From a9c79689a9150c67c3bc133463c71aa887a8ebc9 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 13 Apr 2020 16:18:14 +0200 Subject: Add own DKIM key for debian.org address. Cf. https://lists.debian.org/debian-devel-announce/2020/04/msg00004.html . \o/ It's also fairly easy to deploy onto the Debian infrastucture: $ USERNAME="guilhem" $ SELECTOR="5d30c523ff3622ed454230a16a11ddf6.$USERNAME.user" $ printf "dkimPubKey: %s %s\n" "$SELECTOR" \ "$(openssl pkey -pubin -in "./certs/dkim/$SELECTOR:debian.org.pub" -outform DER | base64 -w0)" \ | gpg --clearsign | s-nail -r "USERNAME@debian.org" -s dkimPubKey changes@db.debian.org --- .../5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub | 9 +++++++++ group_vars/all.yml | 3 +++ roles/amavis/templates/etc/amavis/conf.d/50-user.j2 | 3 ++- 3 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub diff --git a/certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub b/certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub new file mode 100644 index 0000000..bc14abf --- /dev/null +++ b/certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub @@ -0,0 +1,9 @@ +-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvGwfj6qfh15Nr/fLITGU +ES9Vxtjqz6XR8uYifT9P6n80yVLLF0mCVvekSsH8Y8ZShmDmlqrNAM8i5MyKSGTq +nMTABFlXa0bCHSjY3MNTG0PEn2yUGuc2IsmZWps8oaut5AGirEHoKjx/p2TpcFlD +8DsyojlFbsIYmAQe65nfliDM8Qiu7NgJlghfRTTBTeXJ2yijrPymBFhJ1z1GWxUm +nJHzj4I5ySvOmNgCVfv6nP6OjaGOdso8hiS6rse84evRlczFp+IQ/3ErP4HyNZlS +gHFwRzcENwFdiZ9H3KjM5MUwUJ9ifyy1n2bH/5LOVEsqzmbVJqwrTi1gIP3JQL9z +EwIDAQAB +-----END PUBLIC KEY----- diff --git a/group_vars/all.yml b/group_vars/all.yml index 4fcfc39..abafc8e 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -58,3 +58,6 @@ dkim_keys: "~": # catch-all, for our virtual domains d: x.fripost.org s: 9df9cdc7e101629b5003b587945afa70 + "guilhem@debian.org": + d: debian.org + s: 5d30c523ff3622ed454230a16a11ddf6.guilhem.user diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 index a09c366..8563a8c 100644 --- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 +++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 @@ -33,12 +33,13 @@ $enable_dkim_signing = 1; # Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is # safe as we force our domain with the 'd' tag). {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%} -dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem'); +dkim_key({{ (x == "~") | ternary('qr/./', "'"+(x | regex_replace('^.*@',''))+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem'); {% endfor -%} @dkim_signature_options_bysender_maps = ( {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %} { '{{ (x == "~") | ternary('.', x) }}' => { d => '{{ k.d }}' + , s => '{{ k.s }}' , a => 'rsa-sha256' , ttl => 21*24*3600 , c => 'relaxed/simple' } -- cgit v1.2.3