rock
ab9c2b444b
Two defects in the first cut, both silent from the sender's side because the relay answers 250 either way: - GOTIFY_URL needs a trailing slash; without it the push has no path. - GOTIFY_TITLE_TEMPLATE referenced .Subject, which the relay does not expose, so template execution failed. The relay's default title already carries the subject, so drop the template. Also register the SOPS file in secret-generator.yaml: the sops-secrets app only renders files listed there, so the Secret was never created and the relay sat in CreateContainerConfigError.
100 lines
2.8 KiB
YAML
100 lines
2.8 KiB
YAML
# SMTP -> Gotify relay for ZITADEL notifications.
|
|
#
|
|
# ZITADEL sends verification codes, password resets and one-time passwords by
|
|
# SMTP only, and this cluster has no working mail path: no SMTP credentials are
|
|
# configured for ZITADEL, and the notification table shows
|
|
# verified_email empty for every user. Without a delivery path nobody can finish
|
|
# a first login, at ZITADEL or at any relying party such as Forgejo.
|
|
#
|
|
# This relay accepts plain SMTP on :2525 and forwards every message to Gotify,
|
|
# so codes arrive on the phone through the existing gotify/igotify setup instead
|
|
# of email. ZITADEL then points DefaultInstance.SMTPConfiguration at this
|
|
# Service (see k8s/infra/iam/zitadel-values.yaml).
|
|
#
|
|
# The Gotify token is a Secret, never a literal here.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: smtp-gotify
|
|
namespace: iam
|
|
labels:
|
|
app: smtp-gotify
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 2
|
|
selector:
|
|
matchLabels:
|
|
app: smtp-gotify
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: smtp-gotify
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
runAsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: smtp-gotify
|
|
image: quay.io/reiml/smtp-gotify:latest
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: GOTIFY_URL
|
|
value: "http://gotify.notifications.svc.cluster.local/"
|
|
- name: GOTIFY_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-gotify
|
|
key: token
|
|
- name: GOTIFY_PRIORITY
|
|
value: "5"
|
|
# No title template: the relay's default title already carries
|
|
# the mail subject, and a wrong template field fails the push
|
|
# silently (the SMTP side still answers 250, so the sender thinks
|
|
# the message was delivered).
|
|
ports:
|
|
- name: smtp
|
|
containerPort: 2525
|
|
protocol: TCP
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: smtp
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: smtp
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 20
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: smtp-gotify
|
|
namespace: iam
|
|
labels:
|
|
app: smtp-gotify
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: smtp-gotify
|
|
ports:
|
|
- name: smtp
|
|
port: 2525
|
|
targetPort: smtp
|
|
protocol: TCP
|