mixandClaude Opus 5.5
599149bf83
Comments only, no behaviour changed. Each main.cf/master.cf parameter the
build sets, the wrapper's and the reload hook's reliance on Postfix 3.7.11
(postfix-script, master.5, postconf.5, cleanup_init.c, smtpd_peer.c,
README_FILES), supervisor 4.2.5 (process.py, options.py, events.rst),
logrotate 3.21.0, OpenDKIM's config, Cyrus SASL's sasldb, rspamd 3.11.1
(milter_headers.lua, multimap, the map watcher), Docker Compose, CoreDNS
and certbot now say where that is written. Measurements already there stay
measurements ("date not recorded" where none was); hand-composed fixtures
say so.
Contradictions left for their own commits: C-P31 cleanup's size limit,
C-P42 master outside supervisor's signal, C-V5/V6 startsecs, C-V10,
C-S3/Q3 sasldb written in place, C-Q4/A1 certbot's symlinks, C-R7 rspamd
skips local clients but the signature routine does not, C-P8, C-R4, C-R12,
C-M7, C-E2, C-K8/K9, C-D1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
2.4 KiB
Plaintext
46 lines
2.4 KiB
Plaintext
# OpenDKIM — per-domain signing.
|
|
#
|
|
# Signing is strictly per-domain: each sending domain has its own key pair and
|
|
# selector. The panel generates keys under /data/opendkim/keys/<domain>/ and
|
|
# keeps KeyTable/SigningTable in sync as domains are added or removed, then asks
|
|
# supervisord to send this process SIGUSR1 to reload the tables. (OpenDKIM
|
|
# 2.11.0~beta2, opendkim/opendkim.8.in: on SIGUSR1 the configuration file is
|
|
# re-read; opendkim/opendkim.c, dkimf_config_reload() -> dkimf_config_load(),
|
|
# opens SigningTable and KeyTable again with dkimf_db_open().)
|
|
#
|
|
# Both table files are created (empty) by entrypoint.sh before OpenDKIM starts,
|
|
# so the daemon comes up cleanly on a fresh /data with no domains yet and simply
|
|
# signs nothing until the first domain is added. (opendkim/opendkim-db.c,
|
|
# dkimf_db_open(): a file or refile table is read line by line; an empty file
|
|
# is an empty table, not an error.)
|
|
|
|
Syslog no
|
|
UMask 007
|
|
Mode s
|
|
|
|
# SigningTable uses refile: so the "*@example.com" left-hand patterns match any
|
|
# local-part for a domain; KeyTable maps each domain to its key and selector.
|
|
# (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are
|
|
# wildcard patterns matched against the From: address, in file order.)
|
|
KeyTable /data/opendkim/KeyTable
|
|
SigningTable refile:/data/opendkim/SigningTable
|
|
|
|
# The private keys are owned by `panel` and read by `opendkim` through the shared
|
|
# `selfpost` group, so they are deliberately group-readable (mode 0640). That is
|
|
# safe on this single-tenant, private bind mount, but it trips OpenDKIM's default
|
|
# key-safety check, so the check is disabled here by design. (opendkim/
|
|
# opendkim.c, dkimf_checkfsnode(): a key file must be owned by root or by the
|
|
# executing uid, and a group-readable one must be in a group of no other user -
|
|
# `panel` owns these and `selfpost` has three members.)
|
|
RequireSafeKeys no
|
|
|
|
# UMask 007 above leaves the socket group read-write (opendkim.conf.5.in,
|
|
# UMask: it applies to the socket); its group is selfpost by the setgid
|
|
# /run/opendkim (build/entrypoint.sh). UserID: the process takes the user's
|
|
# groups (opendkim.conf.5.in, UserID); with Background no and -f
|
|
# (build/supervisord.conf, opendkim.8.in) the supervised pid is OpenDKIM itself.
|
|
Socket local:/run/opendkim/opendkim.sock
|
|
PidFile /run/opendkim/opendkim.pid
|
|
UserID opendkim
|
|
Background no
|