From 5c3419df0261ad4e72987e0f2ab2c3ee899405ae Mon Sep 17 00:00:00 2001
From: deploy <deploy@athleticmap>
Date: Fri, 25 Sep 2026 23:46:24 +0000
Subject: [PATCH] =?UTF-8?q?fix(escolinha):=20o=20e-mail=20do=20Keycloak=20?=
 =?UTF-8?q?no=20GitOps,=20e=20a=20porta=20587=20aberta=20=E2=80=94=20'Esqu?=
 =?UTF-8?q?eci=20minha=20senha'=20nunca=20saiu=20da=20rede?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tenants/escolinha/11-sealed-smtp.yaml     | 15 ++++++++++++++
 tenants/escolinha/20-keycloak.yaml        |  8 ++++++++
 tenants/escolinha/21-netpol-smtp.yaml     | 24 +++++++++++++++++++++++
 tenants/escolinha/35-realm-import-cm.yaml | 14 +++++++++++++
 4 files changed, 61 insertions(+)
 create mode 100644 tenants/escolinha/11-sealed-smtp.yaml
 create mode 100644 tenants/escolinha/21-netpol-smtp.yaml

diff --git a/tenants/escolinha/11-sealed-smtp.yaml b/tenants/escolinha/11-sealed-smtp.yaml
new file mode 100644
index 0000000..c326bad
--- /dev/null
+++ b/tenants/escolinha/11-sealed-smtp.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: smtp-credentials
+  namespace: escolinha-prod
+spec:
+  encryptedData:
+    senha: AgBiNmLGJCAnMAVoTOeWA8OXxdboS7e2EHlzmcXZ3Ecr9zg0p6/0ukeUcIcS4/f8XoFWNmo2zGQgif12j7c7vPnANpI+Nbb+TLhkStO4VvFY8Tr5ORz8O7VcbwAHGagtB1mffBjwAV8RkUL3LjvE8DY5qKKdWynEZzQbjeRpuExZrh+FN68Svl+5shfliriBYCY24FvBaYcRKL1XLxplIVpN/w1U2DU8J7Ta2O+CCbsDnLNXFdjDVh6ZLUa08QZwoPAvXCCYgcnBJ3oqRBWjOBgTsIdBMNmiCbIFDVBfmfi99qYSrOFf4WDRd2r92pam81OKwemyubweQvOvWGnBWFkvsitgDwF6/TiXe9TU1RrZuBN5d8FDnFh6eM+A4NeIfaCkE2xOzqe8DRhEg12RoddEq1BCvOKpIUZUQ1fqToTTTnJLMp8y3XAdRk5HFp6A/TffUWon01Dy5RKSW+/94qcTMEJHxv/YCXVNzL0seQiH60RENtCGbz0HZeDObGPgtvX4E2h7iaKKFZG0IEslK4cScG34oH3C4ypvP9Wgtptr8oWWKBvvAUYXempVdaVr72o9htM0pLLle/JSGxcGdcibX5HlAX3KTfdEonhwJNEWNtiFkcWd9vBT5NkuwROtg9xB2lCkZ8AyszEhqEkMhQ5JNTfpDXocq4WVT9UgZWZePhnP6ePIaIi8tgxuAFH5FhVgaRWe736ZLzKz6+ZtfBGOzY5q
+  template:
+    metadata:
+      creationTimestamp: null
+      name: smtp-credentials
+      namespace: escolinha-prod
diff --git a/tenants/escolinha/20-keycloak.yaml b/tenants/escolinha/20-keycloak.yaml
index e551c36..d295e64 100644
--- a/tenants/escolinha/20-keycloak.yaml
+++ b/tenants/escolinha/20-keycloak.yaml
@@ -38,6 +38,14 @@ spec:
                 secretKeyRef:
                   name: keycloak-admin
                   key: password
+            # A senha do SMTP para o IMPORT do realm (`${SMTP_SENHA}` no
+            # 35-realm-import-cm.yaml). Opcional: sem o Secret, o Keycloak sobe.
+            - name: SMTP_SENHA
+              valueFrom:
+                secretKeyRef:
+                  name: smtp-credentials
+                  key: senha
+                  optional: true
             - name: KC_HEALTH_ENABLED
               value: "true"
             - name: KC_HTTP_ENABLED
diff --git a/tenants/escolinha/21-netpol-smtp.yaml b/tenants/escolinha/21-netpol-smtp.yaml
new file mode 100644
index 0000000..2b981e0
--- /dev/null
+++ b/tenants/escolinha/21-netpol-smtp.yaml
@@ -0,0 +1,24 @@
+# =============================================================================
+# A saida do Keycloak do escolinha para o SMTP (587).
+#
+# Sem ela, a `deny-cross-tenant` fecha a saida e "Esqueci minha senha" nunca
+# mandou e-mail — medido em 2026-09-25: o pod do plataforma-prod SAI para
+# smtp.hostinger.com:587, o do escolinha-prod era BLOQUEADO. Mesma regra do
+# `tenants/plataforma/20-netpol-smtp.yaml`, so para o Keycloak.
+# =============================================================================
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: egress-smtp
+  namespace: escolinha-prod
+spec:
+  podSelector:
+    matchLabels: { app: keycloak }
+  policyTypes: [Egress]
+  egress:
+    - ports:
+        - { protocol: TCP, port: 587 }
+      to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
diff --git a/tenants/escolinha/35-realm-import-cm.yaml b/tenants/escolinha/35-realm-import-cm.yaml
index a2bffbb..373ef85 100644
--- a/tenants/escolinha/35-realm-import-cm.yaml
+++ b/tenants/escolinha/35-realm-import-cm.yaml
@@ -9,6 +9,20 @@ data:
       "loginWithEmailAllowed": true,
       "rememberMe": true,
       "resetPasswordAllowed": true,
+      "emailTheme": "athleticmap-v2",
+      "smtpServer": {
+        "host": "smtp.hostinger.com",
+        "port": "587",
+        "starttls": "true",
+        "ssl": "false",
+        "auth": "true",
+        "user": "nao-responda@athleticmap.com",
+        "password": "${SMTP_SENHA}",
+        "from": "nao-responda@athleticmap.com",
+        "fromDisplayName": "Athletic Map",
+        "replyTo": "contato@athleticmap.com",
+        "replyToDisplayName": "Athletic Map"
+      },
       "roles": {
         "realm": [
           { "name": "admin" },