From c21b92d9b79a80a27607618666b56fbc5cd26ac8 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 3 Dec 2018 23:13:04 +0100
Subject: Upgrade DKIM keys to rsa2048, and allow for multiple keys.

---
 roles/amavis/handlers/main.yml                      |  4 ----
 roles/amavis/tasks/main.yml                         | 19 +++++++++++++++----
 roles/amavis/templates/etc/amavis/conf.d/50-user.j2 | 18 +++++++++++++-----
 3 files changed, 28 insertions(+), 13 deletions(-)

(limited to 'roles')

diff --git a/roles/amavis/handlers/main.yml b/roles/amavis/handlers/main.yml
index 62cc6fc..684be0f 100644
--- a/roles/amavis/handlers/main.yml
+++ b/roles/amavis/handlers/main.yml
@@ -2,10 +2,6 @@
 - name: Restart ClamAV
   service: name=clamav-daemon state=restarted
 
-- name: Publish the public key to the DNS zone
-  # See the output of 'genkeypair.sh dkim --privkey=/path/to/key'
-  fail: "msg={{ dkim.stdout }}"
-
 - name: Restart Amavis
   service: name=amavis state=restarted
 
diff --git a/roles/amavis/tasks/main.yml b/roles/amavis/tasks/main.yml
index 936703a..92a0e81 100644
--- a/roles/amavis/tasks/main.yml
+++ b/roles/amavis/tasks/main.yml
@@ -41,26 +41,37 @@
            owner=root group=root
            mode=0644
 
-- name: Create directory /var/lib/dkim
-  file: path=/var/lib/dkim
+- name: Create directory /etc/amavis/dkim
+  file: path=/etc/amavis/dkim
         state=directory
         owner=root group=root
         mode=0755
   when: "'out' in group_names"
   tags:
     - genkey
+    - dkim
 
 - name: Generate a private key for DKIM signing
-  command: genkeypair.sh dkim --privkey=/var/lib/dkim/20140703.fripost.org.key -t rsa -b 1024
+  command: genkeypair.sh dkim --privkey=/etc/amavis/dkim/{{ item }}.pem -t rsa -b 2048
+  with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
   register: dkim
   changed_when: dkim.rc == 0
   failed_when: dkim.rc > 1
   when: "'out' in group_names"
   notify:
     - Restart Amavis
-    - Publish the public key to the DNS zone
   tags:
     - genkey
+    - dkim
+
+- name: Fetch DKIM keys
+  fetch_cmd: cmd="openssl pkey -pubout -outform PEM"
+             stdin=/etc/amavis/dkim/{{ item }}.pem
+             dest=certs/dkim/{{ item }}.pub
+  with_items: "{{ (dkim_keys[inventory_hostname_short] | default({})).values() | map(attribute='s') | list }}"
+  tags:
+    - genkey
+    - dkim
 
 - name: Configure Amavis
   template: src=etc/amavis/conf.d/50-user.j2
diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
index 26bcdb9..f3ff416 100644
--- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
+++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
@@ -32,12 +32,20 @@ undef $enable_dkim_signing;
 $enable_dkim_signing = 1;
 # Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is
 # safe as we force our domain with the 'd' tag).
-dkim_key(qr/./, '20140703', '/var/lib/dkim/20140703.'.$mydomain.'.key');
+{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%}
+dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}.pem');
+{% endfor -%}
 @dkim_signature_options_bysender_maps = (
-    { '.' => { d => $mydomain
-             , a => 'rsa-sha256'
-             , ttl => 21*24*3600
-             , c => 'relaxed/simple' } } );
+{% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %}
+    { '{{ (x == "~") | ternary('.', x) }}' => {
+        d => '{{ k.d }}'
+      , a => 'rsa-sha256'
+      , ttl => 21*24*3600
+      , c => 'relaxed/simple' }
+    }{% if not loop.last %},
+{% endif %}
+{% endfor %}
+);
 # Conform to RFC 4871 and don't sign Received: headers.
 $signed_header_fields{received} = 0;
 {% endif %}
-- 
cgit v1.2.3