SLT-1103: Frontend chart: Add support for mailpit, deprecate mailhog

.circleci/config.yml

@@ -93,6 +93,7 @@ workflows:
                 name: Add helm repositories and build local chart
                 command: |
                   helm repo add elastic https://helm.elastic.co
+                  helm repo add jouve https://jouve.github.io/charts/
                   helm repo add codecentric https://codecentric.github.io/helm-charts
                   helm dependency build ./charts/frontend
             - run:

charts/frontend/Chart.lock

@@ -5,6 +5,9 @@ dependencies:
 - name: mailhog
   repository: https://storage.googleapis.com/charts.wdr.io
   version: 5.1.0
+- name: mailpit
+  repository: https://jouve.github.io/charts/
+  version: 0.24.0
 - name: elasticsearch
   repository: file://../elasticsearch
   version: 8.5.1
@@ -23,5 +26,5 @@ dependencies:
 - name: redis
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 19.1.5
-digest: sha256:b5bdf0a7bd385f79ea727101d2fa5b02859e027fc2f1408d0e711d604132d476
-generated: "2025-03-18T10:38:55.608016594+02:00"
+digest: sha256:6d8a9d224e4f05d80001444956b411ec09e584c90894d897ebf0f4d7d275d7f9
+generated: "2025-04-08T22:49:11.202227+03:00"

charts/frontend/Chart.yaml

@@ -10,6 +10,10 @@ dependencies:
   version: 5.1.x
   repository: https://storage.googleapis.com/charts.wdr.io
   condition: mailhog.enabled
+- name: mailpit
+  version: 0.24.x
+  repository: https://jouve.github.io/charts/
+  condition: mailpit.enabled
 - name: elasticsearch
   version: 8.5.x
   # repository: https://helm.elastic.co

charts/frontend/templates/NOTES.txt

@@ -29,6 +29,16 @@ Mailhog available at:
   {{- end }}
 {{- end }}
 
+{{- if .Values.mailpit.enabled }}
+
+Mailpit available at:
+
+  http://{{- template "frontend.domain" . }}/mailpit
+  {{- range $index, $domain := .Values.exposeDomains }}
+  http://{{ $domain.hostname }}/mailpit
+  {{- end }}
+{{- end }}
+
 {{ if $.Values.shell.enabled }}
 SSH connection (limited access through VPN):
   {{ range $index, $service := .Values.services }}

charts/frontend/templates/_helpers.tpl

@@ -182,6 +182,13 @@ rsync -az /values_mounts/ /backups/current/
 - name: MAILHOG_ADDRESS
   value: "{{ .Release.Name }}-mailhog:1025"
 {{- end }}
+{{- if .Values.mailpit.enabled }}
+{{- if contains "mailpit" .Release.Name -}}
+{{- fail "Do not use 'mailpit' in release name or deployment will fail" -}}
+{{- end }}
+- name: MAILPIT_ADDRESS
+  value: "{{ .Release.Name }}-mailpit-smtp:25"
+{{- end }}
 {{- if .Values.varnish.enabled }}
 - name: VARNISH_ADMIN_HOST
   value: {{ .Release.Name }}-varnish

charts/frontend/templates/checks.yaml

@@ -1,7 +1,13 @@
+{{- if and .Values.mailhog.enabled .Values.mailpit.enabled }}
+{{- fail "Mailhog and mailpit can't be enabled at the same time as those are overlapping services. Use mailpit only as mailhog is deprecated." -}}
+{{- end }}
 {{- if index (index .Values "silta-release") "branchName" }}
 {{- if eq (index (index .Values "silta-release") "branchName") "production" }}
 {{- if .Values.mailhog.enabled }}
 {{- fail "Mailhog should not be enabled in production" -}}
 {{- end }}
+{{- if .Values.mailpit.enabled }}
+{{- fail "Mailpit should not be enabled in production" -}}
+{{- end }}
 {{- end }}
 {{- end }}

charts/frontend/templates/configmap.yaml

@@ -199,6 +199,43 @@ data:
       }
       {{- end}}
 
+      {{- if .Values.mailpit.enabled }}
+      # Redirect the legacy mailhog service to mailpit.
+      location /mailhog {
+        return 301 /mailpit/;
+      }
+      location /mailpit/ {
+                # Auth / whitelist always enabled
+        satisfy any;
+        allow 127.0.0.1;
+        {{- range .Values.nginx.noauthips }}
+        allow {{ . }};
+        {{- end }}
+        deny all;
+
+        {{- if gt (len .Values.nginx.noauthips) 1 -}}
+        # Basic auth only offered when at least one extra ip is whitelisted. Prevents using default credentials.
+        auth_basic "Restricted";
+        auth_basic_user_file /etc/nginx/.htaccess;
+        {{- end}}
+
+        # Proxy to mailpit container
+        proxy_pass http://{{ .Release.Name }}-mailpit-http:80/mailpit/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # Websock connection
+        chunked_transfer_encoding on;
+        proxy_set_header X-NginX-Proxy true;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_http_version 1.1;
+        proxy_redirect off;
+        proxy_buffering off;
+      }
+      {{- end}}
+
       # Custom configuration gets included here
       {{- if .Values.nginx.serverExtraConfig }}
       {{- tpl .Values.nginx.serverExtraConfig . | trim | nindent 6 }}

charts/frontend/templates/varnish-configmap-vcl.yaml

@@ -138,6 +138,13 @@ data:
       }
       {{- end }}
 
+      {{- if .Values.mailpit.enabled }}
+      // No varnish for mailpit
+      if (req.url ~ "^/mailpit(/|$)") {
+        return (pass);
+      }
+      {{- end }}
+
       if (req.http.Accept-Encoding) {
         if (req.url ~ "\.(jpg|png|gif|svg|tif|tiff|ico|webp|gz|tgz|bz2|tbz|mp3|ogg|swf|zip|pdf|woff|eot|ttf)(\?.*)?$") {
           # No point in compressing these

charts/frontend/test.values.yaml

@@ -29,7 +29,7 @@ shell:
 elasticsearch:
   enabled: true
 
-mailhog:
+mailpit:
   enabled: true
 
 mongodb:

charts/frontend/values.schema.json

@@ -582,6 +582,12 @@
         "enabled": { "type": "boolean" }
       }
     },
+    "mailpit": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean" }
+      }
+    },
     "mailhog": {
       "type": "object",
       "properties": {

charts/frontend/values.yaml

@@ -576,6 +576,28 @@ signalsciences:
       cpu: 200m
       memory: 300Mi
 
+# Mailpit service overrides
+# see: https://github.com/jouve/charts/blob/main/charts/mailpit/values.yaml
+mailpit:
+  enabled: false
+  extraEnvVars:
+    - name: MP_SMTP_AUTH_ACCEPT_ANY
+      value: "true"
+    - name: MP_SMTP_AUTH_ALLOW_INSECURE
+      value: "true"
+  resources:
+    requests:
+      cpu: 1m
+      memory: 10M
+    limits:
+      cpu: 50m
+      memory: 100M
+  mailpit:
+    # This is for easier proxying from Drupal's nginx
+    webroot: /mailpit
+  enableServiceLinks: false
+
+# Important! This service is deprecated and will be removed from future releases. Please use "mailpit" instead.
 # Mailhog service overrides
 # see: https://github.com/codecentric/helm-charts/blob/master/charts/mailhog/values.yaml
 mailhog:

silta/silta.yml

@@ -80,3 +80,6 @@ redis:
 
 mongodb:
   enabled: true
+
+mailpit:
+  enabled: true