Add LDAP outpost, SOGo on K8s, Stalwart OIDC

sogo-mail/external-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: sogo-mail-postgres-credentials
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: sogo-mail-postgres-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: kv/sogo-mail
+        property: postgres_user
+    - secretKey: password
+      remoteRef:
+        key: kv/sogo-mail
+        property: postgres_pw

sogo-mail/postgresql-cluster.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: sogo-mail-postgres
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  bootstrap:
+    initdb:
+      database: sogo
+      owner: sogo
+      secret:
+        name: sogo-mail-postgres-credentials
+  storage:
+    storageClass: longhorn
+    size: 20Gi

sogo-mail/sogo-config-secret.yaml

@@ -0,0 +1,46 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: sogo-mail-secrets
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: sogo-mail-secrets
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        SOGoProfileURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_user_profile"
+        OCSFolderInfoURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_folder_info"
+        OCSSessionsFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_sessions_folder"
+        OCSCacheFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_cache_folder"
+        OCSStoreURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_store"
+        OCSAclURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_acl"
+        SOGoUserSources__yaml: |
+          - type: ldap
+            id: authentik
+            CNFieldName: cn
+            IDFieldName: cn
+            UIDFieldName: cn
+            bindDN: "cn={{ .ldap_bind_user }},ou=users,DC=ldap,DC=goauthentik,DC=io"
+            bindPassword: "{{ .ldap_bind_password }}"
+            hostname: "ldap://ak-outpost-ldap-outpost.authentik.svc.cluster.local:3389"
+            baseDN: "ou=users,DC=ldap,DC=goauthentik,DC=io"
+            canAuthenticate: YES
+            isAddressBook: YES
+            bindAsCurrentUser: YES
+            LoginFieldNames: ("mail")
+            MailFieldNames: ("mail")
+            displayName: "Shared Addresses"
+            filter: "(objectClass=user)"
+        SOGoIMAPServer: "imaps://mail.rubenhensen.nl:993/?tls=YES&tlsVerifyMode=none"
+        SOGoSMTPServer: "smtp://mail.rubenhensen.nl:587/?tls=YES&tlsVerifyMode=none"
+        SOGoSMTPAuthenticationType: "PLAIN"
+        SOGoMailDomain: "rubenhensen.nl"
+        SOGoForceExternalLoginWithEmail: "YES"
+  dataFrom:
+    - extract:
+        key: kv/sogo-mail