v0.0.2

docs/RSPAMD_DKIM.md

@@ -1,4 +1,4 @@
-# Rspamd DKIM integration (0.0.1-dev)
+# Rspamd DKIM integration (0.0.2)
 
 PostfixAdmin-RS can manage file-based DKIM signing for Rspamd without growing a large `domain { ... }` block.
 It uses Rspamd's supported `selector_map` and `path_map` mechanism. DKIM is always per-domain: every domain maps to its own selector and private-key path. `default_selector` is only the default selector name used for new mappings; it is not a shared key.
@@ -37,7 +37,7 @@ If `selector_map` or `path_map` already exists outside the managed block, Postfi
 Do not run the web service as root. The service account needs write access only to the DKIM key directory, the two map files, and (if automatic bootstrap is desired) `dkim_signing.conf`.
 Rspamd needs read access to private keys.
 
-A typical layout is the dedicated `postfixadmin` service user whose files inherit the `_rspamd` group from a setgid DKIM directory. Keep private keys at mode `0640`.
+In 0.0.2 the packaged permission helper creates a dedicated `postfixadmin-rspamd` group shared only by the `postfixadmin` service account and the detected Rspamd runtime user. The DKIM directory is setgid so generated keys inherit that group. Keep private keys at mode `0640`.
 
 Reload is deliberately an argv-only configured command. If automatic reload is wanted, use a tightly scoped sudoers rule that permits only `systemctl reload rspamd`, then configure:
 
@@ -83,3 +83,18 @@ Rspamd obserwuje lokalne pliki map i odswieza je po zmianach, wiec po jednorazow
 When `[dkim].user_read_only = true`, a mailbox user can open DKIM and see the complete public DNS record for their own domain. The API may return records from both the PostfixAdmin DKIM tables and Rspamd, but it never exposes private-key bytes or private-key paths to mailbox users.
 
 In SSH development mode the application cannot directly read `/var/lib/rspamd/dkim` on the remote mail server. `dev.sh` therefore creates a temporary public-only cache under `.dev/rspamd-remote-public`: it reads the remote maps/config and derives the public key with OpenSSL on the remote host. Only the final public TXT record is copied back; private key bytes never leave the mail server. Disable this development helper with `POSTFIXADMIN_RS_DEV_RSPAMD_PUBLIC_SYNC=false`.
+
+## Host permissions for 0.0.2
+
+`postfixadmin-rs` never needs to run as root. For the standard paths, install the package and run once:
+
+```bash
+sudo /usr/lib/postfixadmin-rs/setup-rspamd-dkim-permissions
+sudo systemctl restart postfixadmin-rs rspamd
+```
+
+The helper creates a dedicated `postfixadmin-rspamd` group, adds the PostfixAdmin-RS and Rspamd runtime users to it, prepares `/var/lib/rspamd/dkim` as a setgid shared directory, keeps private keys at `0640`, and grants the service write access only to `dkim_signing.conf` rather than all of `/etc/rspamd/local.d`.
+
+You can override detection with `POSTFIXADMIN_RS_RSPAMD_USER`, `POSTFIXADMIN_RS_RSPAMD_KEY_DIR`, and `POSTFIXADMIN_RS_RSPAMD_SIGNING_CONFIG` when the host uses non-standard names or paths.
+
+Filesystem failures now include the operation and exact path in the API error instead of the generic `I/O operation failed` message.