mailu values¶
Every value of chart mailu 0.1.7, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.
| Value | Type | Default | Description |
|---|---|---|---|
secrets.type |
string | kubernetes |
kubernetes: Secret from the values below. externalSecret: from a secret store One of: kubernetes, externalSecret. |
secrets.initialAdminPassword |
string | "" |
password of the first admin account; empty: generated |
secrets.secretKey |
string | "" |
machine-to-machine secrets; empty: generated once and kept on upgrade |
secrets.apiToken |
string | "" |
|
secrets.roundcubeKey |
string | "" |
|
secrets.externalSecret.storeKind |
string | ClusterSecretStore |
|
secrets.externalSecret.storeName |
string | "" |
|
secrets.externalSecret.refreshInterval |
string | 1h |
|
secrets.externalSecret.items |
object | one vault item per key; the value is read from the item's password | |
secrets.externalSecret.items.secret-key |
string | mailu-secret-key |
|
secrets.externalSecret.items.initial-account-password |
string | mailu-initial-account-password |
|
secrets.externalSecret.items.api-token |
string | mailu-api-token |
|
secrets.externalSecret.items.roundcube-db-password |
string | mailu-roundcube-db-password |
|
mailService |
object | Public Service for the mail protocols | |
mailService.public |
boolean | false |
true: LoadBalancer Service with a public address, whatever type says |
mailService.type |
string | ClusterIP |
LoadBalancer gives the mail ports a public address |
mailService.externalTrafficPolicy |
string | Local |
|
mailService.annotations |
object | {} |
for example the address pool annotation of the load balancer |
mailService.ports.smtp |
boolean | true |
|
mailService.ports.smtps |
boolean | true |
|
mailService.ports.submission |
boolean | true |
|
mailService.ports.imap |
boolean | true |
|
mailService.ports.imaps |
boolean | true |
|
mailService.ports.pop3 |
boolean | true |
|
mailService.ports.pop3s |
boolean | true |
|
mailService.ports.manageSieve |
boolean | true |
|
mailService.ports.http |
boolean | false |
webmail on the mail address itself, next to the Route |
mailService.ports.https |
boolean | false |
|
dns |
object | Records in the platform's DNS, written by external-dns. Works for a mail domain in a zone that external-dns serves; for any other zone create the records yourself. | |
dns.enabled |
boolean | false |
|
dns.ttl |
integer | 300 |
|
dns.spf |
string | v=spf1 mx -all |
|
dns.dmarc |
string | v=DMARC1; p=quarantine |
|
egressService |
object | Second public address, used only as the source of outgoing mail | |
egressService.enabled |
boolean | false |
|
egressService.annotations |
object | {} |
|
route |
object | Webmail and admin interface | |
route.enabled |
boolean | true |
|
route.hostname |
string | "" |
empty: OpenShift assigns a host under the default application domain |
certificate |
object | Certificate for the mail protocols, for the hostnames of the mail server. Disabled: a certificate of the cluster's internal service CA is used. | |
certificate.enabled |
boolean | false |
|
certificate.issuerName |
string | "" |
|
certificate.issuerKind |
string | ClusterIssuer |
|
certificate.renewBefore |
string | 720h |
|
networkPolicy.enabled |
boolean | true |
|
monitoring |
object | ServiceMonitors, alert rules and the NetworkPolicy for the scraper | |
monitoring.enabled |
boolean | false |
|
monitoring.alerts |
boolean | true |
alert rules next to the ServiceMonitors; false where the platform alerts centrally |
monitoring.namespaceLabels |
object | label of the namespaces that may scrape | |
monitoring.namespaceLabels.network.openshift.io/policy-group |
string | monitoring |
|
rspamd.greylistWhitelistDomains |
array | ["anthropic.com", "amazonses.com", "bol.com", "canva.com", "ebay.com", "odoo.... |
sender domains that skip greylisting |
imapsync |
object | Web page to copy mailboxes from another mail server | |
imapsync.enabled |
boolean | false |
|
imapsync.replicaCount |
integer | 1 |
|
imapsync.image.repository |
string | gilleslamiral/imapsync |
|
imapsync.image.tag |
string | 2.326 |
|
imapsync.image.pullPolicy |
string | IfNotPresent |
|
imapsync.nginx.image.repository |
string | nginxinc/nginx-unprivileged |
|
imapsync.nginx.image.tag |
string | stable-alpine |
|
imapsync.nginx.image.pullPolicy |
string | IfNotPresent |
|
imapsync.route.hostname |
string | "" |
