From a72c8440f8ab6d2c1bfb598a14c961b32f9dcfb0 Mon Sep 17 00:00:00 2001 From: Brian Lee Date: Wed, 29 May 2024 11:58:31 -0700 Subject: [PATCH] Add DKIM signing when using multiple domains. --- tasks/opendkim.yml | 39 ++++++++++++++++++++++++++++++++++---- templates/keytable.j2 | 8 ++++++++ templates/opendkim.conf.j2 | 3 ++- templates/signingtable.j2 | 8 ++++++++ 4 files changed, 53 insertions(+), 5 deletions(-) create mode 100644 templates/keytable.j2 create mode 100644 templates/signingtable.j2 diff --git a/tasks/opendkim.yml b/tasks/opendkim.yml index 7bd54d0..d578419 100644 --- a/tasks/opendkim.yml +++ b/tasks/opendkim.yml @@ -21,14 +21,45 @@ mode: '0770' notify: restart opendkim -- name: Generate DKIM signing key +#- name: Generate DKIM signing key +# ansible.builtin.command: +# cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ postfix_domain }} --directory /etc/dkimkeys" +# creates: "/etc/dkimkeys/{{ dkim_selector }}.private" +# become: true +# become_user: opendkim +# notify: restart opendkim + +- name: Ensure DKIM directories exist for each domain + ansible.builtin.file: + path: "/etc/dkimkeys/{{ item.name }}" + state: directory + owner: opendkim + group: opendkim + mode: '0750' + loop: "{{ [{'name': postfix_domain}] + postfix_virtual_domains }}" + +- name: Generate DKIM signing keys for each domain ansible.builtin.command: - cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ postfix_domain }} --directory /etc/dkimkeys" - creates: "/etc/dkimkeys/{{ dkim_selector }}.private" - become: true + cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ item.name }} --directory /etc/dkimkeys/{{ item.name }}" + creates: "/etc/dkimkeys/{{ item.name }}/{{ dkim_selector }}.private" + loop: "{{ [{'name': postfix_domain}] + postfix_virtual_domains }}" become_user: opendkim notify: restart opendkim +- name: Configure the KeyTable + ansible.builtin.template: + src: keytable.j2 + dest: "{{ dkim_key_path }}/KeyTable" + mode: '0644' + notify: restart opendkim + +- name: Configuring the SigningTable + ansible.builtin.template: + src: signingtable.j2 + dest: "{{ dkim_key_path }}/SigningTable" + mode: '0644' + notify: restart opendkim + - name: Ensure postfix is in opendkim group ansible.builtin.user: name: postfix diff --git a/templates/keytable.j2 b/templates/keytable.j2 new file mode 100644 index 0000000..5d8b7a2 --- /dev/null +++ b/templates/keytable.j2 @@ -0,0 +1,8 @@ +{% if postfix_virtual_domains|length > 0 %} +{{ dkim_selector }}._domainkey.{{ postfix_domain }} {{ postfix_domain }}:mail:/etc/dkimkeys/{{ postfix_domain }}/{{ dkim_selector }}.private +{% for domain in postfix_virtual_domains %} +{{ dkim_selector }}._domainkey.{{ domain.name }} {{ domain.name }}:mail:/etc/dkimkeys/{{ domain.name }}/{{ dkim_selector }}.private +{% endfor %} +{% else %} +{{ dkim_selector }}._domainkey.{{ postfix_domain }} {{ postfix_domain }}:mail:/etc/dkimkeys/{{ postfix_domain }}/{{ dkim_selector }}.private +{% endif %} \ No newline at end of file diff --git a/templates/opendkim.conf.j2 b/templates/opendkim.conf.j2 index 52c0c30..04ef392 100644 --- a/templates/opendkim.conf.j2 +++ b/templates/opendkim.conf.j2 @@ -21,7 +21,8 @@ OversignHeaders From # setup options can be found in /usr/share/doc/opendkim/README.opendkim. Domain {{ postfix_domain }} Selector {{ dkim_selector }} -KeyFile {{ dkim_key_path}}/{{ dkim_selector }}.private +KeyTable {{ dkim_key_path }}/KeyTable +SigningTable refile:{{ dkim_key_path }}/SigningTable # In Debian, opendkim runs as user "opendkim". A umask of 007 is required when # using a local socket with MTAs that access the socket as a non-privileged diff --git a/templates/signingtable.j2 b/templates/signingtable.j2 new file mode 100644 index 0000000..efc1a91 --- /dev/null +++ b/templates/signingtable.j2 @@ -0,0 +1,8 @@ +{% if postfix_virtual_domains|length > 0 %} +*@{{ postfix_domain }} {{ dkim_selector }}._domainkey.{{ postfix_domain }} +{% for domain in postfix_virtual_domains %} +*@{{ domain.name }} {{ dkim_selector }}._domainkey.{{ domain.name }} +{% endfor %} +{% else %} +*@{{ postfix_domain }} {{ dkim_selector }}._domainkey.{{ postfix_domain }} +{% endif %} \ No newline at end of file