feat(new): add docker-mailserver helm chart v5.1.1 - #102
Merged
Conversation
MAVRICK-1
force-pushed
the
feat/docker-mailserver
branch
from
July 18, 2026 19:10
cabf8f1 to
3604320
Compare
Adds the docker-mailserver chart (IMAP + bundled Postfix for outbound mail), with sane in-cluster defaults, plus an optional Cilium egress gateway template for a stable outbound IP (SPF alignment) - since docker-mailserver bundles its own Postfix, this is the one place mail actually leaves the cluster for a deployment using this chart, not a separate relay chart. Also patches the vendored subchart's service.yaml to support externalIPs - the upstream template never read that value at all, so it was being silently ignored. Egress policy's pod-selector label key is configurable (egressGateway.podSelectorLabelKey, defaults to 'release' - this chart's actual convention). Getting this wrong means the policy silently matches nothing; confirmed happening in production, causing a real SPF failure until caught and fixed. Adds tls.enforceOutbound (default off) for anyone who wants to require TLS on outbound delivery instead of Postfix's default opportunistic behaviour. Adds service.exposePlaintextImap (default false) - plaintext IMAP (143) was included in the Service unconditionally whenever IMAP is enabled, alongside TLS IMAPS (993), meaning it was reachable from outside the cluster on any deployment using a LoadBalancer/NodePort service. Flagged by an external security report against a real deployment using this chart. Only IMAPS is exposed now unless you explicitly opt in. Signed-off-by: Rishi <rishi@obmondo.com>
MAVRICK-1
force-pushed
the
feat/docker-mailserver
branch
from
July 22, 2026 05:24
3604320 to
7f68d44
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the docker-mailserver Helm chart (IMAP + bundled Postfix for outbound mail) with sane in-cluster defaults, plus an optional Cilium egress gateway for a stable outbound IP so SPF passes.
Also includes two things found while running this in production: