From 7788e93f0e563360c7376ddcf8798b6aa1bae175 Mon Sep 17 00:00:00 2001
From: LanQin <lanqinnet@qq.com>
Date: Tue, 16 Jun 2026 21:48:42 +0800
Subject: [PATCH] =?UTF-8?q?chore(deploy):=20=E8=B0=83=E6=95=B4=20rspamd=20?=
 =?UTF-8?q?=E4=B8=8E=20dovecot=20=E5=90=AF=E5=8A=A8=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 为 `rspamd` 指定运行用户/组，提升容器内启动一致性。
- 将 `dovecot` 配置格式整理为多行块，保持配置可读性。
- 在 `rspamd` 入口脚本中按可用账号选择启动参数，并保留兜底启动方式。
---
 deploy/all-in-one/supervisord.conf |  2 +-
 deploy/dovecot/dovecot.conf        | 30 +++++++++++++++++++++++-------
 deploy/rspamd/entrypoint.sh        |  7 ++++++-
 3 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/deploy/all-in-one/supervisord.conf b/deploy/all-in-one/supervisord.conf
index bd19505..153aa7c 100644
--- a/deploy/all-in-one/supervisord.conf
+++ b/deploy/all-in-one/supervisord.conf
@@ -35,7 +35,7 @@ stderr_logfile_maxbytes=0
 priority=30
 
 [program:rspamd]
-command=/usr/bin/rspamd -f
+command=/usr/bin/rspamd -f -u _rspamd -g _rspamd
 autostart=true
 autorestart=true
 stdout_logfile=/dev/fd/1
diff --git a/deploy/dovecot/dovecot.conf b/deploy/dovecot/dovecot.conf
index 9187d71..079c283 100644
--- a/deploy/dovecot/dovecot.conf
+++ b/deploy/dovecot/dovecot.conf
@@ -12,11 +12,21 @@ ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key
 mail_home = /var/mail/vhosts/%d/%n
 namespace inbox {
   inbox = yes
-  mailbox Drafts { special_use = \Drafts }
-  mailbox Sent { special_use = \Sent }
-  mailbox Trash { special_use = \Trash }
-  mailbox Archive { special_use = \Archive }
-  mailbox Spam { special_use = \Junk }
+  mailbox Drafts {
+    special_use = \Drafts
+  }
+  mailbox Sent {
+    special_use = \Sent
+  }
+  mailbox Trash {
+    special_use = \Trash
+  }
+  mailbox Archive {
+    special_use = \Archive
+  }
+  mailbox Spam {
+    special_use = \Junk
+  }
 }
 
 passdb {
@@ -29,11 +39,17 @@ userdb {
 }
 
 service imap-login {
-  inet_listener imaps { port = 993 ssl = yes }
+  inet_listener imaps {
+    port = 993
+    ssl = yes
+  }
 }
 
 service lmtp {
-  inet_listener lmtp { address = 0.0.0.0 port = 24 }
+  inet_listener lmtp {
+    address = 0.0.0.0
+    port = 24
+  }
 }
 
 service auth {
diff --git a/deploy/rspamd/entrypoint.sh b/deploy/rspamd/entrypoint.sh
index 6d0fbb7..72ba8cb 100644
--- a/deploy/rspamd/entrypoint.sh
+++ b/deploy/rspamd/entrypoint.sh
@@ -10,4 +10,9 @@ fi
 
 /usr/local/bin/lanqin-rspamd-sync-dkim --once || true
 /usr/local/bin/lanqin-rspamd-sync-dkim &
-exec rspamd -f
+if id _rspamd >/dev/null 2>&1; then
+  exec rspamd -f -u _rspamd -g _rspamd
+elif id rspamd >/dev/null 2>&1; then
+  exec rspamd -f -u rspamd -g rspamd
+fi
+exec rspamd -f --insecure