Connect Stalwart to Authentik LDAP for user authentication

- Add LDAP directory backend in Stalwart pointing to ldap.rubenhensen.nl
- Expose Authentik LDAP outpost externally via LoadBalancer service
- Add ldap.rubenhensen.nl DNS record

authentik/ldap-outpost-lb.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ldap-outpost-external
+  namespace: authentik
+spec:
+  type: LoadBalancer
+  selector:
+    app.kubernetes.io/name: ak-outpost-ldap-outpost
+  ports:
+    - name: ldap
+      port: 389
+      targetPort: 3389
+      protocol: TCP
+    - name: ldaps
+      port: 636
+      targetPort: 6636
+      protocol: TCP

dns/domains/rubenhensen.nl.yaml

@@ -23,6 +23,10 @@ records:
     expire: 86400
     type: A
     content: "62.41.87.114"
+  - name: "ldap"
+    expire: 86400
+    type: A
+    content: "62.41.87.114"
   - name: "argocd"
     expire: 86400
     type: CNAME

nix-infra-machine/nodes/node001.nix

@@ -91,7 +91,7 @@
         fts = "rocksdb";
         blob = "rocksdb";
         lookup = "rocksdb";
-        directory = "internal";
+        directory = "authentik";
       };
 
       store.rocksdb = {
@@ -112,6 +112,28 @@
         enable = true;
       };
 
+      directory.authentik = {
+        type = "ldap";
+        url = "ldap://ldap.rubenhensen.nl:389";
+        timeout = "30s";
+        tls.enable = false;
+        base-dn = "DC=ldap,DC=goauthentik,DC=io";
+
+        bind.auth.method = "lookup";
+
+        filter = {
+          name = "(&(objectClass=user)(cn=?))";
+          email = "(&(objectClass=user)(|(mail=?)(mailAlias=?)))";
+        };
+
+        attributes = {
+          name = "cn";
+          class = "objectClass";
+          email = "mail";
+          groups = "memberOf";
+        };
+      };
+
       authentication.fallback-admin = {
         user = "admin";
         secret = "%{file:/run/credentials/stalwart-mail.service/stalwart-admin-password}%";