fix(escolinha): o e-mail do Keycloak no GitOps, e a porta 587 aberta — 'Esqueci minha senha' nunca saiu da rede

tenants/escolinha/11-sealed-smtp.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: smtp-credentials
+  namespace: escolinha-prod
+spec:
+  encryptedData:
+    senha: AgBiNmLGJCAnMAVoTOeWA8OXxdboS7e2EHlzmcXZ3Ecr9zg0p6/0ukeUcIcS4/f8XoFWNmo2zGQgif12j7c7vPnANpI+Nbb+TLhkStO4VvFY8Tr5ORz8O7VcbwAHGagtB1mffBjwAV8RkUL3LjvE8DY5qKKdWynEZzQbjeRpuExZrh+FN68Svl+5shfliriBYCY24FvBaYcRKL1XLxplIVpN/w1U2DU8J7Ta2O+CCbsDnLNXFdjDVh6ZLUa08QZwoPAvXCCYgcnBJ3oqRBWjOBgTsIdBMNmiCbIFDVBfmfi99qYSrOFf4WDRd2r92pam81OKwemyubweQvOvWGnBWFkvsitgDwF6/TiXe9TU1RrZuBN5d8FDnFh6eM+A4NeIfaCkE2xOzqe8DRhEg12RoddEq1BCvOKpIUZUQ1fqToTTTnJLMp8y3XAdRk5HFp6A/TffUWon01Dy5RKSW+/94qcTMEJHxv/YCXVNzL0seQiH60RENtCGbz0HZeDObGPgtvX4E2h7iaKKFZG0IEslK4cScG34oH3C4ypvP9Wgtptr8oWWKBvvAUYXempVdaVr72o9htM0pLLle/JSGxcGdcibX5HlAX3KTfdEonhwJNEWNtiFkcWd9vBT5NkuwROtg9xB2lCkZ8AyszEhqEkMhQ5JNTfpDXocq4WVT9UgZWZePhnP6ePIaIi8tgxuAFH5FhVgaRWe736ZLzKz6+ZtfBGOzY5q
+  template:
+    metadata:
+      creationTimestamp: null
+      name: smtp-credentials
+      namespace: escolinha-prod

tenants/escolinha/20-keycloak.yaml

@@ -38,6 +38,14 @@ spec:
                 secretKeyRef:
                   name: keycloak-admin
                   key: password
+            # A senha do SMTP para o IMPORT do realm (`${SMTP_SENHA}` no
+            # 35-realm-import-cm.yaml). Opcional: sem o Secret, o Keycloak sobe.
+            - name: SMTP_SENHA
+              valueFrom:
+                secretKeyRef:
+                  name: smtp-credentials
+                  key: senha
+                  optional: true
             - name: KC_HEALTH_ENABLED
               value: "true"
             - name: KC_HTTP_ENABLED

tenants/escolinha/21-netpol-smtp.yaml

@@ -0,0 +1,24 @@
+# =============================================================================
+# A saida do Keycloak do escolinha para o SMTP (587).
+#
+# Sem ela, a `deny-cross-tenant` fecha a saida e "Esqueci minha senha" nunca
+# mandou e-mail — medido em 2026-09-25: o pod do plataforma-prod SAI para
+# smtp.hostinger.com:587, o do escolinha-prod era BLOQUEADO. Mesma regra do
+# `tenants/plataforma/20-netpol-smtp.yaml`, so para o Keycloak.
+# =============================================================================
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-smtp
+  namespace: escolinha-prod
+spec:
+  podSelector:
+    matchLabels: { app: keycloak }
+  policyTypes: [Egress]
+  egress:
+    - ports:
+        - { protocol: TCP, port: 587 }
+      to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]

tenants/escolinha/35-realm-import-cm.yaml

@@ -9,6 +9,20 @@ data:
       "loginWithEmailAllowed": true,
       "rememberMe": true,
       "resetPasswordAllowed": true,
+      "emailTheme": "athleticmap-v2",
+      "smtpServer": {
+        "host": "smtp.hostinger.com",
+        "port": "587",
+        "starttls": "true",
+        "ssl": "false",
+        "auth": "true",
+        "user": "nao-responda@athleticmap.com",
+        "password": "${SMTP_SENHA}",
+        "from": "nao-responda@athleticmap.com",
+        "fromDisplayName": "Athletic Map",
+        "replyTo": "contato@athleticmap.com",
+        "replyToDisplayName": "Athletic Map"
+      },
       "roles": {
         "realm": [
           { "name": "admin" },