apiVersion: v2
name: stalwart
description: A Helm chart to deploy a cluster-capable Stalwart mail server (SMTP, IMAP, JMAP, ManageSieve) on Kubernetes
icon: https://avatars.githubusercontent.com/u/76623657

type: application

# appVersion is the exact image tag, and the "v" is part of it - so it is part
# of appVersion and of the "+up" suffix. Precedent: calibre-web-automated
# (+upv4.0.6), matrix-synapse (+upv1.159.0), ytdlp-web-player (+upv1.2.0).
#
# The glibc image, not "-alpine". Both flavours are published for every release
# from the same source and carry the same uid/gid 2000 and the same two volumes;
# the choice is a deployment decision, and keeping it out of the tag is what
# lets renovate.json5 anchor the version with a plain three-part regex instead
# of maintaining a compatibility suffix. The moving tags "latest", "v0.16" and
# their -alpine twins are excluded by that same anchor: measured on 2026-10-02
# all three of latest / v0.16 / v0.16.24 resolved to one digest pushed seconds
# apart, so either floating name would change the running image with no commit
# in this repository and nothing to report it.
version: 1.0.0+upv0.16.24
appVersion: "v0.16.24"

maintainers:
  - name: jklein

# The second chart in this repo with a dependency (after ytdlp-web-player).
# README, "Chart dependencies", holds the bar it has to clear and the price;
# both are restated here because the price is paid by whoever reads this file
# next, not by whoever added the line.
#
# WHY ONE HERE. Stalwart's in-memory store is not a cache that can be dropped:
# from v0.16 it also carries the cluster coordinator ("the Default variant
# reuses the Redis connection already configured on the in-memory store"), so a
# multi-node install does not work without it. Redis/Valkey is admissible as
# the in-memory store ONLY - never as the data or blob store. Offering it inside
# the chart means the wiring (host, port, egress rule) is in one place instead
# of split across two releases that have to agree.
#
# WHY IT IS OFF BY DEFAULT, and why that is more than convention here: most
# installations already run a Valkey, and this repo publishes a valkey chart of
# its own that is the better choice when one application owns the instance.
# Point externalServices.valkey at it and this dependency renders nothing.
#
# UPSTREAM'S CHART IS CONSUMED AS IT COMES (guideline 14.2). Two of its defaults
# fall short of this repo's conventions and are deliberately NOT patched here;
# they are documented in our values.yaml under "valkey:" instead, where the
# values-level fix stays available to whoever installs the chart.
dependencies:
  - name: valkey
    # KEEP THIS VERSION MOVING - it is the only path a Valkey update has.
    #
    # A subchart is invisible to everything downstream that watches Helm release
    # versions: what this file declares is baked into our packaged .tgz, and
    # Fleet only ever sees the version of "stalwart". So a new valkey chart - a
    # security fix included - reaches a cluster ONLY when this line is raised
    # and a new stalwart version is published. Nothing reports the gap.
    #
    # Renovate's BUILT-IN helmv3 manager reads this block and opens the PR (no
    # customManagers entry exists or would help - repository and version sit
    # together in one file, which is the case that manager is for), and
    # ci/renovate-bump-chart.sh bumps this chart's patch version, which is what
    # actually ships it. That chain is the whole safety net; switched off, this
    # line needs a human on a calendar instead.
    #
    # Independent of appVersion: raising it is a patch or minor bump of this
    # chart and is never tied to the Stalwart image.
    version: "0.12.0"
    # The Valkey project's own chart, so upstream owns the schema - not a
    # re-packaging. Note the repository is the plain HTTP index, not OCI.
    repository: "https://valkey.io/valkey-helm"
    # Off by default, so a plain install renders none of its objects. Helm
    # splits a condition on dots only; this name carries no dash, so unlike
    # ytdlp-web-player's oauth2-proxy it is also reachable as .Values.valkey.*
    # inside templates without index.
    condition: valkey.enabled