Support multiple domains in dev

Author: ryanjjung

bases/nginx/configmap.yaml

@@ -91,29 +91,31 @@ data:
     events {}
   
     http {
-      # --- SSL Configuration ---
-      # These files are populated as volumes mounted to the pods from secrets drawn from an
-      # external secret store.
-      ssl_certificate /etc/nginx/tls.crt;
-      ssl_certificate_key /etc/nginx/tls.key;
-      ssl_session_cache shared:SSL:10m;
-      ssl_session_timeout 10m;
-  
-      # Enable gzip compression
-      gzip on;
-  
       upstream stalwart-https {
         # The "stalwart-https" server is a Kubernetes Service exposing Stalwart's HTTPS port to
         # internal sources.
         server stalwart-https:443;
       }
   
       server {
+        # --- Domain setup
         server_name $TODO_KUSTOMIZE;
         listen 443 ssl;
         keepalive_timeout 60s;
         proxy_connect_timeout 1s;
   
+        # --- SSL Configuration ---
+        # These files are populated as volumes mounted to the pods from secrets drawn from an
+        # external secret store.
+        ssl_certificate /etc/nginx/tls.crt;
+        ssl_certificate_key /etc/nginx/tls.key;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 10m;
+  
+        # Enable gzip compression
+        gzip on;
+        gzip_types text/html application/json;
+  
         # Specifically block access to these routes
         location ^~ /account {  # Stalwart's user account settings system, superceded by thunderbird-accounts
           return 404;

overlays/tb-dev/kustomization.yaml

@@ -14,6 +14,7 @@ images:
 patches:
   - path: nginx/aws/security-groups.yaml
   - path: nginx/configmap.yaml
+  - path: nginx/deployment.yaml
   - path: stalwart-mail/aws/elasticache.yaml
   - path: stalwart-mail/aws/s3.yaml
   - path: stalwart-mail/aws/security-groups.yaml

overlays/tb-dev/nginx/configmap.yaml

@@ -79,6 +79,93 @@ data:
   
     events {}
   
+    http {
+      upstream stalwart-https {
+        # The "stalwart-https" server is a Kubernetes Service exposing Stalwart's HTTPS port to
+        # internal sources.
+        server stalwart-https:443;
+      }
+  
+      server {
+        # --- Dev domain server ---
+        server_name *.dev-thundermail.com;
+        listen 443 ssl;
+        keepalive_timeout 60s;
+        proxy_connect_timeout 1s;
+
+        # --- SSL Configuration ---
+        # These files are populated as volumes mounted to the pods from secrets drawn from an
+        # external secret store.
+        ssl_certificate /etc/nginx/dev-thundermail.crt;
+        ssl_certificate_key /etc/nginx/dev-thundermail.key;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 10m;
+
+        # Enable gzip compression
+        gzip on;
+        gzip_types text/html application/json;
+  
+        # Specifically block access to these routes
+        location ^~ /account {  # Stalwart's user account settings system, superceded by thunderbird-accounts
+          return 404;
+        }
+  
+        location ^~ /admin {  # Stalwart's web admin console, only accessible by private route
+          return 404;
+        }
+  
+        location ^~ /api {  # Stalwart's underlying API system, only accessible by private route
+          return 404;
+        }
+  
+        # All other routes are acceptable, and should be proxied to the backend
+        location ^~ / {
+          proxy_pass https://stalwart-https;
+          proxy_set_header Host mail.dev-thundermail.com;
+          proxy_ssl_name mail.dev-thundermail.com;
+        }
+      }
+
+      server {
+        # --- Stage domain server ---
+        server_name *.stage-thundermail.com;
+        listen 443 ssl;
+        keepalive_timeout 60s;
+        proxy_connect_timeout 1s;
+
+        # --- SSL Configuration ---
+        # These files are populated as volumes mounted to the pods from secrets drawn from an
+        # external secret store.
+        ssl_certificate /etc/nginx/stage-thundermail.crt;
+        ssl_certificate_key /etc/nginx/stage-thundermail.key;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 10m;
+
+        # Enable gzip compression
+        gzip on;
+        gzip_types text/html application/json;
+  
+        # Specifically block access to these routes
+        location ^~ /account {  # Stalwart's user account settings system, superceded by thunderbird-accounts
+          return 404;
+        }
+  
+        location ^~ /admin {  # Stalwart's web admin console, only accessible by private route
+          return 404;
+        }
+  
+        location ^~ /api {  # Stalwart's underlying API system, only accessible by private route
+          return 404;
+        }
+  
+        # All other routes are acceptable, and should be proxied to the backend
+        location ^~ / {
+          proxy_pass https://stalwart-https;
+          proxy_set_header Host mail.stage-thundermail.com;
+          proxy_ssl_name mail.stage-thundermail.com;
+        }
+      }
+  
     http {
       # --- SSL Configuration ---
       # These files are populated as volumes mounted to the pods from secrets drawn from an