Skip to content

Commit fed57b4

Browse files
jchristgitjchristgit
committed
Set up new dkim milter
The existing `opendkim` milter is no longer maintained. This commit introduces a role which deploys `dkim-milter`. As-is, it is not a complete replacement, since the role does not (yet) migrate keys of the old `opendkim` setup.
1 parent 3a266af commit fed57b4

File tree

6 files changed

+196
-1
lines changed

6 files changed

+196
-1
lines changed

‎ansible/playbook.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
- name: Deploy mailservers
2222
hosts: mail
2323
roles:
24-
- opendkim
24+
- dkim-milter
2525
- opendmarc
2626
- opendmarc-inbox
2727
- sasl

‎ansible/roles/dkim-milter/handlers/main.yml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
- name: Reload dkim-milter
3+
ansible.builtin.service:
4+
name: dkim-milter.service
5+
state: restarted
6+
tags:
7+
- role::dkim-milter
8+
9+
- name: Restart dkim-milter
10+
ansible.builtin.service:
11+
name: dkim-milter.service
12+
state: restarted
13+
tags:
14+
- role::dkim-milter

‎ansible/roles/dkim-milter/tasks/main.yml

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
---
2+
- name: Install opendkim-tools
3+
# Used currently to generate keys. Could theoretically replace this with dkimdo
4+
# https://codeberg.org/glts/dkimdo
5+
ansible.builtin.package:
6+
name: opendkim-tools
7+
state: present
8+
tags:
9+
- role::dkim-milter
10+
11+
- name: Pull dkim-milter AppImage from Uncle Christ
12+
ansible.builtin.get_url:
13+
checksum: sha256:{{ dkim_milter_package_root }}/sha256sums.txt
14+
url: "{{ dkim_milter_package_root }}/dkim-milter"
15+
dest: /usr/local/sbin/dkim-milter
16+
owner: root
17+
group: root
18+
mode: 0o755
19+
vars:
20+
dkim_milter_version: 0.2.0-alpha.1
21+
uncle_christ_package_root: https://git.jchri.st/api/packages/jc/generic
22+
dkim_milter_package_root: "{{ uncle_christ_package_root }}/dkim-milter/{{ dkim_milter_version }}"
23+
tags:
24+
- role::dkim-milter
25+
# https://codeberg.org/forgejo/forgejo/issues/6871
26+
when:
27+
- not ansible_check_mode
28+
29+
- name: Create dkim-milter user
30+
ansible.builtin.user:
31+
name: dkim-milter
32+
home: /var/lib/dkim-milter
33+
group: dkim-milter
34+
create_home: false
35+
system: true
36+
shell: /usr/sbin/nologin
37+
tags:
38+
- role::dkim-milter
39+
40+
- name: Create dkim-milter directory
41+
ansible.builtin.file:
42+
path: /etc/dkim-milter
43+
state: directory
44+
owner: dkim-milter
45+
group: dkim-milter
46+
mode: 0o700
47+
tags:
48+
- role::dkim-milter
49+
50+
- name: Create dkim-milter keys directory
51+
ansible.builtin.file:
52+
path: /etc/dkim-milter/keys
53+
state: directory
54+
owner: dkim-milter
55+
group: dkim-milter
56+
mode: 0o700
57+
tags:
58+
- role::dkim-milter
59+
60+
- name: Template dkim-milter configuration file
61+
ansible.builtin.template:
62+
src: dkim-milter.conf.j2
63+
dest: /etc/dkim-milter/dkim-milter.conf
64+
owner: dkim-milter
65+
group: dkim-milter
66+
mode: 0o400
67+
notify:
68+
- Reload dkim-milter
69+
tags:
70+
- role::dkim-milter
71+
72+
- name: Template signing-keys file
73+
ansible.builtin.copy:
74+
content: |
75+
{% for domain in dkim_milter_domains %}
76+
{% set keyname = (domain | replace(".", "_")) %}
77+
{{ keyname }} < /etc/dkim-milter/keys/{{ keyname }}.pem
78+
{% endfor %}
79+
{% for item in dkim_milter_extra_signings %}
80+
{% set keyname = (item['domain'] | replace(".", "_")) %}
81+
{{ keyname }} < /etc/dkim-milter/keys/{{ keyname }}.pem
82+
{% endfor %}
83+
dest: /etc/dkim-milter/signing-keys
84+
owner: dkim-milter
85+
group: dkim-milter
86+
mode: 0o400
87+
notify:
88+
- Reload dkim-milter
89+
tags:
90+
- role::dkim-milter
91+
92+
- name: Template signing-senders file
93+
ansible.builtin.copy:
94+
content: |
95+
# Sender expression Domain Selector Key name
96+
{% for domain in dkim_milter_domains %}
97+
{% set keyname = (domain | replace(".", "_")) %}
98+
.{{ domain }} {{ domain }} {{ dkim_milter_selector }} {{ keyname }}
99+
{% endfor %}
100+
{% for item in dkim_milter_extra_signings %}
101+
{% set keyname = (item['use_key'] | replace(".", "_")) %}
102+
{% set domain = item['domain'] %}
103+
.{{ domain }} {{ domain }} {{ dkim_milter_selector }} {{ keyname }}
104+
{% endfor %}
105+
dest: /etc/dkim-milter/signing-senders
106+
owner: dkim-milter
107+
group: dkim-milter
108+
mode: 0o400
109+
notify:
110+
- Reload dkim-milter
111+
tags:
112+
- role::dkim-milter
113+
114+
- name: Generate dkim keys
115+
become: true
116+
become_user: dkim-milter
117+
ansible.builtin.command: |
118+
opendkim-genkey -D /etc/dkim-milter/keys/{{ item }} -d {{ item }} -s {{ dkim_milter_selector }}
119+
with_items:
120+
- "{{ dkim_milter_domains }}"
121+
args:
122+
creates: /etc/dkim-milter/keys/{{ item }}/{{ dkim_milter_selector }}.private
123+
notify:
124+
- Reload dkim-milter
125+
tags:
126+
- role::dkim-milter
127+
128+
- name: Template systemd service
129+
ansible.builtin.template:
130+
src: dkim-milter.service.j2
131+
dest: /etc/systemd/system/dkim-milter.service
132+
owner: root
133+
group: root
134+
mode: 0o444
135+
register: dkim_milter_service
136+
notify:
137+
- Restart dkim-milter
138+
tags:
139+
- role::dkim-milter
140+
141+
- name: Start and enable dkim-milter
142+
ansible.builtin.service:
143+
name: dkim-milter.service
144+
state: started
145+
enabled: true
146+
daemon_reload: "{{ dkim_milter_service is changed }}"
147+
tags:
148+
- role::dkim-milter

