inbound-antispam-panel: the filter reads its signing key for every message

The routine kept the key after its first read. SelfPost makes a new key
when the file is lost or damaged, or a backup brings back another, and
rspamd would then have gone on signing with the old one - every verdict
unrecorded - until someone restarted the sidecar. The file is one short
line; reading it per message costs nothing worth keeping a copy for.

The guide says what never needs doing: nothing of rspamd's is cleared
after a change of the lists or the key; a restart is for a change of
its own configuration only.

Prompted by the owner's question whether rspamd's cache needs clearing
(2026-10-12).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -96,8 +96,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   key SelfPost creates in `data/antispam/filter.key` - and the inbound log
   shows a verdict only next to a signature that fits. Nothing to configure,
   but the sidecar needs the new `antispam/rspamd/milter_headers.conf` and a
-  restart after SelfPost's first start; until then accepted mail is logged
-  as *selfpost*, with no verdict.
+  restart to read it; until then accepted mail is logged as *selfpost*, with
+  no verdict.
 - A full backup carries the inbound log, the filter lists and their files
   under `data/antispam/`. It does not carry the `antispam/` directory with the
   compose fragment and the rspamd configuration - copy that from

deploy/antispam/rspamd/milter_headers.conf

@@ -21,15 +21,17 @@ use = ["x-spamd-result", "x-rspamd-action", "selfpost-signature"];
 
 custom {
   selfpost-signature = <<EOD
-local key
 return function(task, common_meta)
   local remove = { ['X-SelfPost-Filter'] = 0 }
-  if not key then
-    local f = io.open('/etc/rspamd/selfpost/filter.key', 'r')
-    if f then
-      key = f:read('*l')
-      f:close()
-    end
+  -- The key is read for every message and kept nowhere: SelfPost may make a
+  -- new one (the file was lost, a backup was restored), and a key remembered
+  -- here would go on signing what SelfPost no longer accepts until someone
+  -- restarted this container. The file is one short line.
+  local key
+  local f = io.open('/etc/rspamd/selfpost/filter.key', 'r')
+  if f then
+    key = f:read('*l')
+    f:close()
   end
   local qid = task:get_queue_id()
   if not key or key == '' or not qid or qid == '' then

docs/guide.md

@@ -868,8 +868,11 @@ recompute. The key is `data/antispam/filter.key`: SelfPost creates it on its
 first start with the inbound relay on, and the sidecar reads it from the
 directory it already mounts - there is nothing to configure. If Inbound › Log
 shows *selfpost* for mail the filter did judge, the sidecar is running without
-this file or started before the key existed: copy `antispam/rspamd/` again and
-restart the sidecar.
+this file: copy `antispam/rspamd/` again and restart the sidecar. Nothing of
+rspamd's needs clearing, then or after a change of the lists or of the key: it
+rereads the list files by itself and reads the key anew for every message. A
+restart is needed only for a change of its own configuration - the files of
+`antispam/rspamd/`.
 
 The same directory holds
 [multimap.conf](../deploy/antispam/rspamd/multimap.conf), the rules for the