empty: OpenShift assigns a host under the default application domain |
imapsync.resources.requests.cpu |
string | 25m |
|
imapsync.resources.requests.memory |
string | 64Mi |
|
imapsync.resources.limits.cpu |
string | 1 |
|
imapsync.resources.limits.memory |
string | 512Mi |
|
global.dkim |
object | DKIM signing key made by cert-manager instead of in the admin interface. The platform publishes its public half as the DKIM record. Switch on at install: a key made in the admin interface earlier is no longer used. | |
global.dkim.managed |
boolean | false |
|
global.dkim.selector |
string | dkim |
|
global.dkim.issuer.name |
string | selfsigned |
|
global.dkim.issuer.kind |
string | ClusterIssuer |
|
global.dkim.secretTemplate |
object | {} |
labels and annotations of the Secret that holds the key, by which a platform recognises it and publishes the DKIM record |
global.publicAddress |
object | Public address of the load balancer (MetalLB annotations) | |
global.publicAddress.shared |
boolean | false |
true: the public Services of this project share one address. They then use externalTrafficPolicy Cluster, so a server no longer sees the address of its client. The mail Service never shares: it needs that address to refuse spam and relaying. false: one address per Service. |
global.publicAddress.sharingKey |
string | "" |
Services with the same key share; empty: the name of the project |
global.publicAddress.ip |
string | "" |
with shared: ask for this address; empty: the load balancer assigns one |
global.database.roundcube.existingSecret |
string | mailu-secrets |
|
global.database.roundcube.existingSecretPasswordKey |
string | roundcube-db-password |
|
upstream |
object | Values of the upstream chart mailu, included under the alias upstream | |
upstream.nameOverride |
string | mailu |
|
upstream.fullnameOverride |
string | mailu |
|
upstream.commonLabels |
object | on every object of the upstream chart; they do not reach pods or selectors | |
upstream.commonLabels.app |
string | {{ include "mailu.names.fullname" . }} |
|
upstream.commonLabels.app.kubernetes.io/part-of |
string | {{ .Release.Name }} |
|
upstream.domain |
string | example.org |
The part after the @ of the mail addresses |
upstream.hostnames |
array | ["mail.example.org"] |
The first one is the name in the MX record |
upstream.existingSecret |
string | mailu-secrets |
all four secrets live in one Secret, made by this chart |
upstream.initialAccount.enabled |
boolean | true |
|
upstream.initialAccount.username |
string | admin |
|
upstream.initialAccount.domain |
string | example.org |
Same value as the mail domain |
upstream.initialAccount.existingSecret |
string | mailu-secrets |
|
upstream.initialAccount.existingSecretPasswordKey |
string | initial-account-password |
|
upstream.initialAccount.mode |
string | create |
|
upstream.api.enabled |
boolean | true |
|
upstream.api.existingSecret |
string | mailu-secrets |
|
upstream.api.existingSecretTokenKey |
string | api-token |
|
upstream.subnet |
string | 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 |
networks that count as internal: pods and services of the cluster |
upstream.ingress.enabled |
boolean | false |
|
upstream.ingress.tlsFlavorOverride |
string | mail |
TLS on the mail ports, plain HTTP on port 80 for the Route |
upstream.ingress.realIpFrom |
string | 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 |
|
upstream.persistence.size |
string | 20Gi |
|
upstream.persistence.storageClass |
string | "" |
empty: the default StorageClass of the cluster |
upstream.clamav.enabled |
boolean | false |
|
upstream.front.containerSecurityContext |
object | root needs a fixed UID, else the pod gets a random one | |
upstream.front.containerSecurityContext.enabled |
boolean | true |
|
upstream.front.containerSecurityContext.runAsUser |
integer | 0 |
|
upstream.front.containerSecurityContext.runAsNonRoot |
boolean | false |
|
upstream.front.hostPort.enabled |
boolean | false |
|
upstream.front.externalService |
object | replaced by the Service of this chart | |
upstream.front.externalService.enabled |
boolean | false |
|
upstream.front.extraEnvVarsCM |
string | {{ include "mailu.names.fullname" . }}-ports |
listening ports follow mailService.ports |
upstream.front.extraVolumes |
array | [{"name": "dovecot-override", "configMap": {"name": "{{ include \"mailu.names... |
|
upstream.front.extraVolumeMounts |
