From 603930eff02e84df33770bb2c8d48542577900c4 Mon Sep 17 00:00:00 2001 From: Emilien Escalle Date: Tue, 27 Jan 2026 11:08:02 +0100 Subject: [PATCH 1/5] ci: fix helm test --- .github/workflows/__shared-ci.yml | 2 + .gitignore | 1 + .tool-versions | 14 ++-- postal/Chart.lock | 9 ++- postal/Chart.yaml | 6 +- postal/charts/.gitignore | 2 - postal/ci/00-hack-values.yaml | 4 + postal/ci/01-base-values.yaml | 18 +++++ postal/ci/02-smtp-tls-values.yaml | 43 +++++++++++ postal/ci/03-ingress-values.yaml | 52 +++++++++++++ postal/ci/base-values.yaml | 17 ----- postal/ci/ingress-values.yaml | 40 ---------- postal/ci/smtp-tls-values.yaml | 20 ----- postal/templates/secret.yaml | 12 ++- postal/values-ori.yaml | 122 ------------------------------ postal/values.yaml | 36 +++++---- 16 files changed, 169 insertions(+), 229 deletions(-) delete mode 100644 postal/charts/.gitignore create mode 100644 postal/ci/00-hack-values.yaml create mode 100644 postal/ci/01-base-values.yaml create mode 100644 postal/ci/02-smtp-tls-values.yaml create mode 100644 postal/ci/03-ingress-values.yaml delete mode 100644 postal/ci/base-values.yaml delete mode 100644 postal/ci/ingress-values.yaml delete mode 100644 postal/ci/smtp-tls-values.yaml delete mode 100644 postal/values-ori.yaml diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml index b58f138..3b38948 100644 --- a/.github/workflows/__shared-ci.yml +++ b/.github/workflows/__shared-ci.yml @@ -30,9 +30,11 @@ jobs: with: helm-repositories: | bitnami https://charts.bitnami.com/bitnami + jetstack https://charts.jetstack.io helm-set: | global.railsSecretKey=\$RAILS_SECRET_KEY global.signingKey=\$SIGNING_KEY + cert-manager.enabled=true env: RAILS_SECRET_KEY: ${{ secrets.RAILS_SECRET_KEY }} SIGNING_KEY: ${{ secrets.SIGNING_KEY }} diff --git a/.gitignore b/.gitignore index 6543537..aa48006 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,7 @@ # helm postal/values-local.yaml +postal/charts/** # TODO list .TODO diff --git a/.tool-versions b/.tool-versions index 70096a8..a45bff5 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1,7 +1,7 @@ -github-cli 2.58.0 -helm 3.14.3 -helm-ct 3.10.1 -helm-docs 1.14.2 -kubeconform 0.6.4 -kubectl 1.30.5 -cosign 2.0.2 +cosign 2.0.2 +github-cli 2.86.0 +helm 3.14.3 +helm-ct 3.10.1 +helm-docs 1.14.2 +kubeconform 0.6.4 +kubectl 1.30.5 diff --git a/postal/Chart.lock b/postal/Chart.lock index bfd68cf..ec27c59 100644 --- a/postal/Chart.lock +++ b/postal/Chart.lock @@ -1,6 +1,9 @@ dependencies: - name: mariadb repository: https://charts.bitnami.com/bitnami - version: 16.5.0 -digest: sha256:b8d5aaa73ffcafb8792593ee848b85ffc743f4ae221ace5e22e4b18dddd732c8 -generated: "2024-12-12T00:39:35.18628+01:00" + version: 24.1.1 +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.19.3 +digest: sha256:dedc4fe64102ad01f78f2e0d93cfaffbd7838d7003472cf2e5d67e78590bee9a +generated: "2026-02-16T18:22:17.714365+01:00" diff --git a/postal/Chart.yaml b/postal/Chart.yaml index a58755d..5f65f1a 100644 --- a/postal/Chart.yaml +++ b/postal/Chart.yaml @@ -35,5 +35,9 @@ maintainers: dependencies: - name: mariadb repository: https://charts.bitnami.com/bitnami - version: 16.*.