- Shipped
- May 11, 2026 at 11:11 PM UTC
- Author
- Kamo
- Commit
- 4b50063
Auto-cert now provisions and maintains the Let's Encrypt cert for mail.kamocrm.com (HTTP-01 via Traefik on port 80) and keeps the postfix consumer in sync across namespaces. Auto-cert changes: - Add mail.kamocrm.com to STATIC_DOMAINS. - New CROSS_NS_CERT_MIRRORS table mapping FQDN -> (target namespace, deployments to restart). Default entry: mail.kamocrm.com -> ("mail", ["postfix"]). - mirror_secret_to_namespace() copies tls-<stem> from kamo to the target ns idempotently (only restarts consumers when the tls.crt actually changes — every-minute sync stays cheap). - restart_deployment() runs kubectl rollout restart on consumers when a renewal lands. - Hooked into wait_for_host_cert_ready and the main loop so both auto-cert-driven issuances and cert-manager auto-renewals propagate. - New Role/RoleBinding (mail namespace) grants secrets create/update and deployments patch to the auto-cert ServiceAccount. Postfix changes: - Mount tls-mail-kamocrm-com (optional secret) at /etc/letsencrypt. - On boot, copy the LE cert into /etc/postfix/tls/ if present; otherwise generate a short-lived self-signed snakeoil so postfix can start before the cert is issued. - Use the real cert for smtpd_tls_cert_file / key_file with TLSv1.2+ and high ciphers. Submission (587) now offers a valid, trusted cert once auto-cert finishes the first issuance and rolls the deployment.