Martin Weinelt
6ff4a50f02
After bumping the generation of new DKIM keys to RSA 2048 in NixOS 25.11 key rotation for existing users could not be done safely. To resolve this situation we now support multiple generations of selectors per domain to enable proper DKIM key transitions as described in RFC6376 3.1. The added documentation introduces and motivates DKIM and guides the user through a DKIM key rotation. Additionally, DKIM key material can now also be treated as a managed secrets when autogenerated state on the mail server host is undesirable. This change is fully backwards compatible in behavior and will continue to use the previously generated DKIM key without any additional configuration up until the point when DKIM selectors are configured explicitly.
28 lines
1.2 KiB
ReStructuredText
28 lines
1.2 KiB
ReStructuredText
Backup Guide
|
||
============
|
||
|
||
First off you should have a backup of your ``configuration.nix`` file
|
||
where you have the server config (but that is already in a git
|
||
repository right?)
|
||
|
||
Next you need to backup ``/var/vmail`` or whatever you have specified
|
||
for the option ``mailDirectory``. This is where all the mails reside.
|
||
Good options are a cron job with ``rsync`` or ``scp``. But really
|
||
anything works, as it is simply a folder with plenty of files in it. If
|
||
your backup solution does not preserve the owner of the files don’t
|
||
forget to ``chown`` them to ``virtualMail:virtualMail`` if you copy them
|
||
back (or whatever you specified as ``vmailUserName``, and
|
||
``vmailGroupName``).
|
||
|
||
If you enabled ``enableManageSieve`` then you also may want to backup
|
||
``/var/sieve`` or whatever you have specified as ``sieveDirectory``.
|
||
The same considerations regarding file ownership apply as for the
|
||
Maildir.
|
||
|
||
To backup spam and ham training data, backup ``/var/lib/redis-rspamd``.
|
||
|
||
Finally you can (optionally) make a backup of ``/var/dkim`` (or whatever you
|
||
specified as :option:`mailserver.dkim.keyDirectory`). If you should lose those
|
||
don’t worry, new ones will be created on the fly. But you will need to update
|
||
the DKIM TXT records to reflect the new key material.
|