Stalwart v0.16 keeps all config in Postgres, reachable via the x: JMAP
management objects. This script writes everything the setup wizard would —
stores (Garage S3 + Redis), listeners (with per-listener PROXY trust on the
mail ports), the primary domain (+auto DKIM), admin + relay/catch-all
accounts, TLS/DNS, and optional Authelia SSO — straight into Postgres over
HTTP Basic. Idempotent (query-before-create), so re-runs are safe.
Tiers (the DNS/TLS automation boundary):
* Tier 1 (default, trustless): manual DNS, prints the records to publish.
* Tier 2 (STALWART_DNS_API_KEY set): Stalwart auto-publishes DNS + ACME
DNS-01 via the provider (Spaceship wired).
Authelia SSO is opt-in (STALWART_SSO_ENABLE); admin + relay keep password
auth as break-glass so enabling SSO can never lock you out.
.env.example: documents the tiered DNS + SSO surface (core reuses existing
fields; only tier-2 needs DNS provider keys). README: quickstart step + layout.
Validated: bash -n; all JMAP payloads build valid JSON; read/idempotency
paths against a live instance. NOT yet validated on a fresh boot (fallback
admin -> create -> re-auth) or the OIDC login round-trip — verify on a
throwaway deploy before relying on those paths.
Shaped to drop into federatedSocial bootstrap.sh as cmd_provision_stalwart.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
