From 37933de75620ddf42988c722cfb4556fa7afe79f Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 26 Oct 2026 23:38:29 -0700
Subject: [PATCH] fix(iam): give the SMTP->Gotify relay a writable /tmp

The relay stages each message in /tmp before pushing. readOnlyRootFilesystem
left it with a read-only /tmp, so it answered '250 queued' and then dropped the
message: no Gotify push, no error line. Mount an emptyDir at /tmp.
---
 k8s/infra/iam/smtp-gotify.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/k8s/infra/iam/smtp-gotify.yaml b/k8s/infra/iam/smtp-gotify.yaml
index 6918f34..eeb174f 100644
--- a/k8s/infra/iam/smtp-gotify.yaml
+++ b/k8s/infra/iam/smtp-gotify.yaml
@@ -36,6 +36,9 @@ spec:
         runAsGroup: 65534
         seccompProfile:
           type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
       containers:
         - name: smtp-gotify
           image: quay.io/reiml/smtp-gotify:latest
@@ -58,6 +61,12 @@ spec:
             - name: smtp
               containerPort: 2525
               protocol: TCP
+          volumeMounts:
+            # The relay stages each message in /tmp before the Gotify push.
+            # With readOnlyRootFilesystem it accepted SMTP (250 queued) and
+            # then silently dropped the message: no push, no error.
+            - name: tmp
+              mountPath: /tmp
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true