* + version: 24.1.1 condition: mariadb.enabled + - name: cert-manager + repository: https://charts.jetstack.io + version: 1.19.3 + condition: cert-manager.enabled diff --git a/postal/charts/.gitignore b/postal/charts/.gitignore deleted file mode 100644 index 1287e9b..0000000 --- a/postal/charts/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -** -!.gitignore diff --git a/postal/ci/00-hack-values.yaml b/postal/ci/00-hack-values.yaml new file mode 100644 index 0000000..ec53935 --- /dev/null +++ b/postal/ci/00-hack-values.yaml @@ -0,0 +1,4 @@ +cert-manager: + enabled: true + crds: + enabled: true diff --git a/postal/ci/01-base-values.yaml b/postal/ci/01-base-values.yaml new file mode 100644 index 0000000..cd166a1 --- /dev/null +++ b/postal/ci/01-base-values.yaml @@ -0,0 +1,18 @@ +image: + registry: fake.registry + +jobs: + initialize: + enable: false + +web: + replicaCount: 0 + +smtp: + replicaCount: 0 + +worker: + replicaCount: 0 + +cert-manager: + enabled: true diff --git a/postal/ci/02-smtp-tls-values.yaml b/postal/ci/02-smtp-tls-values.yaml new file mode 100644 index 0000000..1d71c65 --- /dev/null +++ b/postal/ci/02-smtp-tls-values.yaml @@ -0,0 +1,43 @@ +# SECURITY NOTE: These are example values for CI/testing purposes only. +# In production, these values MUST be replaced with actual secrets. +# Consider using environment variables or secret management systems. +global: + railsSecretKey: LvH4wQpMsNbzuXcNIkvedxBLT9VSSXcjC5LbIcGOS0x06ooTLqtAnPradCvAjIHS7hO90KdUSjfY4xtMWPb6SRdSLH03JNest3xVNJx0ORzhtJYaJX9wjqfH6NTAHyEt + signingKey: | + -----BEGIN PRIVATE KEY----- + MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDSAOXj/qF/TzuP + Ut/ns25uK/jBnIZCwQUJyODksJCRCUU9CUgafZwyyTvox91Es36Xqg/xVfunR/d/ + AFiabpqBY2om1Kvi1CvRLiZCiuKAY9zPtTjPqOKnDEcR6fPqq/9cSZaUNOytqBjK + N82bGTlAWXcWauY6kmciyJASkSHNA5/nzoVlmCvcGAHxVQq/SyDSbGOcKBW26ayC + N04peX3hOnOkOm+R6pdg/gnSK3P8NsW3MxP+MugcZGnyUZXysGWRZgh7A7vtrVcp + omMZsdw7KjcJr4z/2gHtogIQU2O6O2nWQZfowVdcNfPsvzumL3XokTOtNSeWxj2u + N8vmToTnAgMBAAECggEAEeDwsYHupuOMew2/sT618pw8v+L/DTTYpHYdK2say7ZB + 1knxgQvbnflC5/UIEf7EEs5wMAg1dg7q872ITZGIBub7VRX7EkMk/diTekvPr8WQ + uYBAt3E15qnlbRGBaiO9iFJdhv2gfsJWZfTtRLyXgrJ7MIXmVus665uupF4FxinW + u/vQnxZOp0lNd1y/9wWP9qx5c47H2DVjxtbog5Wbo3GjjUWIEpsJWs/CBSoINhNc + THFKvimVgPOcqz8vhyrobnUJAFEBH4AcDIydrCVBEEpwTKRhs1ww+Asrj+w+Am+/ + 1TMQfXpnym3KIQx9uaFqHPNFfb6/+6s5/xib2dJZMQKBgQD6tv0+SvFY9znxWp2x + IOQKJzPKfVWhtiLL1mSHmL1jR/WOFzoe8u4oKiYdyATECXGf/5bd4aOIRKxaFnDC + TUYBtoDFqejHlRjAjz280zASd/YB1TTk9LwPtxCF3DDXtuM2qRooCqO1gn7kSwBq + IpLT4H2edj/EA2CvP6V9QY3VVwKBgQDWbjSnZHq+LIO7582cY04bOSkhTCSh+kA2 + wjp0C+ZriFlKoiwMQAz6D5YFGE2rhAeur00l01Emgtq+T0dcZ6k4o+JfUQZVS4Qp + AY1EoEGLG7XvjVJhB5Dpdjk5zso/6L5vpsroH4Cz3ejdE7YcdQmvEXzW5PS2lJpb + +DajDBIC8QKBgHoee8fF1T0SXuTS0JCghrLzWWS+G+HCx7wl1528pjMfr9ngMm00 + wxBJR3umG7wpJXFbm27EI1WSrajL2WyrGvhmnt6o3juowf+5RccdzwKP8AIAid0j + 4B5/esrY7+mCqbXMNHNgi1E0GP62EaOg54fQhx+SVYjyZDu4crFKJv3NAoGBALUD + u3dDn0pDEcHiYPQP8LOSgWIWgSYrt2GCfQ3RreZA5//U/xIoT8wYtDAA4DBV+JZC + bgHsbajw9e+JxVgAOh4SWtrT72C5qwtiv/qavjnMXr2ms1AtrusmXhCqvJlOxNRE + HS3uyhsMzbMzHJzRQCeFv7k49kvbDqNs2dKyMdJBAoGBAKyd19QDKgl14Qcfpyrt + NWufWVbukOFVJlh6XCxR9qyMZRAtw9cJbQshUfaOXxzh1H7soJ+Bq4ySW7MkzhCG + oDDsor1Y3hxiLCDctwdr8qX3F0je4ow7HftyFTlh5xtSbmYV/EnHpO40tuKBLqnA + ZPicQao+s/8DQwNr25oSL+kM + -----END PRIVATE KEY----- + +smtp: + tls: + enabled: true + hosts: + - smtp.example.local + +cert-manager: + enabled: true diff --git a/postal/ci/03-ingress-values.yaml b/postal/ci/03-ingress-values.yaml new file mode 100644 index 0000000..2b621ea --- /dev/null +++ b/postal/ci/03-ingress-values.yaml @@ -0,0 +1,52 @@ +# SECURITY NOTE: These are example values for CI/testing purposes only. +# In production, these values MUST be replaced with actual secrets. +# Consider using environment variables or secret management systems. +global: + railsSecretKey: LvH4wQpMsNbzuXcNIkvedxBLT9VSSXcjC5LbIcGOS0x06ooTLqtAnPradCvAjIHS7hO90KdUSjfY4xtMWPb6SRdSLH03JNest3xVNJx0ORzhtJYaJX9wjqfH6NTAHyEt + signingKey: | + -----BEGIN PRIVATE KEY----- + MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDSAOXj/qF/TzuP + Ut/ns25uK/jBnIZCwQUJyODksJCRCUU9CUgafZwyyTvox91Es36Xqg/xVfunR/d/ + AFiabpqBY2om1Kvi1CvRLiZCiuKAY9zPtTjPqOKnDEcR6fPqq/9cSZaUNOytqBjK + N82bGTlAWXcWauY6kmciyJASkSHNA5/nzoVlmCvcGAHxVQq/SyDSbGOcKBW26ayC + N04peX3hOnOkOm+R6pdg/gnSK3P8NsW3MxP+MugcZGnyUZXysGWRZgh7A7vtrVcp + omMZsdw7KjcJr4z/2gHtogIQU2O6O2nWQZfowVdcNfPsvzumL3XokTOtNSeWxj2u + N8vmToTnAgMBAAECggEAEeDwsYHupuOMew2/sT618pw8v+L/DTTYpHYdK2say7ZB + 1knxgQvbnflC5/UIEf7EEs5wMAg1dg7q872ITZGIBub7VRX7EkMk/diTekvPr8WQ + uYBAt3E15qnlbRGBaiO9iFJdhv2gfsJWZfTtRLyXgrJ7MIXmVus665uupF4FxinW + u/vQnxZOp0lNd1y/9wWP9qx5c47H2DVjxtbog5Wbo3GjjUWIEpsJWs/CBSoINhNc + THFKvimVgPOcqz8vhyrobnUJAFEBH4AcDIydrCVBEEpwTKRhs1ww+Asrj+w+Am+/ + 1TMQfXpnym3KIQx9uaFqHPNFfb6/+6s5/xib2dJZMQKBgQD6tv0+SvFY9znxWp2x + IOQKJzPKfVWhtiLL1mSHmL1jR/WOFzoe8u4oKiYdyATECXGf/5bd4aOIRKxaFnDC + TUYBtoDFqejHlRjAjz280zASd/YB1TTk9LwPtxCF3DDXtuM2qRooCqO1gn7kSwBq + IpLT4H2edj/EA2CvP6V9QY3VVwKBgQDWbjSnZHq+LIO7582cY04bOSkhTCSh+kA2 + wjp0C+ZriFlKoiwMQAz6D5YFGE2rhAeur00l01Emgtq+T0dcZ6k4o+JfUQZVS4Qp + AY1EoEGLG7XvjVJhB5Dpdjk5zso/6L5vpsroH4Cz3ejdE7YcdQmvEXzW5PS2lJpb + +DajDBIC8QKBgHoee8fF1T0SXuTS0JCghrLzWWS+G+HCx7wl1528pjMfr9ngMm00 + wxBJR3umG7wpJXFbm27EI1WSrajL2WyrGvhmnt6o3juowf+5RccdzwKP8AIAid0j + 4B5/esrY7+mCqbXMNHNgi1E0GP62EaOg54fQhx+SVYjyZDu4crFKJv3NAoGBALUD + u3dDn0pDEcHiYPQP8LOSgWIWgSYrt2GCfQ3RreZA5//U/xIoT8wYtDAA4DBV+JZC + bgHsbajw9e+JxVgAOh4SWtrT72C5qwtiv/qavjnMXr2ms1AtrusmXhCqvJlOxNRE + HS3uyhsMzbMzHJzRQCeFv7k49kvbDqNs2dKyMdJBAoGBAKyd19QDKgl14Qcfpyrt + NWufWVbukOFVJlh6XCxR9qyMZRAtw9cJbQshUfaOXxzh1H7soJ+Bq4ySW7MkzhCG + oDDsor1Y3hxiLCDctwdr8qX3F0je4ow7HftyFTlh5xtSbmYV/EnHpO40tuKBLqnA + ZPicQao+s/8DQwNr25oSL+kM + -----END PRIVATE KEY----- + +ingress: + enabled: true + className: "nginx" + annotations: + cert-manager.io/cluster-issuer: letsencrypt + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: + - secretName: chart-example-tls + hosts: + - chart-example.local + +cert-manager: + enabled: true diff --git a/postal/ci/base-values.yaml b/postal/ci/base-values.yaml deleted file mode 100644 index ca9da0a..0000000 --- a/postal/ci/base-values.