feat: add another smtp relay for noreply email

kubernetes/main/apps/services/postiz/app/externalsecret.yaml

@@ -28,6 +28,8 @@ spec:
         EMAIL_HOST: "smtp-relay.services.svc.cluster.local" # smtp host if you choose nodemailer
         EMAIL_PORT: "25" # smtp port if you choose nodemailer
         EMAIL_SECURE: "false" # smtp secure if you choose nodemailer
+        EMAIL_FROM_NAME: "Postiz Emailer"
+        EMAIL_FROM_ADDRESS: "[email protected]"
   dataFrom:
     - extract:
         key: /cloudnativepg

kubernetes/main/apps/services/smtp-relay/ks.yaml

@@ -23,3 +23,28 @@ spec:
       HOSTNAME: smpt-relay.rafaribe.com
       APP_UID: "1000"
       APP_GID: "1000"
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app smtp-relay-noreply
+  namespace: flux-system
+spec:
+  path: "./kubernetes/main/apps/services/smtp-relay/noreply"
+  targetNamespace: services
+  sourceRef:
+    kind: GitRepository
+    name: home-ops
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  prune: true
+  wait: false
+  interval: 10m
+  postBuild:
+    substitute:
+      APP: *app
+      HOSTNAME: smpt-relay-noreply.rafaribe.com
+      APP_UID: "1000"
+      APP_GID: "1000"

kubernetes/main/apps/services/smtp-relay/noreply/externalsecret.yaml

@@ -0,0 +1,22 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name smtp-relay-noreply
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: akeyless-secret-store
+  target:
+    name: *name
+    template:
+      engineVersion: v2
+      data:
+        SMTP_RELAY_HOSTNAME: "{{ .SMTP_RELAY_HOSTNAME }}"
+        SMTP_RELAY_SERVER: "{{ .SMTP_RELAY_SERVER }}"
+        SMTP_RELAY_USERNAME: noreply@"{{ .SMTP_RELAY_HOSTNAME }}"
+        SMTP_RELAY_PASSWORD: "{{ .SMTP_RELAY_PASSWORD }}"
+  dataFrom:
+    - extract:
+        key: /smtp-relay

kubernetes/main/apps/services/smtp-relay/noreply/helmrelease.yaml

@@ -0,0 +1,103 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app smtp-relay-noreply
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.6.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      smtp-relay-noreply:
+        strategy: RollingUpdate
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/foxcpp/maddy
+              tag: 0.7.1@sha256:6ab538e2f28baf2324f7cb418c7f9476fd9c7e9fa9b14bc3aecf51a9f6962064
+            env:
+              SMTP_RELAY_SMTP_PORT: &port 25
+              SMTP_RELAY_METRICS_PORT: &metricsPort 8080
+              SMTP_RELAY_SERVER_PORT: 465
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+              limits:
+                memory: 128Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile: { type: RuntimeDefault }
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: *app
+    service:
+      app:
+        controller: smtp-relay-noreply
+        type: LoadBalancer
+        annotations:
+          external-dns.alpha.kubernetes.io/hostname: smtp-relay-noreply.rafaribe.com
+          io.cilium/lb-ipam-ips: ${LB_SMTP_RELAY_NOREPLY}
+        ports:
+          http:
+            primary: true
+            port: *metricsPort
+          smtp:
+            port: *port
+    serviceMonitor:
+      app:
+        serviceName: smtp-relay-noreply
+        endpoints:
+          - port: http
+            scheme: http
+            path: /metrics
+            interval: 1m
+            scrapeTimeout: 10s
+    persistence:
+      config:
+        type: configMap
+        name: smtp-relay-noreply-configmap
+        globalMounts:
+          - path: /data/maddy.conf
+            subPath: maddy.conf
+            readOnly: true
+      cache:
+        type: emptyDir
+        globalMounts:
+          - path: /cache

kubernetes/main/apps/services/smtp-relay/noreply/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: smtp-relay-noreply-configmap
+    files:
+      - maddy.conf=./resources/maddy.conf
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/main/apps/services/smtp-relay/noreply/resources/maddy.conf

@@ -0,0 +1,24 @@
+state_dir /cache/state
+runtime_dir /cache/run
+
+openmetrics tcp://0.0.0.0:{env:SMTP_RELAY_METRICS_PORT} { }
+
+tls off
+hostname {env:SMTP_RELAY_HOSTNAME}
+
+smtp tcp://0.0.0.0:{env:SMTP_RELAY_SMTP_PORT} {
+    default_source {
+        deliver_to &remote_queue
+    }
+}
+
+target.queue remote_queue {
+    target &remote_smtp
+}
+
+target.smtp remote_smtp {
+    attempt_starttls yes
+    require_tls yes
+    auth plain {env:SMTP_RELAY_USERNAME} {env:SMTP_RELAY_PASSWORD}
+    targets tls://{env:SMTP_RELAY_SERVER}:{env:SMTP_RELAY_SERVER_PORT}
+}