Connect Stalwart to Authentik LDAP for user authentication

- Add LDAP directory backend in Stalwart pointing to ldap.rubenhensen.nl
- Expose Authentik LDAP outpost externally via LoadBalancer service
- Add ldap.rubenhensen.nl DNS record

nix-infra-machine/nodes/node001.nix

@@ -91,7 +91,7 @@
         fts = "rocksdb";
         blob = "rocksdb";
         lookup = "rocksdb";
-        directory = "internal";
+        directory = "authentik";
       };
 
       store.rocksdb = {
@@ -112,6 +112,28 @@
         enable = true;
       };
 
+      directory.authentik = {
+        type = "ldap";
+        url = "ldap://ldap.rubenhensen.nl:389";
+        timeout = "30s";
+        tls.enable = false;
+        base-dn = "DC=ldap,DC=goauthentik,DC=io";
+
+        bind.auth.method = "lookup";
+
+        filter = {
+          name = "(&(objectClass=user)(cn=?))";
+          email = "(&(objectClass=user)(|(mail=?)(mailAlias=?)))";
+        };
+
+        attributes = {
+          name = "cn";
+          class = "objectClass";
+          email = "mail";
+          groups = "memberOf";
+        };
+      };
+
       authentication.fallback-admin = {
         user = "admin";
         secret = "%{file:/run/credentials/stalwart-mail.service/stalwart-admin-password}%";