mixandClaude Opus 5.5
dab7715e80
test / test (push) Canceled after 0s
M17: the supervisord control socket is root:supervisor 0770, a group whose one member is the panel; OpenDKIM and Postfix keep `selfpost` for the files under /data and no longer reach the socket. L30, read in OpenDKIM 2.11.0~beta2's source first: it logs through syslog(3) only and has no Logfile option, and nothing in the container served /dev/log. internal/syslogrelay (the panel binary with -syslog-relay=/run/syslog/log, program syslog-relay before OpenDKIM, /dev/log a link to its socket) passes the datagrams to stdout, error and worse marked. opendkim.conf: Syslog yes, Canonicalization relaxed/simple, OversignHeaders From (RFC 6376 § 3.4, § 8.15). e2e: OpenDKIM's start line reaches the container log; every program RUNNING; DKIM verifies. Tested on the test server: go vet + go test of 26 packages, make e2e (all pass, 626 s) on this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
61 lines
3.3 KiB
Plaintext
61 lines
3.3 KiB
Plaintext
# OpenDKIM — per-domain signing.
|
|
#
|
|
# Signing is strictly per-domain: each sending domain has its own key pair and
|
|
# selector. The panel generates keys under /data/opendkim/keys/<domain>/ and
|
|
# keeps KeyTable/SigningTable in sync as domains are added or removed, then asks
|
|
# supervisord to send this process SIGUSR1 to reload the tables. (OpenDKIM
|
|
# 2.11.0~beta2, opendkim/opendkim.8.in: on SIGUSR1 the configuration file is
|
|
# re-read; opendkim/opendkim.c, dkimf_config_reload() -> dkimf_config_load(),
|
|
# opens SigningTable and KeyTable again with dkimf_db_open().)
|
|
#
|
|
# Both table files are created (empty) by entrypoint.sh before OpenDKIM starts,
|
|
# so the daemon comes up cleanly on a fresh /data with no domains yet and simply
|
|
# signs nothing until the first domain is added. (opendkim/opendkim-db.c,
|
|
# dkimf_db_open(): a file or refile table is read line by line; an empty file
|
|
# is an empty table, not an error.)
|
|
|
|
# Logged through syslog(3) to /dev/log, which the syslog-relay program passes
|
|
# to the container's log (build/supervisord.conf; audit 2026-10-12, L30). The
|
|
# errors are what is wanted - a key that cannot be read, a table that cannot
|
|
# be opened; a line per signed message (SyslogSuccess) is not.
|
|
Syslog yes
|
|
UMask 007
|
|
Mode s
|
|
|
|
# relaxed/simple: the header fields relaxed, so a relay that refolds or
|
|
# respaces one does not break the signature; the body simple, as signed
|
|
# (opendkim.conf.5.in, Canonicalization: header/body, the default
|
|
# simple/simple; RFC 6376 § 3.4). OversignHeaders From lists From: in h= once
|
|
# more than it is present, so a From: added on the way fails the signature
|
|
# instead of being shown above the signed one (opendkim.conf.5.in,
|
|
# OversignHeaders; RFC 6376 § 8.15) - the replay 2.4.0's sender check is
|
|
# about.
|
|
Canonicalization relaxed/simple
|
|
OversignHeaders From
|
|
|
|
# SigningTable uses refile: so the "*@example.com" left-hand patterns match any
|
|
# local-part for a domain; KeyTable maps each domain to its key and selector.
|
|
# (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are
|
|
# wildcard patterns matched against the From: address, in file order.)
|
|
KeyTable /data/opendkim/KeyTable
|
|
SigningTable refile:/data/opendkim/SigningTable
|
|
|
|
# The private keys are owned by `panel` and read by `opendkim` through the shared
|
|
# `selfpost` group, so they are deliberately group-readable (mode 0640). That is
|
|
# safe on this single-tenant, private bind mount, but it trips OpenDKIM's default
|
|
# key-safety check, so the check is disabled here by design. (opendkim/
|
|
# opendkim.c, dkimf_checkfsnode(): a key file must be owned by root or by the
|
|
# executing uid, and a group-readable one must be in a group of no other user -
|
|
# `panel` owns these and `selfpost` has three members.)
|
|
RequireSafeKeys no
|
|
|
|
# UMask 007 above leaves the socket group read-write (opendkim.conf.5.in,
|
|
# UMask: it applies to the socket); its group is selfpost by the setgid
|
|
# /run/opendkim (build/entrypoint.sh). UserID: the process takes the user's
|
|
# groups (opendkim.conf.5.in, UserID); with Background no and -f
|
|
# (build/supervisord.conf, opendkim.8.in) the supervised pid is OpenDKIM itself.
|
|
Socket local:/run/opendkim/opendkim.sock
|
|
PidFile /run/opendkim/opendkim.pid
|
|
UserID opendkim
|
|
Background no
|