{{- /*
DNS records the SME admin must publish for this mail server.

The unified-rbac console UI reads this ConfigMap to render the "Mail
domain DNS setup" pane to the SME admin (BYO-domain mode) or to display
"DNS setup complete" status (free-subdomain mode, where the chart's
PowerDNS Job already published the records to the otech zone).

Per docs/INVIOLABLE-PRINCIPLES.md #4, every value (selector, algorithm,
SPF policy, DMARC policy, DMARC rua) is operator-tunable. The actual
DKIM public key is written into RocksDB on first Stalwart boot — the
setup Job reads it back via `/api/dkim/<selector>` and the unified-rbac
service patches this ConfigMap at runtime once the value is known. The
template below ships the static records (MX, SPF, DMARC) and a
placeholder DKIM record line so the UI can render before DKIM is sealed.
*/}}
{{- if .Values.stalwart.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "bp-stalwart-tenant.dnsRecordsConfigMapName" . }}
  labels:
    {{- include "bp-stalwart-tenant.labels" . | nindent 4 }}
    catalyst.openova.io/role: dns-records-required
data:
  domain: {{ .Values.domain.primary | quote }}
  mode: {{ .Values.domain.mode | quote }}
  records.yaml: |
    # MX record — points the SME's domain at this Stalwart's mail Service.
    # The hostname is the LoadBalancer-assigned address (filled in at
    # runtime by the unified-rbac controller once the LB IP is known).
    - kind: MX
      name: {{ .Values.domain.primary | quote }}
      priority: 10
      value: {{ printf "mail.%s" .Values.domain.primary | quote }}

    # SPF — declare this Stalwart's IP as a permitted sender; close
    # everything else off per .Values.dns.spf.policy.
    - kind: TXT
      name: {{ .Values.domain.primary | quote }}
      value: {{ printf "v=spf1 mx %s" .Values.dns.spf.policy | quote }}

    # DKIM public key — selector + algorithm rendered here; the actual
    # `p=<base64>` blob is stamped in by the unified-rbac controller
    # once Stalwart has minted the key on first boot. Placeholder
    # "<DKIM-PUBLIC-KEY>" is a sentinel the controller searches for.
    - kind: TXT
      name: {{ printf "%s._domainkey.%s" .Values.dns.dkim.selector .Values.domain.primary | quote }}
      value: "v=DKIM1; k=ed25519; p=<DKIM-PUBLIC-KEY>"

    # DMARC.
    - kind: TXT
      name: {{ printf "_dmarc.%s" .Values.domain.primary | quote }}
      value: {{ printf "v=DMARC1; p=%s; rua=mailto:%s" .Values.dns.dmarc.policy (default (printf "dmarc@%s" .Values.domain.primary) .Values.dns.dmarc.rua) | quote }}
{{- end }}
