Initial commit

Dockerfile

@@ -0,0 +1,19 @@
+FROM ubuntu:22.04
+
+WORKDIR /opt/opendkim
+
+RUN apt update && \
+  apt upgrade -y && \
+  apt install -y opendkim inetutils-syslogd curl
+
+RUN curl -SsfL -o /usr/bin/gomplate "https://github.com/hairyhenderson/gomplate/releases/download/v3.11.5/gomplate_linux-amd64-slim" && \
+  chmod 755 /usr/bin/gomplate && \
+  mkdir -p /etc/rsyslog.d/ && \
+  touch /etc/rsyslog.d/stdout.conf && \
+  echo "*.*    /dev/stdout" > /etc/rsyslog.d/stdout.conf
+
+COPY entrypoint.sh .
+COPY opendkim.conf.tpl .
+
+EXPOSE 8892/tcp
+CMD ["/bin/bash", "entrypoint.sh"]

README.md

@@ -1,3 +1,58 @@
-# opendkim-docker
+# Building the image
+```sh
+docker build --rm -t opendkim:latest .
+```
 
-Dockerized OpenDKIM service for signing outgoing mail with DKIM.
+# Generating private key
+Before running the private key must be generated using opendkim-keygen or supplied.
+```sh
+# Generate private key.
+opendkim-genkey --bits=2048 --selector=dkim --restrict --verbose
+
+# Getting publickey for DNS record.
+cat dkim.txt | tr -d "\"\n\" \t" | sed -r "s/.*\((.*)\).*/\\1\n/"
+```
+
+# Running the image
+```sh
+docker run -it --rm --name opendkim -p 8892:8892 -v /path/dkim.private:/opt/opendkim/keys/dkim.private opendkim:latest
+```
+
+# Environment variables
+These values are default and can be overriden by declaring environment variable with naother value.
+```sh
+# Attempts to become the specified userid before starting operations. The value is of the form userid[:group].
+OPENDKIM_USERID="opendkim"
+
+# Specifies the socket that should be established by the filter to receive connections.
+OPENDKIM_SOCKET="inet:8892@0.0.0.0"
+
+# A set of domains whose mail should be signed by this filter.
+OPENDKIM_DOMAIN="*"
+
+# Gives the location of a PEM-formatted private key to be used for signing all messages. Ignored if a KeyTable is defined.
+OPENDKIM_KEYFILE="/opt/opendkim/keys/dkim.private"
+
+# Defines the name of the selector to be used when signing messages.
+OPENDKIM_SELECTOR="dkim"
+
+# Selects the canonicalization method(s) to be used when signing messages.
+OPENDKIM_CANONICALIZATION="relaxed/simple"
+
+# Selects operating modes. The string is a concatenation of characters
+# that indicate which mode(s) of operation are desired. Valid modes are s (signer) and v (verifier).
+OPENDKIM_MODE="sv"
+
+# Sign subdomains of those listed by the Domain parameter as well as the actual domains.
+OPENDKIM_SUBDOMAINS="true"
+
+# Specifies a set of header fields that should be included in all signature header lists (the "h=" tag) 
+# once more than the number of times they were actually present in the signed message.
+OPENDKIM_OVERSIGNHEADERS="From"
+
+# Specifies a file from which trust anchor data should be read when doing DNS queries and applying the DNSSEC protocol.
+OPENDKIM_TRUSTANCHORFILE="/usr/share/dns/root.key"
+
+# Identifies a set internal hosts whose mail should be signed rather than verified.
+OPENDKIM_INTERNALHOSTS="127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8"
+```

