v0.0.2

packaging/postfixadmin-rs-rspamd-setup

@@ -0,0 +1,74 @@
+#!/bin/sh
+set -eu
+
+# One-time host permission setup for the file-based Rspamd DKIM integration.
+# The web service stays unprivileged; both daemons share only this dedicated group.
+
+KEY_DIR="${POSTFIXADMIN_RS_RSPAMD_KEY_DIR:-/var/lib/rspamd/dkim}"
+SIGNING_CONFIG="${POSTFIXADMIN_RS_RSPAMD_SIGNING_CONFIG:-/etc/rspamd/local.d/dkim_signing.conf}"
+SHARED_GROUP="${POSTFIXADMIN_RS_RSPAMD_GROUP:-postfixadmin-rspamd}"
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "error: run this helper as root" >&2
+  exit 1
+fi
+
+if ! getent passwd postfixadmin >/dev/null 2>&1; then
+  echo "error: postfixadmin service user does not exist; install postfixadmin-rs first" >&2
+  exit 1
+fi
+
+RSPAMD_USER="${POSTFIXADMIN_RS_RSPAMD_USER:-}"
+if [ -z "$RSPAMD_USER" ]; then
+  for candidate in _rspamd rspamd; do
+    if getent passwd "$candidate" >/dev/null 2>&1; then
+      RSPAMD_USER="$candidate"
+      break
+    fi
+  done
+fi
+if [ -z "$RSPAMD_USER" ] || ! getent passwd "$RSPAMD_USER" >/dev/null 2>&1; then
+  echo "error: cannot determine Rspamd runtime user; set POSTFIXADMIN_RS_RSPAMD_USER" >&2
+  exit 1
+fi
+
+if ! getent group "$SHARED_GROUP" >/dev/null 2>&1; then
+  addgroup --system "$SHARED_GROUP" >/dev/null
+fi
+
+usermod -a -G "$SHARED_GROUP" postfixadmin
+usermod -a -G "$SHARED_GROUP" "$RSPAMD_USER"
+
+# The root DKIM directory is writable by the shared group. Domain directories
+# created by PostfixAdmin-RS inherit the group through setgid.
+install -d -o root -g "$SHARED_GROUP" -m 2770 "$KEY_DIR"
+
+# Normalize already-managed domain directories and files without making private
+# keys world-readable. The service owns subdirectories so it can rotate keys.
+find "$KEY_DIR" -mindepth 1 -type d -exec chown postfixadmin:"$SHARED_GROUP" {} \; -exec chmod 2750 {} \;
+find "$KEY_DIR" -type f -exec chgrp "$SHARED_GROUP" {} \;
+find "$KEY_DIR" -type f -name '*.private' -exec chmod 0640 {} \;
+find "$KEY_DIR" -type f ! -name '*.private' -exec chmod 0640 {} \;
+
+# PostfixAdmin-RS edits this single Rspamd config file directly. Creating it here
+# avoids granting write access to the whole /etc/rspamd/local.d directory.
+SIGNING_DIR="$(dirname "$SIGNING_CONFIG")"
+if [ ! -d "$SIGNING_DIR" ]; then
+  install -d -o root -g root -m 0755 "$SIGNING_DIR"
+fi
+if [ ! -e "$SIGNING_CONFIG" ]; then
+  : > "$SIGNING_CONFIG"
+fi
+chown root:"$SHARED_GROUP" "$SIGNING_CONFIG"
+chmod 0660 "$SIGNING_CONFIG"
+
+cat <<MSG
+Rspamd DKIM permissions prepared.
+  Rspamd user:     $RSPAMD_USER
+  Shared group:    $SHARED_GROUP
+  Key directory:   $KEY_DIR
+  Signing config:  $SIGNING_CONFIG
+
+Restart both services so supplementary groups are reloaded:
+  systemctl restart postfixadmin-rs rspamd
+MSG