mix
8ce050ef7f
Initial feature-complete implementation of the v1.0 specification (phases 0-11 of `docs/implementation-plan.md`). Added: - Panel (Go, single static binary) with SQLite persistence, one-time - Domain management with per-domain DKIM (RSA-2048, generated in pure Go) and - Application (sender identity) management: SASL credentials via `sasldb2`, - Full Postfix relay config generated from env at container start: SMTPS 465, - Journal milter (pure Go, `go-milter`) recording every send to `send_log`; … (6 more in CHANGELOG) Full detail: CHANGELOG.md (0.1.0).
31 lines
1.4 KiB
Plaintext
31 lines
1.4 KiB
Plaintext
# OpenDKIM — per-domain signing (spec 6).
|
|
#
|
|
# Signing is strictly per-domain: each sending domain has its own key pair and
|
|
# selector. The panel generates keys under /data/opendkim/keys/<domain>/ and
|
|
# keeps KeyTable/SigningTable in sync as domains are added or removed, then asks
|
|
# supervisord to send this process SIGUSR1 to reload the tables (spec 6.2, 6.5).
|
|
#
|
|
# Both table files are created (empty) by entrypoint.sh before OpenDKIM starts,
|
|
# so the daemon comes up cleanly on a fresh /data with no domains yet and simply
|
|
# signs nothing until the first domain is added.
|
|
|
|
Syslog no
|
|
UMask 007
|
|
Mode s
|
|
|
|
# SigningTable uses refile: so the "*@example.com" left-hand patterns match any
|
|
# local-part for a domain; KeyTable maps each domain to its key and selector.
|
|
KeyTable /data/opendkim/KeyTable
|
|
SigningTable refile:/data/opendkim/SigningTable
|
|
|
|
# The private keys are owned by `panel` and read by `opendkim` through the shared
|
|
# `selfpost` group, so they are deliberately group-readable (mode 0640). That is
|
|
# safe on this single-tenant, private bind mount, but it trips OpenDKIM's default
|
|
# key-safety check, so the check is disabled here by design.
|
|
RequireSafeKeys no
|
|
|
|
Socket local:/run/opendkim/opendkim.sock
|
|
PidFile /run/opendkim/opendkim.pid
|
|
UserID opendkim
|
|
Background no
|