Keep the certificate served by mail.bechtold.ai on SMTP, submission, and IMAPS synchronized with the certificate renewed by Traefik on Kryptovisor.
email-assistant-mail-tls-sync.timer runs daily on drg-k8s as ax_julian.email-assistant/mailserver-tls, restarts deployment/mailserver, and verifies ports 25, 465, 587, and 993 externally.Repository source: EmailAssistant/scripts/sync-mailserver-tls.sh and EmailAssistant/operations/systemd/.
systemctl list-timers email-assistant-mail-tls-sync.timer --all --no-pager
systemctl status email-assistant-mail-tls-sync.service --no-pager
journalctl -u email-assistant-mail-tls-sync.service --since today --no-pager
The timer runs daily at 04:30 UTC with up to one hour of randomized delay and uses Persistent=true to catch up after downtime.
sudo systemctl start email-assistant-mail-tls-sync.service
systemctl status email-assistant-mail-tls-sync.service --no-pager
A successful unchanged run reports certificate is current. A renewal reports renewal synchronized and externally verified.
The job exits without changing Kubernetes if the source cannot be read, the hostname is wrong, less than 14 days of validity remain, or the key does not match. Investigate SSH access to Kryptovisor, Traefik ACME renewal logs, Kubernetes access, and the service journal. Do not manually copy private keys into repository files.
The EmailAssistant autodeploy workflow may read the private bootstrap bundle, but it applies only secret/mailserver-config. It explicitly skips secret/mailserver-tls; the synchronization service is authoritative for production TLS after bootstrap. This prevents a normal application deployment from restoring an older certificate.