Merge pull request #44 from thunderbird/install-migration-proxy

Install migration proxy

Author: ryanjjung

bases/nginx/service.yaml

@@ -6,26 +6,10 @@ metadata:
   name: nginx
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-    # EKS-specific annotations are documented in "Use Service Annotations to configure Network Load Balancers":
-    # https://docs.aws.amazon.com/eks/latest/userguide/auto-configure-nlb.html
-    # A full list of annotations supported by the AWS Load Balancer controller can be found here:
-    # https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/
-    service.beta.kubernetes.io/aws-load-balancer-name: stalwart-nginx-public
-    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
-    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
-    service.beta.kubernetes.io/aws-load-balancer-attributes: "load_balancing.cross_zone.enabled=true"
-    
-    # Update the below values in overlays
-    service.beta.kubernetes.io/aws-load-balancer-subnets: ""
-    service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "environment=not_set,project=not_set"
 spec:
-  type: LoadBalancer
+  type: ClusterIP
   selector:
-    # The public load balancer should always route traffic to our internal proxy, which will route
-    # that traffic internally according to our rules.
     app: stalwart-nginx
-  loadBalancerSourceRanges: 
-    - 0.0.0.0/0
   ports:
     - name: https
       port: 443

bases/stalwart-migration-proxy/aws/security-groups.yaml

@@ -79,6 +79,12 @@ spec:
       userIDGroupPairs:
         - description: Allow SMTPS service traffic from the proxy load balancer
           groupID: ""  # Populate with Kustomize
+    - fromPort: 587
+      toPort: 587
+      ipProtocol: tcp
+      userIDGroupPairs:
+        - description: Allow SMTP with STARTTLS service traffic from the proxy load balancer
+          groupID: ""  # Populate with Kustomize
     - fromPort: 993
       toPort: 993
       ipProtocol: tcp
@@ -133,6 +139,12 @@ spec:
       ipRanges:
         - cidrIP: "0.0.0.0/0"
           description: "Allow all STMPS ingress"
+    - fromPort: 587
+      toPort: 587
+      ipProtocol: tcp
+      ipRanges:
+        - cidrIP: "0.0.0.0/0"
+          description: "Allow all STMP with STARTTLS ingress"
     - fromPort: 993
       toPort: 993
       ipProtocol: tcp

bases/stalwart-migration-proxy/configmap.yaml

@@ -74,11 +74,13 @@ data:
     host = ""
     tls_server_name = ""
     proxy_protocol = true
+    forwarding = "proxy"
 
     [destination.new]
     host = ""
     tls_server_name = ""
     proxy_protocol = true
+    forwarding = "proxy"
 
     # Explicitly list all supported ports in the old and new installations.
     # "forwarding = proxy" uses PROXY protocol v2 with Stalwart backends and is the correct setting
@@ -88,52 +90,46 @@ data:
     [destination.old.protocol.http]
     port = 443
     tls = "implicit"
-    forwarding = true
+    forwarding = "none"
+    forwarded = true
     
     [destination.old.protocol.smtp]
     port = 465
     tls = "implicit"
-    forwarding = "proxy"
     
     [destination.old.protocol.submission]
     port = 587
     tls = "starttls"
-    forwarding = "proxy"
     
     [destination.old.protocol.imap]
     port = 993
     tls = "implicit"
-    forwarding = "proxy"
     
     [destination.old.protocol.managesieve]
     port = 4190
     tls = "starttls"
-    forwarding = "proxy"
     
     [destination.new.protocol.http]
     port = 443
     tls = "implicit"
-    forwarding = true
+    forwarding = "none"
+    forwarded = true
     
     [destination.new.protocol.smtp]
     port = 465
     tls = "implicit"
-    forwarding = "proxy"
     
     [destination.new.protocol.submission]
     port = 587
     tls = "starttls"
-    forwarding = "proxy"
     
     [destination.new.protocol.imap]
     port = 993
     tls = "implicit"
-    forwarding = "proxy"
     
     [destination.new.protocol.managesieve]
     port = 4190
     tls = "starttls"
-    forwarding = "proxy"
     
     # Listeners describe services listening on ports which will route to the above destinations.
     # "proxy_protocol = 'off'" (the default value, explicit in our config) disables the use of
@@ -145,32 +141,27 @@ data:
 
     [listener.https]
     protocol = "http"
-    proxy_protocol = "off"
     forwarded = "off"
     bind = ["0.0.0.0:443"]
     tls = "implicit"
 
     [listener.submissions]
     protocol = "submission"
-    proxy_protocol = "off"
     bind = ["0.0.0.0:465"]
     tls = "implicit"
 
     [listener.submission]
     protocol = "submission"
-    proxy_protocol = "off"
     bind = ["0.0.0.0:587"]
     tls = "starttls"
 
     [listener.imaps]
     protocol = "imap"
-    proxy_protocol = "off"
     bind = ["0.0.0.0:993"]
     tls = "implicit"
 
