kind: ConfigMap
apiVersion: v1
metadata:
  name: mailserver.env.config
  namespace: mailserver
  labels:
    app: mailserver
data:
  POSTFIX_MESSAGE_SIZE_LIMIT: "100000000"
  OVERRIDE_HOSTNAME: <guess why I've changed this>
  ENABLE_FETCHMAIL: "0"
  FETCHMAIL_POLL: "120"
  ENABLE_SPAMASSASSIN: "1"
  SPAMASSASSIN_SPAM_TO_INBOX: "1"
  SA_SPAM_SUBJECT: "undef"
  MOVE_SPAM_TO_JUNK: "1"
  SA_TAG: "-100000.0"
  SA_TAG2: "4"
  SA_KILL: "100000.0"
  ENABLE_AMAVIS: "1"
  AMAVIS_LOGLEVEL: "0"
  ENABLE_CLAMAV: "1"
  ENABLE_FAIL2BAN: "1"
  ENABLE_POSTGREY: "1"
  ONE_DIR: "1"
  DMS_DEBUG: "0"
  SSL_TYPE: "manual"
  SSL_CERT_PATH: "/etc/ssl/mailserver/tls.crt"
  SSL_KEY_PATH: "/etc/ssl/mailserver/tls.key"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mailserver
  namespace: mailserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mailserver
  template:
    metadata:
      labels:
        app: mailserver
        role: mail
        tier: backend
    spec:
      #nodeSelector:
      #  kubernetes.io/hostname: local.k8s
      #initContainers:
      #- name: init-myservice
      #  image: busybox
      #  command: ["/bin/sh", "-c", "cp /tmp/user-patches.sh /tmp/files"]
      #  volumeMounts:
      #    - name: config
      #      subPath: user-patches.sh
      #      mountPath: /tmp/user-patches.sh
      #      readOnly: true
      #    - name: tmp-files
      #      mountPath: /tmp/files
      containers:
      - name: docker-mailserver
        image: mailserver/docker-mailserver:10.0.0
        imagePullPolicy: Always
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false
          runAsUser: 0
          runAsGroup: 0
          runAsNonRoot: false
          privileged: false
          capabilities:
            add:
              # file permission capabilities
              - CHOWN
              - FOWNER
              - MKNOD
              - SETGID
              - SETUID
              - DAC_OVERRIDE
              # miscellaneous  capabilities
              - SYS_CHROOT
              - NET_BIND_SERVICE
              - KILL
              - NET_ADMIN
            drop: [ALL]
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
          - name: postfix-accounts
            mountPath: /tmp/docker-mailserver/postfix-accounts.cf
            readOnly: true
          - name: config
            subPath: postfix-main.cf
            mountPath: /tmp/docker-mailserver/postfix-main.cf
            readOnly: true
          - name: config
            subPath: postfix-virtual.cf
            mountPath: /tmp/docker-mailserver/postfix-virtual.cf
            readOnly: true
          - name: config
            subPath: fetchmail.cf
            mountPath: /tmp/docker-mailserver/fetchmail.cf
            readOnly: true
          - name: config
            subPath: dovecot.cf
            mountPath: /tmp/docker-mailserver/dovecot.cf
            readOnly: true
          - name: opendkim
            mountPath: /tmp/docker-mailserver/opendkim
            readOnly: true
          - name: data
            mountPath: /var/mail
            subPath: data
          - name: data
            mountPath: /var/mail-state
            subPath: state
          - name: data
            mountPath: /var/log/mail
            subPath: log
          - name: tls
            mountPath: /etc/ssl/mailserver
            readOnly: true
        ports:
          - name: smtp
            containerPort: 25
            protocol: TCP
          - name: smtp-secure
            containerPort: 465
            protocol: TCP
          - name: smtp-auth
            containerPort: 587
          - name: imap
            containerPort: 143
            protocol: TCP
          - name: imap-secure
            containerPort: 993
            protocol: TCP
        envFrom:
          - configMapRef:
              name: mailserver.env.config
      volumes:
        - name: config
          configMap:
            name: mailserver.config
        - name: postfix-accounts
          hostPath:
             path: /mnt/k8s/yaml/mailserver/config/postfix-accounts.cf
             type: File
        - name: opendkim
          hostPath:
            path: /mnt/k8s/yaml/mailserver/config/opendkim
            type: Directory
        - name: data
          persistentVolumeClaim:
            claimName: mailserver-pvc
        - name: tmp-files
          emptyDir: {}
        - name: tls
          secret:
            secretName: <redacted this, can you guess why?>