId="https://localhost:3000"
+        [attachments]
+        # @include "attachments.toml"
+        [log]
+            level="debug"
+            skipFetchLog=false # if true, then does not output individual * FETCH responses to log
+            # delete authentication log entries after 30 days
+            # changing this value only affects new entries
+            # set to false to not log authentication events
+            # set to 0 to keep the logs infinitely
+            authlogExpireDays=30
+            [log.gelf]
+                enabled=false
+                hostname=false # defaults to os.hostname()
+                component="wildduck"
+                [log.gelf.options]
+                    graylogPort=12201
+                    graylogHostname="127.0.0.1"
+                    connection="lan"
+        [imap]
+        # @include "imap.toml"
+        [tls]
+        # @include "tls.toml"
+        [lmtp]
+        # @include "lmtp.toml"
+        [pop3]
+        # @include "pop3.toml"
+        [api]
+        # @include "api.toml"
+        [sender]
+        # @include "sender.toml"
+        [dkim]
+        # @include "dkim.toml"
+        [acme]
+        # @include "acme.toml"
+        [plugins]
+        # @include "plugins/*.toml"
+        [tasks]
+        # if enabled then process jobs like deleting expired messages etc
+        enabled=true
+        [smtp.setup]
+        # Public configuration for SMTP MDA, needed for mobileconfig files
+        hostname="${var.sub-domain}.${var.domain-name}"
+        secure=true
+        port=465
+        [webhooks]
+        # At least one server must have webhook processing enabled,
+        # otherwise events would pile up in the Redis queue.
+        enabled = true
+      api.toml: |-
+        enabled=true
+        port=8000
+        # by default bind to localhost only
+        host="0.0.0.0"
+        # Use `true` (HTTPS) for port 443 and `false` (HTTP) for 80
+        secure=false
+        # If set requires all API calls to have accessToken query argument with that value
+        # http://localhost:8080/users?accessToken=somesecretvalue
+        accessToken="wildduck1234"
+        [accessControl]
+        # If true then require a valid access token to perform API calls
+        # If a client provides a token then it is validated even if using a token is not required
+        enabled=false
+        # Secret for HMAC
+        # Changing this value invalidates all tokens
+        secret="a secret cat"
+        # Generated access token TTL in seconds. Token TTL gets extended by this value every time the token is used. Defaults to 14 days
+        #tokenTTL=1209600
+        # Generated access token max lifetime in seconds. Defaults to 180 days
+        #tokenLifetime=15552000
+        [roles]
+        # @include "roles.json"
+        [tls]
+        # If certificate path is not defined, use global or built-in self-signed certs
+        #key="/path/to/server/key.pem"
+        #cert="/path/to/server/cert.pem"
+        [mobileconfig]
+        # plist configuration for OSX/iOS profile files that are generated with Application Specific Passwords
+        # Use {email} in the description strings to replace it with account email address
+        # A reverse-DNS style identifier (com.example.myprofile, for example) that identifies the profile.
+        # This string is used to determine whether a new profile should replace an existing one or should be added. Username is prepended to this value.
+        identifier="com.email.wildduck"
+        # A human-readable name for the profile. This value is displayed on the Detail screen. It does not have to be unique.
+        displayName="WildDuck Mail"
+        # A human-readable string containing the name of the organization that provided the profile.
+        organization="WildDuck Mail Services"
+        # A description of the profile, shown on the Detail screen for the profile. This should be descriptive enough to help the user decide whether to install the profile.
+        displayDescription="Install this profile to setup {email}"
+        # A user-visible description of the email account, shown in the Mail and Settings applications.
+        accountDescription="WildDuck ({email})"
+        [mobileconfig.tls]
+        # If certificate path is not defined, use global or built-in self-signed certs
+        #key="/path/to/server/key.pem"
+        #cert="/path/to/server/cert.pem"
+        [cors]
+        origins = ["*"]
+      dbs.toml: |-
+        # mongodb connection string for the main database
+        mongo="mongodb://${var.component}:${local.mongo-password}@${var.instance}-${var.component}-mongo-svc.${var.namespace}.svc:27017/wildduck"
+        # redis connection string to connect to a single master (see below for Sentinel example)
+        redis="redis://${var.instance}-${var.component}-redis.${var.namespace}.svc:6379/3"
+        # WildDuck allows using different kind of data in different databases
+        # If you do not provide a database config value, then main database connection
+        # is used for everything
+        # You can either use a database name (uses shared connection) or a configutaion
+        # url (creates a separate connection) for each databases
+
+        # Optional database name or connection url for GridFS if you do not want to
+        # use the main db for storing attachments. Useful if you want
+        # to use a different mount folder or storage engine
+        #gridfs="wildduck"
+
+        # Optional database name or connection url for users collection if you do not want to
+        # use the main db for storing user/address data. Useful if you want
+        # to use a different mount folder or storage engine
+        #users="wildduck"
+
+        # Optional database name or connection url for ZoneMTA queue database. This is
+        # used to push outbound emails to the sending queue
+        sender="zone-mta"
+
+        #queued="mail"
+      dkim.toml: |-
+        # If enabled then encrypt DKIM keys with the secret password. By default DKIM keys
+        # are not encrypted and stored as cleartext. Once set up do not change these values,
+        # otherwise decrypting DKIM keys is going to fail