     [listener.managesieve]
     protocol = "managesieve"
-    proxy_protocol = "off"
     bind = ["0.0.0.0:4190"]
     tls = "starttls"
 

bases/stalwart-migration-proxy/service.yaml

@@ -1,27 +1,33 @@
 ---
-# The stalwart-migration-proxy-redis service maps to the Serverless Redis cache's master endpoint
-apiVersion: v1
-kind: Service
-metadata:
-  name: stalwart-migration-proxy-redis
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  type: ExternalName
-  externalName: "" # Populate with Kustomize
-
----
-# Creates an internal access point for the Stalwart migration proxy
+# The stalwart-migration-proxy service creates a public load balancer exposing
+# our migration proxy to the world.
 apiVersion: v1
 kind: Service
 metadata:
   name: stalwart-migration-proxy
   annotations:
     argocd.argoproj.io/sync-wave: "2"
+    # EKS-specific annotations are documented in "Use Service Annotations to configure Network Load Balancers":
+    # https://docs.aws.amazon.com/eks/latest/userguide/auto-configure-nlb.html
+    # A full list of annotations supported by the AWS Load Balancer controller can be found here:
+    # https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/
+    service.beta.kubernetes.io/aws-load-balancer-name: stalwart-migration-proxy-public
+    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
+    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+    service.beta.kubernetes.io/aws-load-balancer-attributes: "load_balancing.cross_zone.enabled=true"
+    
+    # Update the below values in overlays. Use public subnets, appropriate tags, and the LB's SG.
+    service.beta.kubernetes.io/aws-load-balancer-subnets: ""
+    service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "environment=not_set,project=not_set"
+    service.beta.kubernetes.io/aws-load-balancer-security-groups: "" # stalwart-migration-proxy-lb
 spec:
-  type: ClusterIP
+  type: LoadBalancer
   selector:
+    # The public load balancer should always route traffic to our internal proxy, which will route
+    # that traffic internally according to our rules.
     app: stalwart-migration-proxy
+  loadBalancerSourceRanges: 
+    - 0.0.0.0/0
   ports:
     - name: https
       port: 443
@@ -39,6 +45,18 @@ spec:
       port: 4190
       targetPort: sieve
 
+---
+# The stalwart-migration-proxy-redis service maps to the Serverless Redis cache's master endpoint
+apiVersion: v1
+kind: Service
+metadata:
+  name: stalwart-migration-proxy-redis
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  type: ExternalName
+  externalName: "" # Populate with Kustomize
+
 ---
 # Exposes the Stalwart migration proxy admin API internally for Tailscale to grant human access
 apiVersion: v1

overlays/tb-dev/kustomization.yaml

@@ -14,7 +14,6 @@ images:
 patches:
   - path: nginx/aws/security-groups.yaml
   - path: nginx/configmap.yaml
-  - path: nginx/service.yaml
   - path: stalwart-mail/aws/elasticache.yaml
   - path: stalwart-mail/aws/s3.yaml
   - path: stalwart-mail/aws/security-groups.yaml

overlays/tb-dev/nginx/aws/security-groups.yaml

@@ -25,26 +25,32 @@ spec:
       toPort: 443
       ipProtocol: tcp
       userIDGroupPairs:
-        - description: Allow HTTPS service traffic from the public nginx load balancer
-          groupID: "sg-00473b0f74de5fdaf" # stalwart-nginx-lb
+        - description: Allow HTTPS service traffic from the Stalwart migration proxy pods
+          groupID: sg-0590484da0d3c6702 # stalwart-migration-proxy
     - fromPort: 465
       toPort: 465
       ipProtocol: tcp
       userIDGroupPairs:
-        - description: Allow SMTPS service traffic from the public nginx load balancer
-          groupID: "sg-00473b0f74de5fdaf" # stalwart-nginx-lb
+        - description: Allow SMTPS service traffic from the Stalwart migration proxy pods
+          groupID: sg-0590484da0d3c6702 # stalwart-migration-proxy
+    - fromPort: 587
+      toPort: 587
+      ipProtocol: tcp
+      userIDGroupPairs:
+        - description: Allow SMTP STARTTLS service traffic from the Stalwart migration proxy pods
+          groupID: sg-0590484da0d3c6702 # stalwart-migration-proxy
     - fromPort: 993
       toPort: 993
       ipProtocol: tcp
       userIDGroupPairs:
-        - description: Allow IMAPS service traffic from the public nginx load balancer
-          groupID: "sg-00473b0f74de5fdaf" # stalwart-nginx-lb
+        - description: Allow IMAPS service traffic from the Stalwart migration proxy pods
+          groupID: sg-0590484da0d3c6702 # stalwart-migration-proxy
     - fromPort: 4190
       toPort: 4190
       ipProtocol: tcp
       userIDGroupPairs:
-        - description: Allow ManageSieve service traffic from the public nginx load balancer
-          groupID: "sg-00473b0f74de5fdaf" # stalwart-nginx-lb
+        - description: Allow ManageSieve service traffic from the Stalwart migration proxy pods
+          groupID: sg-0590484da0d3c6702 # stalwart-migration-proxy
 
 ---
 apiVersion: ec2.services.k8s.aws/v1alpha1