Lots of changes

tasks/mail.yaml

@@ -42,6 +42,22 @@
           name: ca-issuer
           kind: ClusterIssuer
 
+- name: Create a persistent volume claim for mail
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: config
+        namespace: mail
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Gi
+
 - name: Create a persistent volume claim for mail
   k8s:
     state: present
@@ -79,7 +95,38 @@
             containers:
               - name: mail
                 image: mailserver/docker-mailserver
+                securityContext:
+                  # `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop`
+                  # executable in `/var/mail-state` for Postfix (maildrop + public dirs):
+                  # https://github.com/docker-mailserver/docker-mailserver/pull/3625
+                  allowPrivilegeEscalation: true
+                  readOnlyRootFilesystem: false
+                  runAsUser: 0
+                  runAsGroup: 0
+                  runAsNonRoot: false
+                  privileged: false
+                  capabilities:
+                    add:
+                      # file permission capabilities
+                      - CHOWN
+                      - FOWNER
+                      - MKNOD
+                      - SETGID
+                      - SETUID
+                      - DAC_OVERRIDE
+                      # network capabilities
+                      - NET_ADMIN  # needed for F2B
+                      - NET_RAW    # needed for F2B
+                      - NET_BIND_SERVICE
+                      # miscellaneous  capabilities
+                      - SYS_CHROOT
+                      - KILL
+                    drop: [ALL]
+                  seccompProfile:
+                    type: RuntimeDefault
                 volumeMounts:
+                  - name: config
+                    mountPath: /tmp/docker-mailserver
                   - name: ssl
                     mountPath: /etc/letsencrypt
                   - name: mail
@@ -145,6 +192,9 @@
               - name: ssl
                 secret:
                   secretName: mail
+              - name: config
+                persistentVolumeClaim:
+                  claimName: config
               - name: mail
                 persistentVolumeClaim:
                   claimName: mail
@@ -172,3 +222,4 @@
           - port: 995
             name: pop3
         type: LoadBalancer
+        externalTrafficPolicy: Local