[opendkim] Generate default configuration.

diff --git a/opendkim/README b/opendkim/README
new file mode 100644 (file)
index 0000000..fb0f443
--- /dev/null
+++ b/opendkim/README
@@ -0,0 +1,22 @@
+opendkim
+========
+
+DKIM (DomainKeys Identified Mail) is an email authentication protocol which
+allows recipients to verify if an email message truly came from the domain that
+it claims to have come from. It uses the /milter/ interface to provide DKIM
+signing.
+
+Files
+-----
+
+opendkim
+|
+|-> opendkim      -- /etc/default :: service configuration
+`-> opendkim.conf -- /etc/        :: configuration parameters
+
+Install
+-------
+
+```
+$ apt install opendkim
+```

diff --git a/opendkim/opendkim b/opendkim/opendkim
new file mode 100644 (file)
index 0000000..51ae707
--- /dev/null
+++ b/opendkim/opendkim
@@ -0,0 +1,30 @@
+# NOTE: This is a legacy configuration file. It is not used by the opendkim
+# systemd service. Please use the corresponding configuration parameters in
+# /etc/opendkim.conf instead.
+#
+# Previously, one would edit the default settings here, and then execute
+# /lib/opendkim/opendkim.service.generate to generate systemd override files at
+# /etc/systemd/system/opendkim.service.d/override.conf and
+# /etc/tmpfiles.d/opendkim.conf. While this is still possible, it is now
+# recommended to adjust the settings directly in /etc/opendkim.conf.
+#
+#DAEMON_OPTS=""
+# Change to /var/spool/postfix/run/opendkim to use a Unix socket with
+# postfix in a chroot:
+#RUNDIR=/var/spool/postfix/run/opendkim
+RUNDIR=/run/opendkim
+#
+# Uncomment to specify an alternate socket
+# Note that setting this will override any Socket value in opendkim.conf
+# default:
+SOCKET=local:$RUNDIR/opendkim.sock
+# listen on all interfaces on port 54321:
+#SOCKET=inet:54321
+# listen on loopback on port 12345:
+#SOCKET=inet:12345@localhost
+# listen on 192.0.2.1 on port 12345:
+#SOCKET=inet:12345@192.0.2.1
+USER=opendkim
+GROUP=opendkim
+PIDFILE=$RUNDIR/$NAME.pid
+EXTRAAFTER=

diff --git a/opendkim/opendkim.conf b/opendkim/opendkim.conf
new file mode 100644 (file)
index 0000000..891acb3
--- /dev/null
+++ b/opendkim/opendkim.conf
@@ -0,0 +1,51 @@
+# This is a basic configuration for signing and verifying. It can easily be
+# adapted to suit a basic installation. See opendkim.conf(5) and
+# /usr/share/doc/opendkim/examples/opendkim.conf.sample for complete
+# documentation of available configuration parameters.
+
+Syslog                 yes
+SyslogSuccess          yes
+#LogWhy                        no
+
+# Common signing and verification parameters. In Debian, the "From" header is
+# oversigned, because it is often the identity key used by reputation systems
+# and thus somewhat security sensitive.
+Canonicalization       relaxed/simple
+#Mode                  sv
+#SubDomains            no
+OversignHeaders                From
+
+# Signing domain, selector, and key (required). For example, perform signing
+# for domain "example.com" with selector "2020" (2020._domainkey.example.com),
+# using the private key stored in /etc/dkimkeys/example.private. More granular
+# setup options can be found in /usr/share/doc/opendkim/README.opendkim.
+#Domain                        example.com
+#Selector              2020
+#KeyFile               /etc/dkimkeys/example.private
+
+# In Debian, opendkim runs as user "opendkim". A umask of 007 is required when
+# using a local socket with MTAs that access the socket as a non-privileged
+# user (for example, Postfix). You may need to add user "postfix" to group
+# "opendkim" in that case.
+UserID                 opendkim
+UMask                  007
+
+# Socket for the MTA connection (required). If the MTA is inside a chroot jail,
+# it must be ensured that the socket is accessible. In Debian, Postfix runs in
+# a chroot in /var/spool/postfix, therefore a Unix socket would have to be
+# configured as shown on the last line below.
+Socket                 local:/run/opendkim/opendkim.sock
+#Socket                        inet:8891@localhost
+#Socket                        inet:8891
+#Socket                        local:/var/spool/postfix/opendkim/opendkim.sock
+
+PidFile                        /run/opendkim/opendkim.pid
+
+# Hosts for which to sign rather than verify, default is 127.0.0.1. See the
+# OPERATION section of opendkim(8) for more information.
+#InternalHosts         192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12
+
+# The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
+# by the package dns-root-data.
+TrustAnchorFile                /usr/share/dns/root.key
+#Nameservers           127.0.0.1