statefulset-litestream.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: &name stalwart
  labels: {}
spec:
  replicas: 1
  serviceName: *name
  selector:
    matchLabels: {}
  template:
    metadata:
      labels: {}
    spec:
      initContainers:
        - name: litestream-init
          image: litestream/litestream:latest
          command:
            - /bin/sh
            - -c
            - |
              set -ex
              ## Install required tools
              apk add yq
              ## Try to restore databases
              DATABASES=$(yq '.dbs[].path' /etc/litestream.yml)
              for db in $DATABASES; do
                litestream restore -if-db-not-exists -if-replica-exists $db
              done
          volumeMounts: &litestreamVolumeMounts
            - name: mail-data
              mountPath: /opt/stalwart-mail/data
            - name: litestream
              mountPath: /etc/litestream.yml
              subPath: litestream.yml
          envFrom: &litestreamEnvFrom
            - prefix: LITESTREAM_
              secretRef:
                ## kubectl -n stalwart create secret generic litestream-s3 --from-literal=ACCESS_KEY_ID=value --from-literal=SECRET_ACCESS_KEY=value
                name: litestream-s3
          resources: &litestreamResources
            limits:
              cpu: "500m"
              memory: "256Mi"
        - name: mail-server-init
          image: alpine:3.19
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -c
            - |
              set -ex
              ## Install required tools
              apk add jq
              ## Deploy spamfilter config
              [[ "$STALWART_TAG" == "latest" ]] && STALWART_TAG=
              STALWART_TAG=${STALWART_TAG:-$(wget https://api.github.com/repos/stalwartlabs/mail-server/releases/latest -O - | jq -r '.tag_name')}
              wget https://github.com/stalwartlabs/mail-server/raw/$STALWART_TAG/resources/config.zip
              unzip -o config.zip spamfilter/* -d /opt/stalwart-mail/etc/
              ## Create directories
              for d in bin data/blobs logs queue reports; do
                mkdir -p /opt/stalwart-mail/$d
              done
              ## Copy bootstrap data
              { set +x; } 2>/dev/null
              echo "Bootstrap data:"
              for f in $(find /tmp/bootstrap -name '*.sqlite3.gz' -type f); do
                f=${f##*/}
                DST=/opt/stalwart-mail/data/${f%.*}
                if [[ ! -f "$DST" ]]; then
                  set -x
                  gunzip -d /tmp/bootstrap/$f -c > "$DST"
                  { set +x; } 2>/dev/null
                else
                  echo "'$DST' already exists"
                fi
              done
          env:
            - name: STALWART_TAG
              value: latest
          volumeMounts:
            - name: basedir
              mountPath: /opt/stalwart-mail
            - name: mail-data
              mountPath: /opt/stalwart-mail/data
            - name: bootstrap
              mountPath: /tmp/bootstrap
      containers:
        - name: mail-server
          image: stalwartlabs/mail-server:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: smtp
              containerPort: 25
            - name: smtps
              containerPort: 465
            - name: submission
              containerPort: 587
            - name: imap
              containerPort: 143
            - name: imaps
              containerPort: 993
            - name: sieve
              containerPort: 4190
            - name: http
              containerPort: 8080
          env: []
          envFrom:
            - secretRef:
                ## kubectl -n stalwart create secret generic jmap-oauth --from-literal=OAUTH_KEY=$(yq '.oauth.key' etc/jmap/oauth.toml)
                name: jmap-oauth
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 2000m
              memory: 512Mi
          volumeMounts:
            - name: basedir
              mountPath: /opt/stalwart-mail
            - name: mail-data
              mountPath: /opt/stalwart-mail/data
            - name: dkim
              mountPath: /opt/stalwart-mail/etc/dkim
            - name: certs
              mountPath: /opt/stalwart-mail/etc/certs
        - name: litestream
          image: litestream/litestream:latest
          args:
            - replicate
          volumeMounts: *litestreamVolumeMounts
          envFrom: *litestreamEnvFrom
          resources: *litestreamResources
          ports:
            - name: metrics
              containerPort: 9090
      restartPolicy: Always
      volumes:
        - name: basedir
          emptyDir: {}
        - name: bootstrap
          secret:
            secretName: stalwart-bootstrap
        - name: config
          configMap:
            name: stalwart
        - name: dkim
          secret:
            secretName: dkim
        - name: mail-data
          persistentVolumeClaim:
            claimName: mail-data
        - name: litestream
          configMap:
            name: litestream
        - name: certs
          secret:
            secretName: stalwart-tls
      nodeSelector: {}
      tolerations: []
  volumeClaimTemplates:
    - metadata:
        name: mail-data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
        storageClassName: standard