‎ansible/roles/dkim-milter/templates/dkim-milter.conf.j2

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
signing_keys = </etc/dkim-milter/signing-keys
2+
signing_senders = </etc/dkim-milter/signing-senders

‎ansible/roles/dkim-milter/templates/dkim-milter.service.j2

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# {{ ansible_managed }}
2+
3+
[Unit]
4+
Description=DKIM Milter
5+
# Documentation=man:dkim-milter(8) man:dkim-milter.conf(5)
6+
After=network-online.target nss-lookup.target
7+
Wants=network-online.target
8+
9+
[Service]
10+
User=dkim-milter
11+
ExecStart=/usr/local/sbin/dkim-milter
12+
ExecReload=/bin/kill -HUP $MAINPID
13+
Restart=on-failure
14+
15+
# schizophrenia
16+
ProtectSystem=full
17+
18+
[Install]
19+
WantedBy=multi-user.target
20+
21+
# vim: ft=dosini.jinja2:

‎ansible/roles/dkim-milter/vars/main.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
dkim_milter_domains:
3+
- pydis.wtf
4+
- pydis.com
5+
- pythondiscord.com
6+
- owlcorp.uk
7+
dkim_milter_extra_signings:
8+
- domain: int.pydis.wtf
9+
use_key: pydis.wtf
10+
dkim_milter_selector: lovelace

0 commit comments

Comments
 (0)