From 636b926c880f0f07a3dbf8083bea3549d15ce1e2 Mon Sep 17 00:00:00 2001
From: Thomas Kaltenbrunner <tom@kaltenbrunner.it>
Date: Fri, 13 Jun 2025 15:54:09 +0200
Subject: [PATCH] fix(open-xchange): Add external secrets for Dovecot and
 Postfix

---
 .../values-dovecot-enterprise.yaml.gotmpl     | 15 +++++
 .../open-xchange/values-dovecot.yaml.gotmpl   | 12 ++++
 .../values-postfix.yaml.gotmpl                |  6 ++
 .../default/external_secrets.yaml.gotmpl      | 56 +++++++++++++++++++
 4 files changed, 89 insertions(+)
 create mode 100644 helmfile/environments/default/external_secrets.yaml.gotmpl

diff --git a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
index 42a01991..ced7cd20 100644
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -24,6 +24,9 @@ dovecot:
     username: {{ .Values.databases.dovecotDictmap.username | quote }}
     password:
       value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.cassandra.dovecotDictmapUser.name | quote }}
+        key: {{ .Values.externalSecrets.cassandra.dovecotDictmapUser.key | quote }}
     keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
   sharedMailboxes:
     enabled: true
@@ -32,16 +35,28 @@ dovecot:
     username: {{ .Values.databases.dovecotACL.username | quote }}
     password:
       value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.cassandra.dovecotACLUser.name | quote }}
+        key: {{ .Values.externalSecrets.cassandra.dovecotACLUser.key | quote }}
     keyspace: {{ .Values.databases.dovecotACL.name | quote }}
   objectStorage:
     bucket: {{ .Values.objectstores.dovecot.bucket | quote }}
     encryption:
       privateKey:
         value: {{ requiredEnv "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
+        existingSecret:
+          name: {{ .Values.externalSecrets.dovecot.objectStorage.encryption.privateKey.name | quote }}
+          key: {{ .Values.externalSecrets.dovecot.objectStorage.encryption.privateKey.key | quote }}
       publicKey:
         value: {{ requiredEnv "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
+        existingSecret:
+          name: {{ .Values.externalSecrets.dovecot.objectStorage.encryption.publicKey.name | quote }}
+          key: {{ .Values.externalSecrets.dovecot.objectStorage.encryption.publicKey.key | quote }}
     fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
     username: {{ .Values.objectstores.dovecot.username | quote }}
     password:
       value: {{ .Values.objectstores.dovecot.secretKey | default .Values.secrets.minio.dovecotUser | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.minio.dovecotUser.name | quote }}
+        key: {{ .Values.externalSecrets.minio.dovecotUser.key | quote }}
 ...
diff --git a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
index 2fc7d82e..a6b0d38b 100644
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -25,10 +25,16 @@ dovecot:
   defaultMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
   password:
     value: {{ .Values.secrets.dovecot.doveadm | quote }}
+    existingSecret:
+      name: {{ .Values.externalSecrets.dovecot.doveadm.name | quote }}
+      key: {{ .Values.externalSecrets.dovecot.doveadm.key | quote }}
   migration:
     enabled: {{ .Values.functional.migration.oxAppSuite.enabled }}
     masterPassword:
       value: {{ .Values.secrets.oxAppSuite.migrationsMasterPassword | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.oxAppSuite.migrationsMasterPassword.name | quote }}
+        key: {{ .Values.externalSecrets.oxAppSuite.migrationsMasterPassword.key | quote }}
   ldap:
     enabled: true
     host: {{ .Values.ldap.host | quote }}
@@ -37,12 +43,18 @@ dovecot:
     dn: "uid=ldapsearch_dovecot,cn=users,{{ .Values.ldap.baseDn }}"
     password:
       value: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.nubus.ldapSearch.dovecot.name | quote }}
+        key: {{ .Values.externalSecrets.nubus.ldapSearch.dovecot.key | quote }}
   oidc:
     enabled: true
     clientID:
       value: "opendesk-dovecot"
     clientSecret:
       value: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.keycloak.clientSecret.dovecot.name | quote }}
+        key: {{ .Values.externalSecrets.keycloak.clientSecret.dovecot.key | quote }}
     introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
     introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
     usernameAttribute: "opendesk_username"
diff --git a/helmfile/apps/services-external/values-postfix.yaml.gotmpl b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
index 4fc41c1b..01ecca13 100644
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -91,8 +91,14 @@ postfix:
     enabled: true
     username:
       value: "opendesk-system"
+      existingSecret:
+        name: {{ .Values.externalSecrets.postfix.opendeskSystemUsername.name | quote }}
+        key: {{ .Values.externalSecrets.postfix.opendeskSystemUsername.key | quote }}
     password:
       value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+      existingSecret:
+        name: {{ .Values.externalSecrets.postfix.opendeskSystemPassword.name | quote }}
+        key: {{ .Values.externalSecrets.postfix.opendeskSystemPassword.key | quote }}
 
   {{- if .Values.antivirus.milter.host }}
   smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
diff --git a/helmfile/environments/default/external_secrets.yaml.gotmpl b/helmfile/environments/default/external_secrets.yaml.gotmpl
new file mode 100644
index 00000000..d86cd89d
--- /dev/null
+++ b/helmfile/environments/default/external_secrets.yaml.gotmpl
@@ -0,0 +1,56 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+# The variables set in this file are required to upgrade components to their "Enterprise" product variant.
+---
+externalSecrets:
+  cassandra:
+    dovecotACLUser:
+      name: ~
+      key: ~
+    dovecotDictmapUser:
+      name: ~
+      key: ~
+
+  dovecot:
+    doveadm:
+      name: ~
+      key: ~
+    objectStorage:
+      encryption:
+        privateKey:
+          name: ~
+          key: ~
+        publicKey:
+          name: ~
+          key: ~
+
+  keycloak:
+    clientSecret:
+      dovecot:
+        name: ~
+        key: ~
+
+  minio:
+    dovecotUser:
+      name: ~
+      key: ~
+
+  nubus:
+    ldapSearch:
+      dovecot:
+        name: ~
+        key: ~
+
+  oxAppSuite:
+    migrationsMasterPassword:
+      name: ~
+      key: ~
+
+  postfix:
+    opendeskSystemUsername:
+      name: ~
+      key: ~
+    opendeskSystemPassword:
+      name: ~
+      key: ~
+...