Sign inSign up

digitaldriveio/openarc

By digitaldriveio

•Updated 12 months ago

Minimal Docker image for OpenARC (ARC signing and verification) based on Debian experimental.

Image
0

599

digitaldriveio/openarc repository overview

⁠OpenARC Docker Entrypoint

This script generates an openarc.conf, creates required runtime files, and runs OpenARC in foreground mode so logs are visible in Docker stdout/stderr.

⁠Features

  • Auto-generates /etc/openarc.conf from environment variables.
  • Secure handling of private keys (chmod 600).
  • Writes the InternalHosts file from a comma-separated environment variable.
  • Copies the private key to /tmp for compatibility or debugging.
  • Runs OpenARC in foreground (-f) for Docker.
  • Disables syslog by default (avoids missing logs in containers).
  • Emits warnings to stderr if key, config, or PID directories are missing or not writable.

⁠Environment Variables

VariableDefaultDescription
OPENARC_AUTH_SERV_IDrelay.example.comAuthservID header value
OPENARC_DOMAINexample.comSigning domain
OPENARC_SELECTORdefaultDKIM/ARC selector
OPENARC_KEY_FILE/openarc/keys/default.privatePath to private key
OPENARC_SOCKETinet:8801@[0.0.0.0]Listener socket (e.g., for milter communication)
OPENARC_PID_FILE/run/openarc/openarc.pidPID file path
OPENARC_USER_IDopenarcUser to drop privileges to
OPENARC_USER_MASK007File creation mask
OPENARC_SYSLOGNoEnable syslog (Yes to log via syslog)
OPENARC_SOFTWARE_HEADERYesAdd SoftwareHeader line to signed emails
OPENARC_CANONICALIZATIONrelaxed/simpleCanonicalization mode used for ARC signing
OPENARC_SIGN_HEADERSto,from,subject,date,message-idComma-separated headers to sign
OPENARC_INTERNAL_HOSTS127.0.0.1Comma-separated list of IPs/domains considered "internal".
OPENARC_MODEsARC processing mode (s, v, or sv)
⁠OPENARC_MODE options
ValueMeaningDescription
sSign onlySigns outbound messages. Suitable for outbound mail relays.
vVerify onlyVerifies ARC signatures on inbound messages. Used in inbound filtering.
svSign and verifyBoth signs and verifies. Use in intermediaries that forward signed mail.

⁠Files Written at Runtime

PathDescription
/etc/openarc.confMain OpenARC configuration file
/etc/openarc/InternalHostsOne host per line, derived from OPENARC_INTERNAL_HOSTS
/tmp/<keyfile>.privateCopy of the ARC key (chmod 600)

⁠Notes

  • If OPENARC_INTERNAL_HOSTS is unset, only 127.0.0.1 will be considered an internal host (this matches OpenARC’s default behavior).
  • The key is copied to /tmp for convenience (e.g. debugging or compatibility with services that read from there).
  • All critical paths (key, InternalHosts, conf) are protected with umask 077 and explicit chmod to restrict access.
  • Mode s (sign only) is appropriate for outbound signing setups. Use sv only if both signing and verifying are required.

⁠Example Usage

docker run --rm \
  -e OPENARC_DOMAIN=example.org \
  -e OPENARC_SELECTOR=mail \
  -e OPENARC_KEY_FILE=/keys/mail.private \
  -e OPENARC_INTERNAL_HOSTS="192.168.0.0/16,mail.example.org" \
  -e OPENARC_MODE=sv \
  -v /local/keys:/keys:ro \
  openarc-image

Tag summary

Content type

Image

Digest

sha256:edb800fa2…

Size

46.9 MB

Last updated

12 months ago

docker pull digitaldriveio/openarc