feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates

- Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS
  proxy, worker, DKIM config, and theme customization
- Add Collabora deployment for document collaboration
- Add Drive frontend nginx config and values
- Add buildkitd namespace for in-cluster container builds
- Add SeaweedFS remote sync and additional S3 buckets
- Update vault secrets across namespaces (devtools, lasuite, media,
  monitoring, ory, storage) with expanded credential management
- Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus
  remote write and additional scrape configs
- Update local/production overlays with resource patches
- Remove stale login-ui resource patch from production overlay

overlays/local/kustomization.yaml

@@ -12,6 +12,7 @@ kind: Kustomization
 # replace DOMAIN_SUFFIX with <LIMA_IP>.sslip.io before kubectl apply.
 
 resources:
+  - ../../base/build
   - ../../base/ingress
   - ../../base/ory
   - ../../base/data
@@ -34,6 +35,7 @@ images:
     newName: src.DOMAIN_SUFFIX/studio/people-backend
   - name: lasuite/people-frontend
     newName: src.DOMAIN_SUFFIX/studio/people-frontend
+    newTag: latest
 
   # amd64-only impress (Docs) images — same mirror pattern.
   - name: lasuite/impress-backend

overlays/local/values-resources.yaml

@@ -180,78 +180,36 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: docs-celery-worker
+  name: collabora
   namespace: lasuite
 spec:
-  replicas: 1
   template:
     spec:
       containers:
-        - name: docs
-          env:
-            # Celery workers: 2 concurrent workers fits within local memory budget.
-            - name: CELERY_WORKER_CONCURRENCY
-              value: "2"
-          resources:
-            limits:
-              memory: 384Mi
-            requests:
-              memory: 128Mi
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docs-backend
-  namespace: lasuite
-spec:
-  replicas: 1
-  template:
-    spec:
-      containers:
-        - name: docs
-          env:
-            # 2 uvicorn workers instead of the default 4 to stay within local memory budget.
-            # Each worker loads the full Django+impress app (~150 MB), so 4 workers
-            # pushed peak RSS above 384 Mi and triggered OOMKill at startup.
-            - name: WEB_CONCURRENCY
-              value: "2"
+        - name: collabora
           resources:
             limits:
               memory: 512Mi
+              cpu: 500m
             requests:
-              memory: 192Mi
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docs-frontend
-  namespace: lasuite
-spec:
-  replicas: 1
-  template:
-    spec:
-      containers:
-        - name: docs
-          resources:
-            limits:
-              memory: 128Mi
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docs-y-provider
-  namespace: lasuite
-spec:
-  replicas: 1
-  template:
-    spec:
-      containers:
-        - name: docs
-          resources:
-            limits:
               memory: 256Mi
+              cpu: 50m
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: buildkitd
+  namespace: build
+spec:
+  template:
+    spec:
+      containers:
+        - name: buildkitd
+          resources:
             requests:
-              memory: 64Mi
+              cpu: "250m"
+              memory: "256Mi"
+            limits:
+              cpu: "2"
+              memory: "2Gi"

overlays/production/patch-mta-in-hostport.yaml

@@ -0,0 +1,15 @@
+# Bind MTA-in port 25 to the host so inbound email reaches the pod directly.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: messages-mta-in
+  namespace: lasuite
+spec:
+  template:
+    spec:
+      containers:
+        - name: messages-mta-in
+          ports:
+            - containerPort: 25
+              hostPort: 25
+              protocol: TCP

overlays/production/postgres-scheduled-backup.yaml

@@ -4,8 +4,8 @@ metadata:
   name: postgres-daily
   namespace: data
 spec:
-  # Daily at 02:00 UTC
-  schedule: "0 2 * * *"
+  # Daily at 02:00 UTC (CNPG uses 6-field cron: second minute hour dom month dow)
+  schedule: "0 0 2 * * *"
   backupOwnerReference: self
   cluster:
     name: postgres

overlays/production/values-resources.yaml

@@ -149,24 +149,6 @@ spec:
             limits:
               memory: 128Mi
 
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: login-ui
-  namespace: ory
-spec:
-  template:
-    spec:
-      containers:
-        - name: login-ui
-          resources:
-            requests:
-              memory: 128Mi
-              cpu: 50m
-            limits:
-              memory: 384Mi
-
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -215,79 +197,17 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: docs-celery-worker
+  name: collabora
   namespace: lasuite
 spec:
-  replicas: 2
   template:
     spec:
       containers:
-        - name: docs
-          env:
-            - name: CELERY_WORKER_CONCURRENCY
-              value: "4"
+        - name: collabora
           resources:
             requests:
               memory: 512Mi
-              cpu: 250m
-            limits:
-              memory: 1Gi
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docs-backend
-  namespace: lasuite
-spec:
-  replicas: 2
-  template:
-    spec:
-      containers:
-        - name: docs
-          env:
-            - name: WEB_CONCURRENCY
-              value: "4"
-          resources:
-            requests:
-              memory: 512Mi
-              cpu: 250m
-            limits:
-              memory: 1Gi
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docs-frontend
-  namespace: lasuite
-spec:
-  replicas: 2
-  template:
-    spec:
-      containers:
-        - name: docs
-          resources:
-            requests:
-              memory: 64Mi
-            limits:
-              memory: 256Mi
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: docs-y-provider
-  namespace: lasuite
-spec:
-  replicas: 1
-  template:
-    spec:
-      containers:
-        - name: docs
-          resources:
-            requests:
-              memory: 256Mi
               cpu: 100m
             limits:
               memory: 1Gi
+              cpu: 1000m