summaryrefslogtreecommitdiffstats
path: root/roles/amavis
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2018-12-05 15:47:34 +0100
committerGuilhem Moulin <guilhem@fripost.org>2018-12-05 16:24:12 +0100
commit9722d50b9b6c5ccd81892a00bdd3023399b004fb (patch)
tree10ff7840e4c924d51217a122ac5f4a7bcb56a476 /roles/amavis
parentc21b92d9b79a80a27607618666b56fbc5cd26ac8 (diff)
DKIM: also include the "d=" tag in key filenames, not only the "s=" tag.
While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily.
Diffstat (limited to 'roles/amavis')
-rw-r--r--roles/amavis/tasks/main.yml10
-rw-r--r--roles/amavis/templates/etc/amavis/conf.d/50-user.j22
2 files changed, 6 insertions, 6 deletions
diff --git a/roles/amavis/tasks/main.yml b/roles/amavis/tasks/main.yml
index 92a0e81..3036c52 100644
--- a/roles/amavis/tasks/main.yml
+++ b/roles/amavis/tasks/main.yml
@@ -52,8 +52,8 @@
- dkim
- name: Generate a private key for DKIM signing
- command: genkeypair.sh dkim --privkey=/etc/amavis/dkim/{{ item }}.pem -t rsa -b 2048
- with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+ command: genkeypair.sh dkim --privkey="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem" -t rsa -b 2048
+ with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}"
register: dkim
changed_when: dkim.rc == 0
failed_when: dkim.rc > 1
@@ -66,9 +66,9 @@
- name: Fetch DKIM keys
fetch_cmd: cmd="openssl pkey -pubout -outform PEM"
- stdin=/etc/amavis/dkim/{{ item }}.pem
- dest=certs/dkim/{{ item }}.pub
- with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+ stdin="/etc/amavis/dkim/{{ item.s }}:{{ item.d }}.pem"
+ dest="certs/dkim/{{ item.s }}:{{ item.d }}.pub"
+ with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | list }}"
tags:
- genkey
- dkim
diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
index f3ff416..a09c366 100644
--- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
+++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
@@ -33,7 +33,7 @@ $enable_dkim_signing = 1;
# Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is
# safe as we force our domain with the 'd' tag).
{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%}
-dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem');
+dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem');
{% endfor -%}
@dkim_signature_options_bysender_maps = (
{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %}