[byjpr]

Closes #19

Changes

• The Rspamd controller socket /run/rspamd/worker-controller.sock changes from 0666 (world-writable, set by simple-nixos-mailserver) to 0660, owner rspamd, group virtualMail. Access is now limited to:
  • root, i.e. the admin rspamc wrapper;
  • Dovecot's spam/ham learning (rspamd-learn-spam.sh / -ham.sh, piped from IMAP processes). Those run with mail_gid = virtualMail, so learning by moving mail into or out of Junk keeps working.
• nginx, kresd and every other local service can no longer retrain the Bayes filter or change maps.
• Rspamd runs unprivileged, and can only give the socket to a group it belongs to, so the service gets SupplementaryGroups=virtualMail. That grants it nothing else: mail homes are created 0700 (NixOS homeMode default) and Dovecot writes mail with umask 0077.

Testing

• The generated rspamd.conf has bind_socket = "/run/rspamd/worker-controller.sock mode=0660 owner=rspamd group=virtualMail".
• rspamd.service has SupplementaryGroups=virtualMail and redis-rspamd; systemd adds the two together.
• The generated dovecot.conf has mail_gid = virtualMail.
• All 5 provider example systems build. nixfmt, shellcheck and tofu validate pass.
• Not exercised on a running server (socket creation as the rspamd user, learning via IMAP). It's on the docs/first-install.md list if First-install checklist, just status, robust relay credential permissions #41 is merged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22o7QQ17GRtkCqpJNFr9B

---

Generated by Claude Code