+        cipher="aes192"
+        secret="${local.secrets.dkim}"
+        # If true then spwans openssl command line executable for generating DKIM keys
+        # Otherwise forge library is used which is cross-environment but slower
+        useOpenSSL=true
+        # Define path to openssl if not in default path
+        #pathOpenSSL="/usr/local/bin/openssl"
+        # If true then also adds a signature for the outbound domain
+        # Affects WildDuck ZoneMTA plugin only
+        signTransportDomain=false
+        # do not change this
+        hashAlgo="sha256"
+      imap.toml: |-
+        # If enabled then WildDuck exposes an IMAP interface for listing and fetching emails
+        enabled=true
+        port=1430
+        host="0.0.0.0"
+        # Use `true` for port 993 and `false` for 143. If connection is not secured
+        # on connection then WildDuck enables STARTTLS extension
+        secure=false
+        # Max size for messages uploaded via APPEND
+        maxMB=25
+        # delete messages from \Trash and \Junk after retention days
+        retention=30
+        # Default max donwload bandwith per day in megabytes
+        maxDownloadMB=10000
+        # Default max upload bandwith per day in  megabytes
+        maxUploadMB=10000
+        # Default max concurrent connections per service per client
+        maxConnections=15
+        # if `true` then do not autodelete expired messages
+        disableRetention=false
+        # If true, then disables STARTTLS support
+        disableSTARTTLS=true
+        # If true, then advertises COMPRESS=DEFLATE capability
+        enableCompression=false
+        # If true, then expect HAProxy PROXY header as the first line of data
+        useProxy=false
+        # useProxy=true # expect PROXY from all conections
+        # useProxy=['*'] # expect PROXY from all conections
+        # useProxy=['1.2.3.4', '1.2.3.5'] # expect PROXY only from connections from listed IP addresses
+        # an array of IP addresses to ignore (not logged)
+        ignoredHosts=[]
+        #name="WildDuck IMAP"
+        #version="1.0.0"
+        #vendor="WildDuck"
+        # Add extra IMAP interfaces
+        #[[interface]]
+        #enabled=true
+        #port=9143
+        #host="0.0.0.0"
+        #secure=false
+        #ignoreSTARTTLS=true
+        # If true then EXPUNGE is called after a message gets a \Deleted flag set
+        autoExpunge=true
+        [setup]
+        # Public configuration for IMAP
+        hostname="${var.sub-domain}.${var.domain-name}"
+        secure=true
+        # port defaults to imap.port
+        port=9930
+        [tls]
+        ## If certificate path is not defined, use global or built-in self-signed certs
+        #key="/path/to/server/key.pem"
+        #cert="/path/to/server/cert.pem"
+        ## You can also define extra options for specific TLS settings:
+        #ciphers="ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS"
+        #secureProtocol="SSLv23_server_method"
+        ## constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_TLSv1 => 100663296
+        #secureOptions=100663296
+        #[[interface]]
+        #enabled=true
+        #port=9143
+        #host="0.0.0.0"
+        #secure=false
+        #ignoreSTARTTLS=false
+      pop3.toml: |-
+        # If enabled then WildDuck exposes a limited POP3 interface for listing and fetching emails
+        enabled=true
+        port=1100
+        # by default bind to localhost only
+        host="0.0.0.0"
+        # If true, then disables STARTTLS support
+        disableSTARTTLS=true
+        # Use `true` for port 995 and `false` for 110
+        secure=false
+        # If true, then do not show server info in CAPA response
+        disableVersionString=false
+        # How many latest messages to list for LIST and UIDL
+        # POP3 server never lists all messages but only a limited length list
+        maxMessages=250
+        # Max donwload bandwith per day in megabytes
+        maxDownloadMB=10000
+        # If true, then expect HAProxy PROXY header as the first line of data
+        useProxy=false
+        # an array of IP addresses to ignore (not logged)
+        ignoredHosts=[]
+        #name="WildDuck POP3"
+        #version="1.0.0"
+        [tls]
+        # If certificate path is not defined, use global or built-in self-signed certs
+        #key="/path/to/server/key.pem"
+        #cert="/path/to/server/cert.pem"
+        [setup]
+        # Public configuration for POP3
+        hostname="${var.sub-domain}.${var.domain-name}"
+        secure=true
+        # port defaults to pop3.port
+        port=995
+      sender.toml: |-
+        # which ZoneMTA queue to use by default
+        zone="default"
+        # Collection name for GridFS storage
+        gfs="mail"
+        # Collection name for the queue
+        # see [dbs].sender option for choosing correct database to use for ZoneMTA queues
+        # by default the main wildduck database is used
+        collection="zone-queue"
+        # Hashing secret for loop detection
+        # Must be shared with haraka-plugin-wildduck
+        # If not set then looping is not tracked
+        loopSecret="${local.secrets.srs}"
+  EOF
+}
+
+resource "kubectl_manifest" "wildduck_service_api" {
+  yaml_body  = <<-EOF
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: "${var.instance}-wildduck-api"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.wildduck-labels)}
+    spec:
+      type: ClusterIP
+      ports:
+      - port: 80
+        targetPort: http
+        protocol: TCP
+        name: http
+      selector: ${jsonencode(local.wildduck-labels)}
+  EOF
+}
+
+resource "kubectl_manifest" "wildduck_service" {
+  yaml_body  = <<-EOF
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: "${var.instance}-wildduck-mail"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.wildduck-labels)}
+    spec:
+      type: LoadBalancer
+      ports:
+      - port: 143
+        targetPort: imap
+        protocol: TCP
+        name: imap
+      - port: 110
+        targetPort: pop3
+        protocol: TCP
+        name: pop3
+      selector: ${jsonencode(local.wildduck-labels)}
+  EOF
+}