DKIM: also include the "d=" tag in key filenames, not only the "s=" tag.

While the combination of "s=" tag (selector) & "d=" tag signing domain
maps to a unique key, the selector alone doesn't necessarily.

2 files changed, 6 insertions, 6 deletions

diff --git a/roles/amavis/tasks/main.yml b/roles/amavis/tasks/main.yml
index 92a0e81..3036c52 100644
--- a/roles/amavis/tasks/main.yml
+++ b/roles/amavis/tasks/main.yml
@@ -35,57 +35,57 @@
   lineinfile: dest=/etc/aliases create=yes
               regexp="^amavis{{':'}} "
               line="amavis{{':'}} root"
 
 - name: Compile the static local Postfix database
   postmap: cmd=postalias src=/etc/aliases db=lmdb
            owner=root group=root
            mode=0644
 
 - name: Create directory /etc/amavis/dkim
   file: path=/etc/amavis/dkim
         state=directory
         owner=root group=root
         mode=0755
   when: "'out' in group_names"
   tags:
     - genkey
     - dkim
 
 - name: Generate a private key for DKIM signing
-  command: genkeypair.sh dkim --privkey=/etc/amavis/dkim/{{ item }}.pem -t rsa -b 2048
-  with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+  command: genkeypair.sh dkim --privkey="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem" -t rsa -b 2048
+  with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}"
   register: dkim
   changed_when: dkim.rc == 0
   failed_when: dkim.rc > 1
   when: "'out' in group_names"
   notify:
     - Restart Amavis
   tags:
     - genkey
     - dkim
 
 - name: Fetch DKIM keys
   fetch_cmd: cmd="openssl pkey -pubout -outform PEM"
-             stdin=/etc/amavis/dkim/{{ item }}.pem
-             dest=certs/dkim/{{ item }}.pub
-  with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+             stdin="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem"
+             dest="certs/dkim/{{ item.s }}:{{ item.d }}.pub"
+  with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}"
   tags:
     - genkey
     - dkim
 
 - name: Configure Amavis
   template: src=etc/amavis/conf.d/50-user.j2
             dest=/etc/amavis/conf.d/50-user
             owner=root group=root
             mode=0644
   register: r3
   notify:
     - Restart Amavis
 
 - meta: flush_handlers
 
 - name: Start Amavis
   service: name=amavis state=started
 
 
 - name: Install 'amavis' Munin plugin
diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
index f3ff416..a09c366 100644
--- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
+++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
@@ -16,41 +16,41 @@ use strict;
 $max_servers = 5;
 $recipient_delimiter = '+';
 
 $mydomain = 'fripost.org';
 $X_HEADER_LINE = "Debian $myproduct_name at $mydomain";
 
 @mynetworks_maps = ();
 @remove_existing_spam_headers_maps = ();
 @bypass_virus_checks_maps = (); # load virus checking code
 
 
 $enable_dkim_verification = 1; # load DKIM signing/verifying code
 {% if 'out' not in group_names %}
 undef $enable_dkim_signing;
 @bypass_spam_checks_maps = (); # load spam checking code
 {% else %}
 $enable_dkim_signing = 1;
 # Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is
 # safe as we force our domain with the 'd' tag).
 {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%}
-dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem');
+dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem');
 {% endfor -%}
 @dkim_signature_options_bysender_maps = (
 {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %}
     { '{{ (x == "~") | ternary('.', x) }}' => {
         d => '{{ k.d }}'
       , a => 'rsa-sha256'
       , ttl => 21*24*3600
       , c => 'relaxed/simple' }
     }{% if not loop.last %},
 {% endif %}
 {% endfor %}
 );
 # Conform to RFC 4871 and don't sign Received: headers.
 $signed_header_fields{received} = 0;
 {% endif %}
 
 
 
 # Defang viruses and nothing else
 %defang_maps_by_ccat = ( &CC_VIRUS    => 1