From a72c8440f8ab6d2c1bfb598a14c961b32f9dcfb0 Mon Sep 17 00:00:00 2001
From: Brian Lee <blee@satstack.cloud>
Date: Wed, 29 May 2024 11:58:31 -0700
Subject: [PATCH] Add DKIM signing when using multiple domains.

---
 tasks/opendkim.yml         | 39 ++++++++++++++++++++++++++++++++++----
 templates/keytable.j2      |  8 ++++++++
 templates/opendkim.conf.j2 |  3 ++-
 templates/signingtable.j2  |  8 ++++++++
 4 files changed, 53 insertions(+), 5 deletions(-)
 create mode 100644 templates/keytable.j2
 create mode 100644 templates/signingtable.j2

diff --git a/tasks/opendkim.yml b/tasks/opendkim.yml
index 7bd54d0..d578419 100644
--- a/tasks/opendkim.yml
+++ b/tasks/opendkim.yml
@@ -21,14 +21,45 @@
     mode: '0770'
   notify: restart opendkim
 
-- name: Generate DKIM signing key
+#- name: Generate DKIM signing key
+#  ansible.builtin.command:
+#    cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ postfix_domain }} --directory /etc/dkimkeys"
+#    creates: "/etc/dkimkeys/{{ dkim_selector }}.private"
+#  become: true
+#  become_user: opendkim
+#  notify: restart opendkim
+
+- name: Ensure DKIM directories exist for each domain
+  ansible.builtin.file:
+    path: "/etc/dkimkeys/{{ item.name }}"
+    state: directory
+    owner: opendkim
+    group: opendkim
+    mode: '0750'
+  loop: "{{ [{'name': postfix_domain}] + postfix_virtual_domains }}"
+
+- name: Generate DKIM signing keys for each domain
   ansible.builtin.command:
-    cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ postfix_domain }} --directory /etc/dkimkeys"
-    creates: "/etc/dkimkeys/{{ dkim_selector }}.private"
-  become: true
+    cmd: "opendkim-genkey -r -s {{ dkim_selector }} -b 2048 -d {{ item.name }} --directory /etc/dkimkeys/{{ item.name }}"
+    creates: "/etc/dkimkeys/{{ item.name }}/{{ dkim_selector }}.private"
+  loop: "{{ [{'name': postfix_domain}] + postfix_virtual_domains }}"
   become_user: opendkim
   notify: restart opendkim
 
+- name: Configure the KeyTable
+  ansible.builtin.template:
+    src: keytable.j2
+    dest: "{{ dkim_key_path }}/KeyTable"
+    mode: '0644'
+  notify: restart opendkim
+
+- name: Configuring the SigningTable
+  ansible.builtin.template:
+    src: signingtable.j2
+    dest: "{{ dkim_key_path }}/SigningTable"
+    mode: '0644'
+  notify: restart opendkim
+
 - name: Ensure postfix is in opendkim group
   ansible.builtin.user:
     name: postfix
diff --git a/templates/keytable.j2 b/templates/keytable.j2
new file mode 100644
index 0000000..5d8b7a2
--- /dev/null
+++ b/templates/keytable.j2
@@ -0,0 +1,8 @@
+{% if postfix_virtual_domains|length > 0 %}
+{{ dkim_selector }}._domainkey.{{ postfix_domain }} {{ postfix_domain }}:mail:/etc/dkimkeys/{{ postfix_domain }}/{{ dkim_selector }}.private
+{% for domain in postfix_virtual_domains %}
+{{ dkim_selector }}._domainkey.{{ domain.name }} {{ domain.name }}:mail:/etc/dkimkeys/{{ domain.name }}/{{ dkim_selector }}.private
+{% endfor %}
+{% else %}
+{{ dkim_selector }}._domainkey.{{ postfix_domain }} {{ postfix_domain }}:mail:/etc/dkimkeys/{{ postfix_domain }}/{{ dkim_selector }}.private
+{% endif %}
\ No newline at end of file
diff --git a/templates/opendkim.conf.j2 b/templates/opendkim.conf.j2
index 52c0c30..04ef392 100644
--- a/templates/opendkim.conf.j2
+++ b/templates/opendkim.conf.j2
@@ -21,7 +21,8 @@ OversignHeaders		From
 # setup options can be found in /usr/share/doc/opendkim/README.opendkim.
 Domain			{{ postfix_domain }}
 Selector		{{ dkim_selector }}
-KeyFile		    {{ dkim_key_path}}/{{ dkim_selector }}.private
+KeyTable        {{ dkim_key_path }}/KeyTable
+SigningTable      refile:{{ dkim_key_path }}/SigningTable
 
 # In Debian, opendkim runs as user "opendkim". A umask of 007 is required when
 # using a local socket with MTAs that access the socket as a non-privileged
diff --git a/templates/signingtable.j2 b/templates/signingtable.j2
new file mode 100644
index 0000000..efc1a91
--- /dev/null
+++ b/templates/signingtable.j2
@@ -0,0 +1,8 @@
+{% if postfix_virtual_domains|length > 0 %}
+*@{{ postfix_domain }} {{ dkim_selector }}._domainkey.{{ postfix_domain }}
+{% for domain in postfix_virtual_domains %}
+*@{{ domain.name }} {{ dkim_selector }}._domainkey.{{ domain.name }}
+{% endfor %}
+{% else %}
+*@{{ postfix_domain }} {{ dkim_selector }}._domainkey.{{ postfix_domain }}
+{% endif %}
\ No newline at end of file