75 lines
2.6 KiB
Bash
Executable File
75 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
# One-time host permission setup for the file-based Rspamd DKIM integration.
|
|
# The web service stays unprivileged; both daemons share only this dedicated group.
|
|
|
|
KEY_DIR="${POSTFIXADMIN_RS_RSPAMD_KEY_DIR:-/var/lib/rspamd/dkim}"
|
|
SIGNING_CONFIG="${POSTFIXADMIN_RS_RSPAMD_SIGNING_CONFIG:-/etc/rspamd/local.d/dkim_signing.conf}"
|
|
SHARED_GROUP="${POSTFIXADMIN_RS_RSPAMD_GROUP:-postfixadmin-rspamd}"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "error: run this helper as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! getent passwd postfixadmin >/dev/null 2>&1; then
|
|
echo "error: postfixadmin service user does not exist; install postfixadmin-rs first" >&2
|
|
exit 1
|
|
fi
|
|
|
|
RSPAMD_USER="${POSTFIXADMIN_RS_RSPAMD_USER:-}"
|
|
if [ -z "$RSPAMD_USER" ]; then
|
|
for candidate in _rspamd rspamd; do
|
|
if getent passwd "$candidate" >/dev/null 2>&1; then
|
|
RSPAMD_USER="$candidate"
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
if [ -z "$RSPAMD_USER" ] || ! getent passwd "$RSPAMD_USER" >/dev/null 2>&1; then
|
|
echo "error: cannot determine Rspamd runtime user; set POSTFIXADMIN_RS_RSPAMD_USER" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! getent group "$SHARED_GROUP" >/dev/null 2>&1; then
|
|
addgroup --system "$SHARED_GROUP" >/dev/null
|
|
fi
|
|
|
|
usermod -a -G "$SHARED_GROUP" postfixadmin
|
|
usermod -a -G "$SHARED_GROUP" "$RSPAMD_USER"
|
|
|
|
# The root DKIM directory is writable by the shared group. Domain directories
|
|
# created by PostfixAdmin-RS inherit the group through setgid.
|
|
install -d -o root -g "$SHARED_GROUP" -m 2770 "$KEY_DIR"
|
|
|
|
# Normalize already-managed domain directories and files without making private
|
|
# keys world-readable. The service owns subdirectories so it can rotate keys.
|
|
find "$KEY_DIR" -mindepth 1 -type d -exec chown postfixadmin:"$SHARED_GROUP" {} \; -exec chmod 2750 {} \;
|
|
find "$KEY_DIR" -type f -exec chgrp "$SHARED_GROUP" {} \;
|
|
find "$KEY_DIR" -type f -name '*.private' -exec chmod 0640 {} \;
|
|
find "$KEY_DIR" -type f ! -name '*.private' -exec chmod 0640 {} \;
|
|
|
|
# PostfixAdmin-RS edits this single Rspamd config file directly. Creating it here
|
|
# avoids granting write access to the whole /etc/rspamd/local.d directory.
|
|
SIGNING_DIR="$(dirname "$SIGNING_CONFIG")"
|
|
if [ ! -d "$SIGNING_DIR" ]; then
|
|
install -d -o root -g root -m 0755 "$SIGNING_DIR"
|
|
fi
|
|
if [ ! -e "$SIGNING_CONFIG" ]; then
|
|
: > "$SIGNING_CONFIG"
|
|
fi
|
|
chown root:"$SHARED_GROUP" "$SIGNING_CONFIG"
|
|
chmod 0660 "$SIGNING_CONFIG"
|
|
|
|
cat <<MSG
|
|
Rspamd DKIM permissions prepared.
|
|
Rspamd user: $RSPAMD_USER
|
|
Shared group: $SHARED_GROUP
|
|
Key directory: $KEY_DIR
|
|
Signing config: $SIGNING_CONFIG
|
|
|
|
Restart both services so supplementary groups are reloaded:
|
|
systemctl restart postfixadmin-rs rspamd
|
|
MSG
|