From 7e99d675fd7d0dd69271ae9b43f3d5c811f30816 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Tue, 13 Oct 2026 21:41:39 +1100
Subject: [PATCH] Sign main.unkin.net mail with the unkin.net DKIM key

---
 apps/base/mail/rspamd-deployment.yaml   | 17 +++++------------
 apps/base/mail/rspamd-vault.yaml        | 18 ------------------
 apps/base/mail/rspamd/dkim_signing.conf |  1 -
 3 files changed, 5 insertions(+), 31 deletions(-)

diff --git a/apps/base/mail/rspamd-deployment.yaml b/apps/base/mail/rspamd-deployment.yaml
index ee3b9ba..2764651 100644
--- a/apps/base/mail/rspamd-deployment.yaml
+++ b/apps/base/mail/rspamd-deployment.yaml
@@ -101,19 +101,12 @@ spec:
           configMap:
             name: rspamd-sa-rules
         - name: dkim
-          projected:
+          secret:
+            secretName: dkim-unkin-net
             defaultMode: 0440
-            sources:
-              - secret:
-                  name: dkim-unkin-net
-                  items:
-                    - key: private_key
-                      path: unkin.net.mail.key
-              - secret:
-                  name: dkim-main-unkin-net
-                  items:
-                    - key: private_key
-                      path: main.unkin.net.mail.key
+            items:
+              - key: private_key
+                path: unkin.net.mail.key
         - name: data
           emptyDir: {}
 ---
diff --git a/apps/base/mail/rspamd-vault.yaml b/apps/base/mail/rspamd-vault.yaml
index 7096600..6a07a11 100644
--- a/apps/base/mail/rspamd-vault.yaml
+++ b/apps/base/mail/rspamd-vault.yaml
@@ -60,24 +60,6 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
-# DKIM private key for main.unkin.net, selector `mail` (field `private_key`).
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: dkim-main-unkin-net
-  namespace: mail
-spec:
-  destination:
-    create: true
-    name: dkim-main-unkin-net
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/mail/default/dkim-main-unkin-net
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
 # Controller (web UI) password; config reads the `rspamadm pw` hash (field `password_hash`).
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
diff --git a/apps/base/mail/rspamd/dkim_signing.conf b/apps/base/mail/rspamd/dkim_signing.conf
index 1f1440f..fce2716 100644
--- a/apps/base/mail/rspamd/dkim_signing.conf
+++ b/apps/base/mail/rspamd/dkim_signing.conf
@@ -2,7 +2,6 @@ sign_authenticated = false;
 sign_local = true;
 sign_inbound = false;
 use_domain = "header";
-use_esld = false;
 allow_hdrfrom_mismatch = false;
 selector = "mail";
 path = "/etc/rspamd/dkim/$domain.$selector.key";