array | [{"name": "dovecot-override", "mountPath": "/overrides/dovecot/proxy.conf", "... |
|
upstream.front.resources.requests.cpu |
string | 50m |
|
upstream.front.resources.requests.memory |
string | 256Mi |
|
upstream.front.resources.limits.cpu |
string | 1 |
|
upstream.front.resources.limits.memory |
string | 1536Mi |
|
upstream.admin.extraEnvVarsCM |
string | {{ include "mailu.names.fullname" . }}-ports |
|
upstream.admin.updateStrategy |
object | one ReadWriteOnce volume: never two admin pods at once | |
upstream.admin.updateStrategy.type |
string | Recreate |
|
upstream.admin.affinity |
object | all pods that share the volume run on one node | |
upstream.admin.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution |
array | [{"labelSelector": {"matchLabels": {"app.kubernetes.io/instance": "{{ .Releas... |
|
upstream.admin.extraEnvVars |
array | [{"name": "SUBNET", "value": "{{ .Values.subnet }}"}] |
|
upstream.admin.initContainers |
array | [{"name": "patch-startup", "image": "{{ .Values.imageRegistry }}/{{ .Values.a... |
the cluster DNS does not validate DNSSEC; skip that startup check |
upstream.admin.extraVolumeMounts |
string | `- name: startup-script | |
| mountPath: /start.py | |||
| subPath: start.py | |||
| {{- if (.Va...` | text, not a list: the DKIM key is mounted only with global.dkim.managed | ||
upstream.admin.extraVolumes |
string | `- name: startup-script | |
| emptyDir: {} | |||
| {{- if (.Values.global.dkim).managed }}...` | |||
upstream.admin.resources.requests.cpu |
string | 50m |
|
upstream.admin.resources.requests.memory |
string | 256Mi |
|
upstream.admin.resources.limits.cpu |
string | 1 |
|
upstream.admin.resources.limits.memory |
string | 1Gi |
|
upstream.dovecot.extraEnv |
array | [{"name": "SKIP_CHOWN", "value": "1"}] |
|
upstream.dovecot.overrides.dovecot.conf |
string | `service imap-login { | |
| chroot = | |||
| } | |||
| service pop3-login { | |||
| chroot = | |||
| } | |||
| service m...` | |||
upstream.dovecot.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution |
array | [{"labelSelector": {"matchLabels": {"app.kubernetes.io/component": "admin", "... |
|
upstream.dovecot.resources.requests.cpu |
string | 50m |
|
upstream.dovecot.resources.requests.memory |
string | 256Mi |
|
upstream.dovecot.resources.limits.cpu |
string | 1 |
|
upstream.dovecot.resources.limits.memory |
string | 1Gi |
|
upstream.postfix.updateStrategy.type |
string | Recreate |
|
upstream.postfix.resources.requests.cpu |
string | 50m |
|
upstream.postfix.resources.requests.memory |
string | 128Mi |
|
upstream.postfix.resources.limits.cpu |
string | 1 |
|
upstream.postfix.resources.limits.memory |
string | 512Mi |
|
upstream.rspamd.extraVolumes |
string | `- name: override-d | |
| configMap: | |||
| name: {{ include "mailu.names.fullname" ....` | text, not a list: the DKIM key is mounted only with global.dkim.managed | ||
upstream.rspamd.extraVolumeMounts |
string | `# DKIM keys of the admin interface, on the shared volume | |
| - name: data | |||
| mount...` | |||
upstream.rspamd.resources.requests.cpu |
string | 100m |
|
upstream.rspamd.resources.requests.memory |
string | 384Mi |
|
upstream.rspamd.resources.limits.cpu |
string | 1 |
|
upstream.rspamd.resources.limits.memory |
string | 1Gi |
|
upstream.webmail.updateStrategy.type |
string | Recreate |
|
upstream.webmail.resources.requests.cpu |
string | 50m |
|
upstream.webmail.resources.requests.memory |
string | 256Mi |
|
upstream.webmail.resources.limits.cpu |
string | 1 |
|
upstream.webmail.resources.limits.memory |
string | 768Mi |
|
upstream.oletools.resources.requests.cpu |
string | 25m |
|
upstream.oletools.resources.requests.memory |
string | 64Mi |
|
upstream.oletools.resources.limits.cpu |
string | 500m |
|
upstream.oletools.resources.limits.memory |
string | 256Mi |
|
upstream.tika.resources.requests.cpu |
string | 100m |
|
upstream.tika.resources.requests.memory |
string | 512Mi |
|
upstream.tika.resources.limits.cpu |
string | 1 |
|
upstream.tika.resources.limits.memory |
string | 2Gi |
|
upstream.redis.master.persistence.size |
string | 1Gi |
|
upstream.redis.master.persistence.storageClass |
string | "" |
|
upstream.redis.master.resources.requests.cpu |
string | 50m |
|
upstream.redis.master.resources.requests.memory |
string | 128Mi |
|
upstream.redis.master.resources.limits.cpu |
string | 500m |
|
upstream.redis.master.resources.limits.memory |
string | 256Mi |