tegwick
a80f858643
Port 25 outbound is blocked on railiance01, so replies need an authenticated submission relay. Enabled only when Secret mas-relay is mounted; otherwise non-local mail is refused at RCPT time instead of queueing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 252470@bnt-lap001 Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241
113 lines
3.5 KiB
YAML
113 lines
3.5 KiB
YAML
# MAS live provider test (mail-address-semantics MAS-WP-0003).
|
|
# Founder go for A-D: 2026-10-08. Temporary: delete the namespace after the test.
|
|
# A namespace + MX pod B LoadBalancer :25 C statute-only ingress D no outbound mail
|
|
# D superseded 2026-10-18: operator chose replies via Scaleway TEM (Secret mas-relay).
|
|
# IMAGE is replaced with the pushed digest at apply time.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: mas
|
|
labels: {app.kubernetes.io/part-of: mail-address-semantics}
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata: {name: mas-evidence, namespace: mas}
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
storageClassName: local-path
|
|
resources: {requests: {storage: 1Gi}}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mas-mx
|
|
namespace: mas
|
|
labels: {app.kubernetes.io/name: mas-mx}
|
|
spec:
|
|
replicas: 1
|
|
strategy: {type: Recreate}
|
|
selector: {matchLabels: {app.kubernetes.io/name: mas-mx}}
|
|
template:
|
|
metadata: {labels: {app.kubernetes.io/name: mas-mx}}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: mx
|
|
image: IMAGE
|
|
args: [mx]
|
|
# Outbound replies via Scaleway TEM, enabled only when Secret mas-relay
|
|
# (keys username, password) exists. Port 25 out is blocked on the node.
|
|
env: [{name: MAS_RELAY, value: "[smtp.tem.scaleway.com]:587"}]
|
|
ports: [{name: smtp, containerPort: 25}]
|
|
volumeMounts:
|
|
- {name: evidence, mountPath: /var/lib/mas}
|
|
- {name: relay, mountPath: /etc/mas-relay, readOnly: true}
|
|
readinessProbe: {tcpSocket: {port: 25}, periodSeconds: 10}
|
|
resources:
|
|
requests: {cpu: 20m, memory: 64Mi}
|
|
limits: {memory: 256Mi}
|
|
volumes:
|
|
- name: evidence
|
|
persistentVolumeClaim: {claimName: mas-evidence}
|
|
- name: relay
|
|
secret: {secretName: mas-relay, optional: true}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: {name: mas-smtp, namespace: mas}
|
|
spec:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local # keep real client IPs in the Postfix log
|
|
selector: {app.kubernetes.io/name: mas-mx}
|
|
ports: [{name: smtp, port: 25, targetPort: 25, protocol: TCP}]
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mas-statute
|
|
namespace: mas
|
|
labels: {app.kubernetes.io/name: mas-statute}
|
|
spec:
|
|
replicas: 1
|
|
selector: {matchLabels: {app.kubernetes.io/name: mas-statute}}
|
|
template:
|
|
metadata: {labels: {app.kubernetes.io/name: mas-statute}}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext: {runAsNonRoot: true, runAsUser: 65534}
|
|
containers:
|
|
- name: statute
|
|
image: IMAGE
|
|
args: [statute]
|
|
ports: [{name: http, containerPort: 8080}]
|
|
readinessProbe: {httpGet: {path: /.well-known/mas, port: 8080}}
|
|
resources:
|
|
requests: {cpu: 5m, memory: 32Mi}
|
|
limits: {memory: 64Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: {name: mas-statute, namespace: mas}
|
|
spec:
|
|
selector: {app.kubernetes.io/name: mas-statute}
|
|
ports: [{name: http, port: 80, targetPort: 8080}]
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: mas-statute
|
|
namespace: mas
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: mas.coulomb.social
|
|
http:
|
|
paths:
|
|
- path: /.well-known/mas
|
|
pathType: Exact
|
|
backend: {service: {name: mas-statute, port: {number: 80}}}
|
|
tls:
|
|
- hosts: [mas.coulomb.social]
|
|
secretName: mas-coulomb-social-tls
|