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# SECURITY NOTE: These are example values for CI/testing purposes only. -# In production, these values MUST be replaced with actual secrets. -# Consider using environment variables or secret management systems. -global: - # Example Rails secret key - REPLACE WITH ACTUAL SECRET IN PRODUCTION - railsSecretKey: "" - # Example signing key - REPLACE WITH ACTUAL PRIVATE KEY IN PRODUCTION - signingKey: | - # EXAMPLE PRIVATE KEY - DO NOT USE IN PRODUCTION - # Generate a real private key using: openssl genrsa -out private.key 2048 - -----BEGIN RSA PRIVATE KEY (EXAMPLE)----- - REPLACE_WITH_ACTUAL_PRIVATE_KEY_IN_PRODUCTION - THIS_IS_JUST_AN_EXAMPLE_PLACEHOLDER - -----END RSA PRIVATE KEY (EXAMPLE)----- - -image: - registry: fake.registry diff --git a/postal/ci/ingress-values.yaml b/postal/ci/ingress-values.yaml deleted file mode 100644 index bb27da3..0000000 --- a/postal/ci/ingress-values.yaml +++ /dev/null @@ -1,40 +0,0 @@ -# SECURITY NOTE: These are example values for CI/testing purposes only. -# In production, these values MUST be replaced with actual secrets. -# Consider using environment variables or secret management systems. -global: - # Example Rails secret key - REPLACE WITH ACTUAL SECRET IN PRODUCTION - railsSecretKey: "" - # Example signing key - REPLACE WITH ACTUAL PRIVATE KEY IN PRODUCTION - signingKey: | - # EXAMPLE PRIVATE KEY - DO NOT USE IN PRODUCTION - # Generate a real private key using: openssl genrsa -out private.key 2048 - -----BEGIN RSA PRIVATE KEY (EXAMPLE)----- - REPLACE_WITH_ACTUAL_PRIVATE_KEY_IN_PRODUCTION - THIS_IS_JUST_AN_EXAMPLE_PLACEHOLDER - -----END RSA PRIVATE KEY (EXAMPLE)----- - 3ye9PkPdIqJWWNm3nOcBEirpGFxsmQgDj1gFYBhUCXpepBdfl4ssWPzzfRiUj2fZ - GRvXfBbJOwKBgQCp5A36HbJnU0BZ6erp5Ah23kIfY0DcE60W2rE92mQ5SZxwZTbU - 2BsgffQv6cVjwwpk9WsqarI4jxW1LoARJ/p21Vkib/ENQjjbQRGJnU5keE8GGVGB - bIDyNUQ9L4K1gkGt9STPM2StUHC/YH3SSy5MXvSEEyFcGih2ZEMnCU6SywKBgGUt - XTGryyjFF1vA0AoXRBzDMa3u4e6AsoKW9UuOismaHEAMsFm2G7BG6T36Y48tuCAd - VV2P1pQ7C0XFdzt8jw+++ZmaULH7QFEXwNKhCdY28jGWhsNhOYph6UdypOG2WcSq - c3GreD2f16rJRIBiX8aSXZJ7/piu3mtUcancoQkXAoGAceHeeqfkgzBIaQ/eyp1/ - 1Ri30uMr2VAEr8SRqPHk940cZVSoPjqdvDph4NpDb2h0Sch1A93K2QH5fKeoTwWb - MtOHJv8UieLT+5AtJp9/1VDI7bTnpj8y9GzYcKKPkiDMa6FOJdBj/qyHATIGyHA8 - wwoL2dTdesL4u1/nRHp19lU= - -----END PRIVATE KEY----- - -ingress: - enabled: true - className: "nginx" - annotations: - cert-manager.io/cluster-issuer: letsencrypt - hosts: - - host: chart-example.local - paths: - - path: / - pathType: ImplementationSpecific - tls: - - secretName: chart-example-tls - hosts: - - chart-example.local diff --git a/postal/ci/smtp-tls-values.yaml b/postal/ci/smtp-tls-values.yaml deleted file mode 100644 index b528af0..0000000 --- a/postal/ci/smtp-tls-values.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# SECURITY NOTE: These are example values for CI/testing purposes only. -# In production, these values MUST be replaced with actual secrets. -# Consider using environment variables or secret management systems. -global: - # Example Rails secret key - REPLACE WITH ACTUAL SECRET IN PRODUCTION - railsSecretKey: "" - # Example signing key - REPLACE WITH ACTUAL PRIVATE KEY IN PRODUCTION - signingKey: | - # EXAMPLE PRIVATE KEY - DO NOT USE IN PRODUCTION - # Generate a real private key using: openssl genrsa -out private.key 2048 - -----BEGIN RSA PRIVATE KEY (EXAMPLE)----- - REPLACE_WITH_ACTUAL_PRIVATE_KEY_IN_PRODUCTION - THIS_IS_JUST_AN_EXAMPLE_PLACEHOLDER - -----END RSA PRIVATE KEY (EXAMPLE)----- - -smtp: - tls: - enabled: true - hosts: - - smtp.example.local diff --git a/postal/templates/secret.yaml b/postal/templates/secret.yaml index 400face..4fce323 100644 --- a/postal/templates/secret.yaml +++ b/postal/templates/secret.yaml @@ -11,6 +11,14 @@ metadata: {{- end }} data: mariadb-password: {{ .Values.mariadb.auth.password | b64enc | quote }} - signing-key: {{ .Values.global.signingKey | required "You must provide a global.signingKey value" | b64enc | quote }} - rails-secret-key: {{ .Values.global.railsSecretKey | required "You must provide a global.railsSecretKey value" | b64enc | quote }} + {{- if .Values.global.signingKey }} + signing-key: {{ .Values.global.signingKey | b64enc | quote }} + {{- else }} + signing-key: {{ genPrivateKey "rsa" | b64enc | quote }} + {{- end }} + {{- if .Values.global.railsSecretKey }} + rails-secret-key: {{ .Values.global.railsSecretKey | b64enc | quote }} + {{- else }} + rails-secret-key: {{ randAlphaNum 128 | b64enc | quote }} + {{- end }} {{- end }} diff --git a/postal/values-ori.yaml b/postal/values-ori.yaml deleted file mode 100644 index 2c8dcbe..0000000 --- a/postal/values-ori.yaml +++ /dev/null @@ -1,122 +0,0 @@ -# Default values for postal. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -# TODO: this is a copy of the original values.yaml file -# generated by helm create postal with a recent version of helm -# there is good ideas inside so we should probably merge both files - -replicaCount: 1 - -image: - repository: ghcr.io/postalserver/postal - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - tag: "" - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -commonsAnnotations: - {} - # argocd.argoproj.io/sync-wave: "1" - # helm.sh/hook: "pre-install,pre-upgrade" - # helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded" - # helm.sh/hook-weight: "1" - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Automatically mount a ServiceAccount's API credentials? - automount: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - -podAnnotations: {} -podLabels: {} - -podSecurityContext: - {} - # fsGroup: 2000 - -securityContext: - {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - -service: - type: ClusterIP - port: 80 - -ingress: - enabled: false - className: "" - annotations: - {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: chart-example.local - paths: - - path: / - pathType: ImplementationSpecific - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -resources: - {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -livenessProbe: - httpGet: - path: / - port: http -readinessProbe: - httpGet: - path: / - port: http - -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 100 - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - -# Additional volumes on the output Deployment definition. -volumes: [] -# - name: foo -# secret: -# secretName: mysecret -# optional: false - -# Additional volumeMounts on the output Deployment definition. -volumeMounts: [] -# - name: foo -# mountPath: "/etc/foo" -# readOnly: true - -nodeSelector: {} - -tolerations: [] - -affinity: {} diff --git a/postal/values.yaml b/postal/values.yaml index 77419aa..a2d3c82 100644 --- a/postal/values.yaml +++ b/postal/values.yaml @@ -337,21 +337,6 @@ spamAssassin: # The port of the