entrypoint.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Misc default variables.
+export OPENDKIM_USERID=${OPENDKIM_USERID:-opendkim}
+export OPENDKIM_SOCKET=${OPENDKIM_SOCKET:-inet:8892@0.0.0.0}
+export OPENDKIM_DOMAIN=${OPENDKIM_DOMAIN:-*}
+export OPENDKIM_KEYFILE=${OPENDKIM_KEYFILE:-/opt/opendkim/keys/dkim.private}
+export OPENDKIM_SELECTOR=${OPENDKIM_SELECTOR:-dkim}
+export OPENDKIM_CANONICALIZATION=${OPENDKIM_CANONICALIZATION:-relaxed/simple}
+export OPENDKIM_MODE=${OPENDKIM_MODE:-sv}
+export OPENDKIM_SUBDOMAINS=${OPENDKIM_SUBDOMAINS:-true}
+export OPENDKIM_OVERSIGNHEADERS=${OPENDKIM_OVERSIGNHEADERS:-From}
+export OPENDKIM_TRUSTANCHORFILE=${OPENDKIM_TRUSTANCHORFILE:-/usr/share/dns/root.key}
+export OPENDKIM_INTERNALHOSTS=${OPENDKIM_INTERNALHOSTS:-127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8}
+
+# Configuration templates.
+gomplate -f opendkim.conf.tpl > /opt/opendkim/opendkim.conf
+
+mkdir -p /var/opendkim
+cp $OPENDKIM_KEYFILE /var/opendkim/dkim.private
+chown opendkim:opendkim /var/opendkim/dkim.private
+chmod 0600 /var/opendkim/dkim.private
+
+opendkim -x /opt/opendkim/opendkim.conf
+syslogd -n -f /etc/rsyslog.d/stdout.conf

opendkim.conf.tpl

@@ -0,0 +1,47 @@
+# Disable log to syslog because we want to log in stdout.
+Syslog                true
+
+# Log via calls to syslog(3) additional entries indicating successful signing or verification of messages.
+SyslogSuccess         true
+
+# If logging is enabled (see Syslog below), issues very detailed logging about the
+# logic behind the filter’s decision to either sign a message or verify it.
+LogWhy                true
+
+# Specifies the path to a file that should be created at process start containing the process ID.
+PidFile               /var/run/opendkim/opendkim.pid
+
+# Attempts to become the specified userid before starting operations. The value is of the form userid[:group].
+UserID                {{ .Env.OPENDKIM_USERID }}
+
+# Specifies the socket that should be established by the filter to receive connections.
+Socket                {{ .Env.OPENDKIM_SOCKET }}
+
+# A set of domains whose mail should be signed by this filter.
+Domain                {{ .Env.OPENDKIM_DOMAIN }}
+
+# Gives the location of a PEM-formatted private key to be used for signing all messages. Ignored if a KeyTable is defined.
+KeyFile               /var/opendkim/dkim.private
+
+# Defines the name of the selector to be used when signing messages.
+Selector              {{ .Env.OPENDKIM_SELECTOR }}
+
+# Selects the canonicalization method(s) to be used when signing messages.
+Canonicalization      {{ .Env.OPENDKIM_CANONICALIZATION }}
+
+# Selects operating modes. The string is a concatenation of characters
+# that indicate which mode(s) of operation are desired. Valid modes are s (signer) and v (verifier).
+Mode                  {{ .Env.OPENDKIM_MODE }}
+
+# Sign subdomains of those listed by the Domain parameter as well as the actual domains.
+SubDomains            {{ .Env.OPENDKIM_SUBDOMAINS }}
+
+# Specifies a set of header fields that should be included in all signature header lists (the "h=" tag) 
+# once more than the number of times they were actually present in the signed message.
+OversignHeaders       {{ .Env.OPENDKIM_OVERSIGNHEADERS }}
+
+# Specifies a file from which trust anchor data should be read when doing DNS queries and applying the DNSSEC protocol.
+TrustAnchorFile       {{ .Env.OPENDKIM_TRUSTANCHORFILE }}
+
+# Identifies a set internal hosts whose mail should be signed rather than verified.
+InternalHosts {{ .Env.OPENDKIM_INTERNALHOSTS }}