Add LDAP outpost, SOGo on K8s, Stalwart OIDC

apps/templates/authentik-helm.yaml

@@ -66,15 +66,32 @@ spec:
                   secretKeyRef:
                     name: vault-oidc-client-secret
                     key: client_secret
+              - name: STALWART_OIDC_CLIENT_SECRET
+                valueFrom:
+                  secretKeyRef:
+                    name: stalwart-oidc-client-secret
+                    key: client_secret
           server:
             volumes:
-              - name: custom-blueprints
+              - name: blueprint-vault
                 configMap:
                   name: authentik-blueprint-vault
+              - name: blueprint-mail
+                configMap:
+                  name: authentik-blueprint-mail
+              - name: blueprint-ldap
+                configMap:
+                  name: authentik-blueprint-ldap
             volumeMounts:
-              - name: custom-blueprints
+              - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
                 subPath: vault-oidc.yaml
+              - name: blueprint-mail
+                mountPath: /blueprints/custom/mail-oidc.yaml
+                subPath: mail-oidc.yaml
+              - name: blueprint-ldap
+                mountPath: /blueprints/custom/ldap.yaml
+                subPath: ldap.yaml
             ingress:
               enabled: true
               ingressClassName: nginx
@@ -88,13 +105,25 @@ spec:
                     - authentik.rubenhensen.nl
           worker:
             volumes:
-              - name: custom-blueprints
+              - name: blueprint-vault
                 configMap:
                   name: authentik-blueprint-vault
+              - name: blueprint-mail
+                configMap:
+                  name: authentik-blueprint-mail
+              - name: blueprint-ldap
+                configMap:
+                  name: authentik-blueprint-ldap
             volumeMounts:
-              - name: custom-blueprints
+              - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
                 subPath: vault-oidc.yaml
+              - name: blueprint-mail
+                mountPath: /blueprints/custom/mail-oidc.yaml
+                subPath: mail-oidc.yaml
+              - name: blueprint-ldap
+                mountPath: /blueprints/custom/ldap.yaml
+                subPath: ldap.yaml
           postgresql:
             enabled: false
           redis:

apps/templates/sogo-mail-helm.yaml

@@ -0,0 +1,56 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sogo-mail
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+    automated:
+      prune: true
+      selfHeal: true
+  project: default
+  sources:
+    - chart: sogo
+      repoURL: https://helm.snry.xyz/docker-sogo/
+      targetRevision: 0.3.5
+      helm:
+        values: |
+          sogo:
+            host: mail.rubenhensen.nl
+            existingSecrets:
+              - sogo-mail-secrets
+          ingress:
+            enabled: true
+            className: nginx
+            annotations:
+              kubernetes.io/tls-acme: "true"
+              cert-manager.io/cluster-issuer: prod-cluster-issuer
+              nginx.ingress.kubernetes.io/server-snippet: |-
+                proxy_http_version 1.1;
+                proxy_hide_header X-Powered-By;
+
+                location = / {
+                  rewrite ^(.*)$ /SOGo;
+                  allow all;
+                }
+
+            tls:
+              - secretName: sogo-mail-tls
+                hosts:
+                  - mail.rubenhensen.nl
+            path: /
+            pathType: Prefix
+          memcached:
+            enabled: true
+    - repoURL: https://github.com/rubenhensen/k8scd.git
+      targetRevision: HEAD
+      path: sogo-mail
+      directory:
+        include: "*.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sogo-mail

authentik/blueprint-ldap.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprint-ldap
+data:
+  ldap.yaml: |
+    version: 1
+    metadata:
+      name: LDAP Outpost
+    entries:
+      - model: authentik_providers_ldap.ldapprovider
+        id: ldap-provider
+        state: present
+        identifiers:
+          name: LDAP
+        attrs:
+          name: LDAP
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+          base_dn: "DC=ldap,DC=goauthentik,DC=io"
+          bind_mode: direct
+          search_mode: direct
+      - model: authentik_core.application
+        id: ldap-app
+        state: present
+        identifiers:
+          slug: ldap
+        attrs:
+          name: LDAP
+          provider: !KeyOf ldap-provider
+      - model: authentik_outposts.outpost
+        id: ldap-outpost
+        state: present
+        identifiers:
+          name: LDAP Outpost
+        attrs:
+          name: LDAP Outpost
+          type: ldap
+          providers:
+            - !KeyOf ldap-provider
+          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [local, true]]