ClamAV server port: 783 -# dependencies -mariadb: - # check available values here: https://artifacthub.io/packages/helm/bitnami/mariadb?modal=values-schema - enabled: true - # TODO: we should switch to templating for the name to avoid using reference to fullname override everywhere - fullnameOverride: postal-mariadb - auth: - database: "postal" - username: "postal" - password: "postal" - initdbScripts: - # NOTE: postal is creating postal-server-* databases to handle postal mail servers configuration - grant_privileges.sql: | - GRANT ALL PRIVILEGES ON `postal%`.* TO 'postal'@'%' WITH GRANT OPTION; - jobs: # Bootstrap MariaDB initialize: @@ -416,3 +401,24 @@ jobs: tolerations: [] affinity: {} + +# dependencies +mariadb: + # check available values here: https://artifacthub.io/packages/helm/bitnami/mariadb?modal=values-schema + enabled: true + # TODO: we should switch to templating for the name to avoid using reference to fullname override everywhere + fullnameOverride: postal-mariadb + auth: + database: "postal" + username: "postal" + password: "postal" + initdbScripts: + # NOTE: postal is creating postal-server-* databases to handle postal mail servers configuration + grant_privileges.sql: | + GRANT ALL PRIVILEGES ON `postal%`.* TO 'postal'@'%' WITH GRANT OPTION; + +cert-manager: + enabled: false + fullnameOverride: cert-manager + crds: + enabled: false From 7bd8c250355896d93f8b51be76197b9756476b74 Mon Sep 17 00:00:00 2001 From: Frederic Leger Date: Mon, 16 Feb 2026 22:57:36 +0100 Subject: [PATCH 2/5] ci: handle smtp tls without cert-manager --- postal/ci/02-smtp-tls-values.yaml | 2 ++ postal/ci/03-ingress-values.yaml | 2 ++ postal/templates/smtp/tls-cert.yaml | 10 ++++++++++ postal/values.yaml | 4 ++-- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/postal/ci/02-smtp-tls-values.yaml b/postal/ci/02-smtp-tls-values.yaml index 1d71c65..8af4b84 100644 --- a/postal/ci/02-smtp-tls-values.yaml +++ b/postal/ci/02-smtp-tls-values.yaml @@ -2,7 +2,9 @@ # In production, these values MUST be replaced with actual secrets. # Consider using environment variables or secret management systems. global: + # checkov:skip=CKV_SECRET_6:sample value only railsSecretKey: LvH4wQpMsNbzuXcNIkvedxBLT9VSSXcjC5LbIcGOS0x06ooTLqtAnPradCvAjIHS7hO90KdUSjfY4xtMWPb6SRdSLH03JNest3xVNJx0ORzhtJYaJX9wjqfH6NTAHyEt + # checkov:skip=CKV_SECRET_13:sample value only signingKey: | -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDSAOXj/qF/TzuP diff --git a/postal/ci/03-ingress-values.yaml b/postal/ci/03-ingress-values.yaml index 2b621ea..ed6cd03 100644 --- a/postal/ci/03-ingress-values.yaml +++ b/postal/ci/03-ingress-values.yaml @@ -2,7 +2,9 @@ # In production, these values MUST be replaced with actual secrets. # Consider using environment variables or secret management systems. global: + # checkov:skip=CKV_SECRET_6:sample value only railsSecretKey: LvH4wQpMsNbzuXcNIkvedxBLT9VSSXcjC5LbIcGOS0x06ooTLqtAnPradCvAjIHS7hO90KdUSjfY4xtMWPb6SRdSLH03JNest3xVNJx0ORzhtJYaJX9wjqfH6NTAHyEt + # checkov:skip=CKV_SECRET_13:sample value only signingKey: | -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDSAOXj/qF/TzuP diff --git a/postal/templates/smtp/tls-cert.yaml b/postal/templates/smtp/tls-cert.yaml index ea35969..5c776a8 