summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2018-12-03 23:13:04 +0100
committerGuilhem Moulin <guilhem@fripost.org>2018-12-04 01:14:45 +0100
commitc21b92d9b79a80a27607618666b56fbc5cd26ac8 (patch)
tree264c8800eac3d6aeac734bbf43fdde40a16781ff /roles
parent50d5b3827eb9e342e499c053f330ac0bcfe424fa (diff)
Upgrade DKIM keys to rsa2048, and allow for multiple keys.
Diffstat (limited to 'roles')
-rw-r--r--roles/amavis/handlers/main.yml4
-rw-r--r--roles/amavis/tasks/main.yml19
-rw-r--r--roles/amavis/templates/etc/amavis/conf.d/50-user.j218
3 files changed, 28 insertions, 13 deletions
diff --git a/roles/amavis/handlers/main.yml b/roles/amavis/handlers/main.yml
index 62cc6fc..684be0f 100644
--- a/roles/amavis/handlers/main.yml
+++ b/roles/amavis/handlers/main.yml
@@ -2,10 +2,6 @@
- name: Restart ClamAV
service: name=clamav-daemon state=restarted
-- name: Publish the public key to the DNS zone
- # See the output of 'genkeypair.sh dkim --privkey=/path/to/key'
- fail: "msg={{ dkim.stdout }}"
-
- name: Restart Amavis
service: name=amavis state=restarted
diff --git a/roles/amavis/tasks/main.yml b/roles/amavis/tasks/main.yml
index 936703a..92a0e81 100644
--- a/roles/amavis/tasks/main.yml
+++ b/roles/amavis/tasks/main.yml
@@ -41,26 +41,37 @@
owner=root group=root
mode=0644
-- name: Create directory /var/lib/dkim
- file: path=/var/lib/dkim
+- name: Create directory /etc/amavis/dkim
+ file: path=/etc/amavis/dkim
state=directory
owner=root group=root
mode=0755
when: "'out' in group_names"
tags:
- genkey
+ - dkim
- name: Generate a private key for DKIM signing
- command: genkeypair.sh dkim --privkey=/var/lib/dkim/20140703.fripost.org.key -t rsa -b 1024
+ command: genkeypair.sh dkim --privkey=/etc/amavis/dkim/{{ item }}.pem -t rsa -b 2048
+ with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
register: dkim
changed_when: dkim.rc == 0
failed_when: dkim.rc > 1
when: "'out' in group_names"
notify:
- Restart Amavis
- - Publish the public key to the DNS zone
tags:
- genkey
+ - dkim
+
+- name: Fetch DKIM keys
+ fetch_cmd: cmd="openssl pkey -pubout -outform PEM"
+ stdin=/etc/amavis/dkim/{{ item }}.pem
+ dest=certs/dkim/{{ item }}.pub
+ with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+ tags:
+ - genkey
+ - dkim
- name: Configure Amavis
template: src=etc/amavis/conf.d/50-user.j2
diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
index 26bcdb9..f3ff416 100644
--- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
+++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
@@ -32,12 +32,20 @@ undef $enable_dkim_signing;
$enable_dkim_signing = 1;
# Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is
# safe as we force our domain with the 'd' tag).
-dkim_key(qr/./, '20140703', '/var/lib/dkim/20140703.'.$mydomain.'.key');
+{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%}
+dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem');
+{% endfor -%}
@dkim_signature_options_bysender_maps = (
- { '.' => { d => $mydomain
- , a => 'rsa-sha256'
- , ttl => 21*24*3600
- , c => 'relaxed/simple' } } );
+{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %}
+ { '{{ (x == "~") | ternary('.', x) }}' => {
+ d => '{{ k.d }}'
+ , a => 'rsa-sha256'
+ , ttl => 21*24*3600
+ , c => 'relaxed/simple' }
+ }{% if not loop.last %},
+{% endif %}
+{% endfor %}
+);
# Conform to RFC 4871 and don't sign Received: headers.
$signed_header_fields{received} = 0;
{% endif %}