fix(docker-mailserver): stop exposing plaintext IMAP by default

Port 143 (and its proxyProtocol variant 10143) was included in the
Service unconditionally whenever IMAP is enabled, alongside 993 -
meaning plaintext, unencrypted IMAP was reachable from outside the
cluster on any deployment using this chart with a LoadBalancer/NodePort
service. Confirmed reachable in production.

Adds service.exposePlaintextImap (default false) - only TLS IMAPS
(993) is exposed unless explicitly opted into.

Signed-off-by: Rishi <rishi@obmondo.com>

Author: MAVRICK-1

argocd-helm-charts/docker-mailserver/charts/docker-mailserver/templates/service.yaml

@@ -73,27 +73,31 @@ spec:
   {{- end }}   
 
   {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}
+    {{- if .Values.service.exposePlaintextImap }}
     - name: imap
       targetPort: imap
       port: 143
-      {{- if eq .Values.service.type "NodePort" }}    
+      {{- if eq .Values.service.type "NodePort" }}
       nodePort: {{ default "30143" .Values.service.nodePort.imap }}
-      {{- end }}       
+      {{- end }}
+    {{- end }}
     - name: imaps
       targetPort: imaps
       port: 993
-      {{- if eq .Values.service.type "NodePort" }}    
+      {{- if eq .Values.service.type "NodePort" }}
       nodePort: {{ default "30993" .Values.service.nodePort.imaps }}
-      {{- end }}   
+      {{- end }}
     {{- if .Values.proxyProtocol.enabled }}
+    {{- if .Values.service.exposePlaintextImap }}
     - name: imap-proxy
       targetPort: imap-proxy
       port: 10143
+    {{- end }}
     - name: imaps-proxy
       targetPort: imaps-proxy
       port: 10993
-    {{- end }}   
-  {{- end }}   
+    {{- end }}
+  {{- end }}
 
   {{- if and (.Values.deployment.env.ENABLE_POP3) (not .Values.deployment.env.SMTP_ONLY) }}
     - name: pop3

argocd-helm-charts/docker-mailserver/charts/docker-mailserver/values.yaml

@@ -323,6 +323,11 @@ service:
   # clusterIp:
   annotations: {}
   labels: {}
+  ## Whether to expose plaintext IMAP (port 143, and 10143 with proxyProtocol) on the Service.
+  ## Defaults to false: only TLS IMAPS (993) is exposed. STARTTLS-capable plaintext IMAP has
+  ## no business being reachable from outside the cluster - set to true only if you have a
+  ## specific client that cannot do IMAPS and you accept the risk.
+  exposePlaintextImap: false
 
 # Note this is a dictionary and not a list so individual keys can be overridden by --set or --value helm parameters
 persistent_volume_claims: