chore(deploy): 将 DKIM 组件切换为 Rspamd

- 用 Rspamd 替换 OpenDKIM 及其相关镜像、编排和启动脚本。
- 调整 Postfix、单容器镜像与 Docker 配置，改为对接 Rspamd milter。
- 增加 DKIM 私钥同步脚本与 Rspamd 本地配置，支持从 SQLite 周期导出签名密钥。
- 更新 API 启动与测试逻辑，兼容新的默认管理员邮箱与邮箱加载方式。

deploy/all-in-one/Dockerfile

@@ -27,7 +27,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     ca-certificates tzdata sqlite3 supervisor nginx \
     postfix postfix-sqlite \
     dovecot-core dovecot-imapd dovecot-lmtpd dovecot-sqlite ssl-cert \
-    opendkim opendkim-tools
+    rspamd
 
 COPY --from=api-build /out/lanqin-api /usr/local/bin/lanqin-api
 COPY --from=web-build /src/apps/web/dist /usr/share/nginx/html
@@ -41,10 +41,10 @@ COPY deploy/postfix/master.cf /etc/postfix/master.cf
 COPY deploy/postfix/sqlite-*.cf /etc/postfix/
 COPY deploy/dovecot/dovecot.conf /etc/dovecot/dovecot.conf
 COPY deploy/dovecot/dovecot-sql.conf.ext /etc/dovecot/dovecot-sql.conf.ext
-COPY deploy/opendkim/opendkim.conf /etc/opendkim.conf
-COPY deploy/opendkim/TrustedHosts /etc/opendkim/TrustedHosts
+COPY deploy/rspamd/local.d/ /etc/rspamd/local.d/
+COPY deploy/rspamd/sync-dkim.sh /usr/local/bin/lanqin-rspamd-sync-dkim
 
-RUN chmod +x /entrypoint.sh && mkdir -p /run/nginx /var/mail/vhosts /data /etc/opendkim/keys
+RUN chmod +x /entrypoint.sh /usr/local/bin/lanqin-rspamd-sync-dkim && mkdir -p /run/nginx /run/rspamd /var/mail/vhosts /data /var/lib/rspamd/dkim
 
 EXPOSE 80 443 25 587 993
 CMD ["/entrypoint.sh"]

deploy/all-in-one/entrypoint.sh

@@ -13,17 +13,23 @@ export LANQIN_DATA_DIR LANQIN_DB_PATH LANQIN_ADDR LANQIN_SMTP_HOST LANQIN_SMTP_P
 
 addgroup --system --gid 5000 vmail 2>/dev/null || true
 adduser --system --uid 5000 --gid 5000 --home /var/mail/vhosts --no-create-home vmail 2>/dev/null || true
-mkdir -p /data /var/mail/vhosts /etc/opendkim/keys /var/spool/postfix /var/run/dovecot
+mkdir -p /data /var/mail/vhosts /var/lib/rspamd/dkim /run/rspamd /var/spool/postfix /var/run/dovecot
 chown -R 5000:5000 /var/mail/vhosts
+if id _rspamd >/dev/null 2>&1; then
+  chown -R _rspamd:_rspamd /run/rspamd /var/lib/rspamd 2>/dev/null || true
+elif id rspamd >/dev/null 2>&1; then
+  chown -R rspamd:rspamd /run/rspamd /var/lib/rspamd 2>/dev/null || true
+fi
 
 postconf -e "myhostname = ${LANQIN_PUBLIC_HOSTNAME}"
 postconf -e "myorigin = ${LANQIN_PUBLIC_HOSTNAME}"
 postconf -e "virtual_transport = lmtp:inet:127.0.0.1:24"
 postconf -e "smtpd_sasl_path = inet:127.0.0.1:12345"
-postconf -e "smtpd_milters = inet:127.0.0.1:8891"
-postconf -e "non_smtpd_milters = inet:127.0.0.1:8891"
+postconf -e "milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}"
+postconf -e "smtpd_milters = inet:127.0.0.1:11332"
+postconf -e "non_smtpd_milters = inet:127.0.0.1:11332"
 
-# OpenDKIM keys are generated after API seed/migrations create the SQLite DB.
+# Rspamd DKIM keys are exported after API seed/migrations create the SQLite DB.
 /usr/local/bin/lanqin-api >/tmp/lanqin-api-bootstrap.log 2>&1 &
 bootstrap_pid=$!
 for i in $(seq 1 60); do
@@ -39,21 +45,7 @@ done
 kill "$bootstrap_pid" 2>/dev/null || true
 wait "$bootstrap_pid" 2>/dev/null || true
 
-: > /etc/opendkim/KeyTable
-: > /etc/opendkim/SigningTable
-if [ -f "$LANQIN_DB_PATH" ]; then
-  sqlite3 -separator '|' "$LANQIN_DB_PATH" "SELECT name, dkim_selector, dkim_private_key FROM domains WHERE status='active';" | while IFS='|' read -r domain selector private_key; do
-    [ -n "$domain" ] || continue
-    dir="/etc/opendkim/keys/$domain"
-    mkdir -p "$dir"
-    keyfile="$dir/$selector.private"
-    printf '%s' "$private_key" | base64 -d > "$keyfile"
-    chmod 600 "$keyfile"
-    echo "$selector._domainkey.$domain $domain:$selector:$keyfile" >> /etc/opendkim/KeyTable
-    echo "*@${domain} ${selector}._domainkey.${domain}" >> /etc/opendkim/SigningTable
-  done
-fi
-chown -R opendkim:opendkim /etc/opendkim
+/usr/local/bin/lanqin-rspamd-sync-dkim --once || true
 
 postfix check
 exec /usr/bin/supervisord -c /etc/supervisor/conf.d/lanqin.conf

deploy/all-in-one/supervisord.conf

@@ -24,8 +24,8 @@ stderr_logfile=/dev/fd/2
 stderr_logfile_maxbytes=0
 priority=20
 
-[program:opendkim]
-command=/usr/sbin/opendkim -f -x /etc/opendkim.conf
+[program:rspamd-dkim-sync]
+command=/usr/local/bin/lanqin-rspamd-sync-dkim
 autostart=true
 autorestart=true
 stdout_logfile=/dev/fd/1
@@ -34,6 +34,16 @@ stderr_logfile=/dev/fd/2
 stderr_logfile_maxbytes=0
 priority=30
 
+[program:rspamd]
+command=/usr/bin/rspamd -f
+autostart=true
+autorestart=true
+stdout_logfile=/dev/fd/1
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/fd/2
+stderr_logfile_maxbytes=0
+priority=35
+
 [program:postfix]
 command=/usr/sbin/postfix start-fg
 autostart=true