100644 --- a/postal/templates/smtp/tls-cert.yaml +++ b/postal/templates/smtp/tls-cert.yaml @@ -23,4 +23,14 @@ spec: name: {{ .Values.smtp.tls.certManager.issuer.name }} kind: {{ .Values.smtp.tls.certManager.issuer.kind }} group: {{ .Values.smtp.tls.certManager.issuer.group }} +{{- else if and .Values.smtp.tls.enabled (eq .Values.smtp.tls.source "self-signed") }} +{{- $ca := genCA "test-ca" 365 }} +{{- $cert := genSignedCert (index .Values.smtp.tls.hosts 0) nil nil 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "postal.smtp.fullname" . }}-tls +data: + tls.crt: {{ $cert.Cert | b64enc }} + tls.key: {{ $cert.Key | b64enc }} {{- end }} diff --git a/postal/values.yaml b/postal/values.yaml index a2d3c82..4d5b578 100644 --- a/postal/values.yaml +++ b/postal/values.yaml @@ -200,8 +200,8 @@ smtp: tls: # -- enable TLS support for smtp enabled: false - # -- specify the source of the TLS certificate (for now only cert-manager is supported) - source: cert-manager + # -- specify the source of the TLS certificate (cert-manager or self-signed are supported) + source: self-signed # -- specify annotations for the TLS object (cert-manager Certificate) annotations: {} # -- specify the hosts that must be covered by the TLS certificate From d6f6f88f6449ca00869fd6088863288c0fa796ea Mon Sep 17 00:00:00 2001 From: Frederic Leger Date: Thu, 19 Feb 2026 16:34:31 +0100 Subject: [PATCH 3/5] Update postal/templates/smtp/tls-cert.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- postal/templates/smtp/tls-cert.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/postal/templates/smtp/tls-cert.yaml b/postal/templates/smtp/tls-cert.yaml index 5c776a8..0dabda2 100644 --- a/postal/templates/smtp/tls-cert.yaml +++ b/postal/templates/smtp/tls-cert.yaml @@ -25,7 +25,11 @@ spec: group: {{ .Values.smtp.tls.certManager.issuer.group }} {{- else if and .Values.smtp.tls.enabled (eq .Values.smtp.tls.source "self-signed") }} {{- $ca := genCA "test-ca" 365 }} -{{- $cert := genSignedCert (index .Values.smtp.tls.hosts 0) nil nil 365 $ca }} +{{- $host := include "postal.smtp.fullname" . }} +{{- if and .Values.smtp.tls.hosts (gt (len .Values.smtp.tls.hosts) 0) }} +{{- $host = index .Values.smtp.tls.hosts 0 }} +{{- end }} +{{- $cert := genSignedCert $host nil nil 365 $ca }} apiVersion: v1 kind: Secret metadata: From b2837c9dc1a75e3949b177d03f23b8cb963daa47 Mon Sep 17 00:00:00 2001 From: Frederic Leger Date: Thu, 19 Feb 2026 16:34:55 +0100 Subject: [PATCH 4/5] Update postal/templates/smtp/tls-cert.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- postal/templates/smtp/tls-cert.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/postal/templates/smtp/tls-cert.yaml b/postal/templates/smtp/tls-cert.yaml index 0dabda2..2af92af 100644 --- a/postal/templates/smtp/tls-cert.yaml +++ b/postal/templates/smtp/tls-cert.yaml @@ -34,6 +34,8 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "postal.smtp.fullname" . }}-tls + labels: + {{- include "postal.labels" . | nindent 4 }} data: tls.crt: {{ $cert.Cert | b64enc }} tls.key: {{ $cert.Key | b64enc }} From 19726a644ab92a223c1327bd875cf29edee60568 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 19 Feb 2026 15:35:55 +0000 Subject: [PATCH 5/5] Initial plan