authentik/blueprint-mail-oidc.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprint-mail
+data:
+  mail-oidc.yaml: |
+    version: 1
+    metadata:
+      name: Mail OIDC
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: stalwart-provider
+        state: present
+        identifiers:
+          name: Stalwart
+        attrs:
+          name: Stalwart
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          client_id: stalwart
+          client_secret: !Env [STALWART_OIDC_CLIENT_SECRET, ""]
+          redirect_uris:
+            - matching_mode: strict
+              url: https://stalwart.rubenhensen.nl/login/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: stalwart-app
+        state: present
+        identifiers:
+          slug: stalwart
+        attrs:
+          name: Stalwart Mail
+          provider: !KeyOf stalwart-provider
+          meta_launch_url: https://stalwart.rubenhensen.nl

authentik/external-secret.yaml

@@ -63,3 +63,21 @@ spec:
       remoteRef:
         key: kv/vault-oidc
         property: client_secret
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: stalwart-oidc-client-secret
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: stalwart-oidc-client-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client_secret
+      remoteRef:
+        key: kv/stalwart-oidc
+        property: client_secret

sogo-mail/external-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: sogo-mail-postgres-credentials
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: sogo-mail-postgres-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: kv/sogo-mail
+        property: postgres_user
+    - secretKey: password
+      remoteRef:
+        key: kv/sogo-mail
+        property: postgres_pw

sogo-mail/postgresql-cluster.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: sogo-mail-postgres
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  bootstrap:
+    initdb:
+      database: sogo
+      owner: sogo
+      secret:
+        name: sogo-mail-postgres-credentials
+  storage:
+    storageClass: longhorn
+    size: 20Gi

sogo-mail/sogo-config-secret.yaml

@@ -0,0 +1,46 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: sogo-mail-secrets
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: sogo-mail-secrets
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        SOGoProfileURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_user_profile"
+        OCSFolderInfoURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_folder_info"
+        OCSSessionsFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_sessions_folder"
+        OCSCacheFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_cache_folder"
+        OCSStoreURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_store"
+        OCSAclURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_acl"
+        SOGoUserSources__yaml: |
+          - type: ldap
+            id: authentik
+            CNFieldName: cn
+            IDFieldName: cn
+            UIDFieldName: cn
+            bindDN: "cn={{ .ldap_bind_user }},ou=users,DC=ldap,DC=goauthentik,DC=io"
+            bindPassword: "{{ .ldap_bind_password }}"
+            hostname: "ldap://ak-outpost-ldap-outpost.authentik.svc.cluster.local:3389"
+            baseDN: "ou=users,DC=ldap,DC=goauthentik,DC=io"
+            canAuthenticate: YES
+            isAddressBook: YES
+            bindAsCurrentUser: YES
+            LoginFieldNames: ("mail")
+            MailFieldNames: ("mail")
+            displayName: "Shared Addresses"
+            filter: "(objectClass=user)"
+        SOGoIMAPServer: "imaps://mail.rubenhensen.nl:993/?tls=YES&tlsVerifyMode=none"
+        SOGoSMTPServer: "smtp://mail.rubenhensen.nl:587/?tls=YES&tlsVerifyMode=none"
+        SOGoSMTPAuthenticationType: "PLAIN"
+        SOGoMailDomain: "rubenhensen.nl"
+        SOGoForceExternalLoginWithEmail: "YES"
+  dataFrom:
+    - extract:
+        key: kv/sogo-mail