dapperdivers · dapperdivers · Feb 22, 2026
@@ -0,0 +1,23 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: email-oauth2-proxy-config
+data:
+  emailproxy.config: |
+    [Email OAuth 2.0 Proxy configuration]
+    # Log to stdout for k8s log collection
+    delete_account_token_on_password_error = False
+    encrypt_client_secret_on_first_use = False
+
+    [outlook]
+    permission_url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
+    token_url = https://login.microsoftonline.com/common/oauth2/v2.0/token
+    oauth2_scope = https://outlook.office.com/IMAP.AccessAsUser.All offline_access
+    redirect_uri = https://login.microsoftonline.com/common/oauth2/nativeclient
+
+    server_address = outlook.office.com
+    server_port = 993
+
+    local_address = 0.0.0.0
+    local_port = 1993
@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: email-oauth2-proxy
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: infisical
+  target:
+    name: email-oauth2-proxy-secret
+    template:
+      engineVersion: v2
+      mergePolicy: Replace
+      data:
+        OUTLOOK_ADDRESS: "{{ .STALWART_OUTLOOK_ADDRESS }}"
+        OUTLOOK_OAUTH_CLIENT_ID: "{{ .STALWART_OUTLOOK_OAUTH_CLIENT_ID }}"
+        OUTLOOK_OAUTH_CLIENT_SECRET: "{{ .STALWART_OUTLOOK_OAUTH_CLIENT_SECRET }}"
+  dataFrom:
+    - find:
+        name:
+          regexp: ^STALWART_OUTLOOK.*
@@ -0,0 +1,85 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: email-oauth2-proxy
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: app-template
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      main:
+        strategy: Recreate
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: blacktirion/email-oauth2-proxy-docker
+              tag: "2.4.0"
+            env:
+              CACHE_STORE: /config/credstore.config
+              LOGFILE: "true"
+            envFrom:
+              - secretRef:
+                  name: email-oauth2-proxy-secret
+            probes:
+              liveness:
+                enabled: true
+                custom: true
+                spec:
+                  tcpSocket:
+                    port: &port 1993
+                  initialDelaySeconds: 10
+                  periodSeconds: 30
+              readiness:
+                enabled: true
+                custom: true
+                spec:
+                  tcpSocket:
+                    port: *port
+                  initialDelaySeconds: 5
+                  periodSeconds: 10
+            resources:
+              requests:
+                cpu: 100m
+                memory: 128Mi
+              limits:
+                cpu: 200m
+                memory: 256Mi
+    service:
+      app:
+        controller: main
+        ports:
+          imap:
+            port: *port
+    persistence:
+      config:
+        type: configMap
+        name: email-oauth2-proxy-config
+        advancedMounts:
+          main:
+            app:
+              - path: /app/emailproxy.config
+                subPath: emailproxy.config
+                readOnly: true
+      data:
+        type: persistentVolumeClaim
+        storageClass: ceph-rbd
+        accessMode: ReadWriteOnce
+        size: 100Mi
+        advancedMounts:
+          main:
+            app:
+              - path: /config
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./externalsecret.yaml
+  - ./configmap.yaml
@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app email-oauth2-proxy
+  namespace: &namespace selfhosted
+spec:
+  targetNamespace: *namespace
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: stalwart
+      namespace: selfhosted
+    - name: external-secrets-stores
+      namespace: external-secrets
+  path: ./kubernetes/apps/selfhosted/email-oauth2-proxy/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: imapsync
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: infisical
+  target:
+    name: imapsync-credentials
+    template:
+      engineVersion: v2
+      mergePolicy: Replace
+      data:
+        # Source provider credentials
+        GMAIL_ADDRESS: "{{ .STALWART_GMAIL_ADDRESS }}"
+        gmail-password: "{{ .STALWART_GMAIL_IMAP_PASSWORD }}"
+        MIGADU_ADDRESS: "{{ .STALWART_MIGADU_ADDRESS }}"
+        migadu-password: "{{ .STALWART_MIGADU_IMAP_PASSWORD }}"
+        OUTLOOK_ADDRESS: "{{ .STALWART_OUTLOOK_ADDRESS }}"
+        outlook-password: "{{ .STALWART_OUTLOOK_IMAP_PASSWORD }}"
+        # Stalwart destination credentials
+        STALWART_USER: "{{ .STALWART_PRIMARY_USER }}"
+        stalwart-password: "{{ .STALWART_PRIMARY_PASSWORD }}"
+  dataFrom:
+    - find:
+        name:
+          regexp: ^STALWART.*