provisioning-catalog/components/stalwart/cluster/stalwart-lib.sh

#!/bin/bash
# Methods library for stalwart — sourced by install-stalwart.sh and run-*.sh
# SCRIPT_DIR must be set by the caller before sourcing.

_kubectl() {
  if command -v kubectl >/dev/null 2>&1; then
    command kubectl "$@"
  elif command -v k0s >/dev/null 2>&1; then
    k0s kubectl "$@"
  else
    echo "ERROR: no kubectl or k0s binary found" >&2; exit 127
  fi
}

_require_env() {
  local var="$1"
  if [ -z "${!var:-}" ]; then
    echo "ERROR: required variable $var is not set" >&2; exit 1
  fi
}

_pod_name() {
  _kubectl get pod \
    --namespace "$STALWART_NAMESPACE" \
    --selector "app.kubernetes.io/name=stalwart" \
    -o jsonpath='{.items[0].metadata.name}' 2>/dev/null
}

_wait_for_pod() {
  local timeout="${1:-180}"
  _kubectl wait pod \
    --namespace "$STALWART_NAMESPACE" \
    --selector "app.kubernetes.io/name=stalwart" \
    --for=condition=Ready \
    --timeout="${timeout}s"
}

# ── Manifest plan helpers ─────────────────────────────────────────────────────

_plan_apply() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  _kubectl apply -f "$path"
}

_plan_apply_skip() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  if _kubectl get -f "$path" >/dev/null 2>&1; then
    echo "  [skip] $file already exists in cluster"
    return 0
  fi
  _kubectl apply -f "$path"
}

_plan_rollout_restart() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  _kubectl rollout restart -f "$path"
}

_plan_delete() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  _kubectl delete -f "$path" --ignore-not-found
}

_plan_recreate() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] $file.yaml not in manifests/"; return 0; }
  _kubectl delete -f "$path" --ignore-not-found
  _kubectl apply -f "$path"
}

# ── Component methods ─────────────────────────────────────────────────────────

_method_create-credentials() {
  _require_env RELAY_USERNAME
  _require_env RELAY_PASSWORD
  _require_env ADMIN_PASSWORD
  _kubectl create secret generic stalwart-credentials \
    --namespace "$STALWART_NAMESPACE" \
    --from-literal=RELAY_USERNAME="$RELAY_USERNAME" \
    --from-literal=RELAY_PASSWORD="$RELAY_PASSWORD" \
    --from-literal=ADMIN_PASSWORD="$ADMIN_PASSWORD" \
    --dry-run=client -o yaml | _kubectl apply -f -
}

_method_apply-tls-secret() {
  local cert_template="$SCRIPT_DIR/templates/certificate.yaml"
  if [ -s "$cert_template" ]; then
    echo "  [cert-manager] applying CF token secret..."
    _kubectl apply --server-side -f "$SCRIPT_DIR/templates/cf-dns-token.yaml"
    echo "  [cert-manager] applying ClusterIssuer..."
    local issuer_name
    issuer_name=$(grep -m1 'name:' "$SCRIPT_DIR/templates/clusterissuer.yaml" | awk '{print $2}')
    if ! _kubectl get clusterissuer "$issuer_name" >/dev/null 2>&1; then
      _kubectl apply --server-side -f "$SCRIPT_DIR/templates/clusterissuer.yaml"
    fi
    echo "  [cert-manager] applying Certificate..."
    _kubectl apply --server-side -f "$cert_template"
    echo "  [cert-manager] waiting for TLS secret '$STALWART_TLS_SECRET' to be created (up to 300s)..."
    local i=0
    until _kubectl get secret "$STALWART_TLS_SECRET" --namespace "$STALWART_NAMESPACE" >/dev/null 2>&1; do
      i=$((i + 1))
      if [ $i -ge 60 ]; then
        echo "ERROR: tls secret '$STALWART_TLS_SECRET' not created after 300s — check ClusterIssuer and DNS challenge" >&2
        exit 1
      fi
      sleep 5
    done
    echo "  [cert-manager] TLS secret '$STALWART_TLS_SECRET' ready"
    return 0
  fi
  local tls_crt="$SCRIPT_DIR/tls.crt"
  local tls_key="$SCRIPT_DIR/tls.key"
  if [ ! -f "$tls_crt" ] || [ ! -f "$tls_key" ]; then
    echo "ERROR: neither certificate.yaml nor tls.crt/tls.key found — cannot create TLS secret" >&2
    exit 1
  fi
  _kubectl create secret tls "$STALWART_TLS_SECRET" \
    --namespace "$STALWART_NAMESPACE" \
    --cert="$tls_crt" \
    --key="$tls_key" \
    --dry-run=client -o yaml | _kubectl apply -f -
}

_method_protect-volume() {
  local pvc="${PLAN_PARAM_PVC:-${STALWART_NAMESPACE}-data}"
  echo "  waiting for PVC '$pvc' to bind..."
  _kubectl wait pvc "$pvc" \
    --namespace "$STALWART_NAMESPACE" \
    --for=jsonpath='{.status.phase}'=Bound \
    --timeout=120s
  local pv_name
  pv_name=$(_kubectl get pvc "$pvc" \
    --namespace "$STALWART_NAMESPACE" \
    -o jsonpath='{.spec.volumeName}')
  if [ -z "$pv_name" ]; then
    echo "  [warn] could not resolve PV name for PVC '$pvc' — skipping volume protection"
    return 0
  fi
  echo "  enabling Hetzner delete-protection on volume '$pv_name'..."
  if command -v hcloud >/dev/null 2>&1; then
    hcloud volume enable-protection "$pv_name" delete 2>/dev/null \
      && echo "  [ok] volume '$pv_name' protected against deletion" \
      || echo "  [warn] hcloud protect failed — enable manually: hcloud volume enable-protection $pv_name delete"
  else
    echo "  [warn] hcloud CLI not found — enable manually: hcloud volume enable-protection $pv_name delete"
  fi
}

_method_wait-ready() {
  _wait_for_pod 180
}

_method_http-check() {
  local path="${PLAN_PARAM_PATH:-/healthz}"
  local expect="${PLAN_PARAM_EXPECT:-200}"
  local url="https://${STALWART_HOSTNAME}${path}"
  echo "  checking $url (expect HTTP $expect)"
  local status
  status=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 "$url" 2>/dev/null)
  [ -z "$status" ] && status="000"
  if [ "$status" = "$expect" ]; then
    echo "  [ok] HTTP $status"
  else
    echo "  [warn] HTTP $status (expected $expect)"
  fi
}

_method_smtp-check() {
  local host="${PLAN_PARAM_HOST:-${STALWART_LB_IPAM_IP}}"
  local port="${PLAN_PARAM_PORT:-${STALWART_SUBMISSION_PORT}}"
  echo "  checking SMTP $host:$port"
  if echo QUIT | nc -w 5 "$host" "$port" 2>/dev/null | grep -q "^220"; then
    echo "  [ok] SMTP $host:$port responding"
  else
    echo "  [warn] SMTP $host:$port not responding"
  fi
}

_method_notify-redeploy() {
  local message="${PLAN_PARAM_MESSAGE:-stalwart redeployed}"
  echo "  [notify] $message"
  if [ -n "${PLAN_PARAM_WEBHOOK:-}" ]; then
    curl -sf -X POST "$PLAN_PARAM_WEBHOOK" \
      -H "Content-Type: application/json" \
      -d "{\"text\": \"${message}\"}" || echo "  [warn] webhook failed"
  fi
}