#!/bin/bash # shellcheck source=../scripts/helpers/index.sh source /usr/local/bin/helpers/index.sh if [[ -f /etc/dms-settings ]] && [[ $(_get_dms_env_value 'ENABLE_RSPAMD') -eq 1 ]]; then if [[ $(_get_dms_env_value 'ENABLE_OPENDKIM') -eq 1 ]]; then log 'error' "You enabled Rspamd and OpenDKIM - OpenDKIM will be implicitly used for DKIM keys" else /usr/local/bin/rspamd-dkim "${@}" exit fi fi KEYSIZE=2048 SELECTOR=mail DOMAINS= function __usage() { printf '%s' "${PURPLE}OPEN-DKIM${RED}(${YELLOW}8${RED}) ${ORANGE}NAME${RESET} open-dkim - Configure DKIM (DomainKeys Identified Mail) ${ORANGE}SYNOPSIS${RESET} setup config dkim [ OPTIONS${RED}...${RESET} ] ${ORANGE}DESCRIPTION${RESET} Creates DKIM keys and configures them within DMS for OpenDKIM. OPTIONS can be used when your requirements are not met by the defaults. When not using 'ACCOUNT_PROVISIONER=FILE' (default), you may need to explicitly use the 'domain' option to generate DKIM keys for your mail account domains. ${ORANGE}OPTIONS${RESET} ${BLUE}Generic Program Information${RESET} help Print the usage information. ${BLUE}Configuration adjustments${RESET} keysize Set the size of the keys to be generated. Possible values: 1024, 2048 and 4096 Default: 2048 selector Set a manual selector for the key. Default: mail domain Provide the domain(s) for which to generate keys for. Default: The FQDN assigned to DMS, excluding any subdomain. 'ACCOUNT_PROVISIONER=FILE' also sources domains from mail accounts. ${ORANGE}EXAMPLES${RESET} ${LWHITE}setup config dkim keysize 4096${RESET} Creates keys with their length increased to a size of 4096-bit. ${LWHITE}setup config dkim keysize 1024 selector 2023-dkim${RESET} Creates 1024-bit sized keys, and changes the DKIM selector to '2023-dkim'. ${LWHITE}setup config dkim domain 'example.com,another-example.com'${RESET} Only generates DKIM keys for the specified domains: 'example.com' and 'another-example.com'. ${ORANGE}EXIT STATUS${RESET} Exit status is 0 if command was successful. If wrong arguments are provided or arguments contain errors, the script will exit early with exit status 2. " } _require_n_parameters_or_print_usage 0 "${@}" while [[ ${#} -gt 0 ]]; do case "${1}" in ( 'keysize' ) if [[ -n ${2+set} ]]; then KEYSIZE="${2}" shift shift else _exit_with_error "No keysize provided after 'keysize' argument" fi ;; ( 'selector' ) if [[ -n ${2+set} ]]; then # shellcheck disable=SC2034 SELECTOR="${2}" shift shift else _exit_with_error "No selector provided after 'selector' argument" fi ;; ( 'domain' ) if [[ -n ${2+set} ]]; then DOMAINS="${2}" shift shift else _exit_with_error "No domain(s) provided after 'domain' argument" fi ;; ( * ) __usage _exit_with_error "Unknown options '${1}' ${2:+and \'${2}\'}" ;; esac done DATABASE_VHOST='/tmp/vhost.dkim' # Prepare a file with one domain per line: function _generate_domains_config() { local TMP_VHOST='/tmp/vhost.dkim.tmp' # Generate the default vhost (equivalent to /etc/postfix/vhost), # unless CLI arg DOMAINS provided an alternative list to use instead: if [[ -z ${DOMAINS} ]]; then _obtain_hostname_and_domainname # uses TMP_VHOST: _vhost_collect_postfix_domains else tr ',' '\n' <<< "${DOMAINS}" >"${TMP_VHOST}" fi # uses DATABASE_VHOST + TMP_VHOST: _create_vhost } _generate_domains_config if [[ ! -s ${DATABASE_VHOST} ]]; then _log 'warn' 'No entries found, no keys to make' exit 0 fi while read -r DKIM_DOMAIN; do mkdir -p "/tmp/docker-mailserver/opendkim/keys/${DKIM_DOMAIN}" if [[ ! -f "/tmp/docker-mailserver/opendkim/keys/${DKIM_DOMAIN}/${SELECTOR}.private" ]]; then _log 'info' "Creating DKIM private key '/tmp/docker-mailserver/opendkim/keys/${DKIM_DOMAIN}/${SELECTOR}.private'" opendkim-genkey \ --bits="${KEYSIZE}" \ --subdomains \ --domain="${DKIM_DOMAIN}" \ --selector="${SELECTOR}" \ --directory="/tmp/docker-mailserver/opendkim/keys/${DKIM_DOMAIN}" fi # write to KeyTable if necessary KEYTABLEENTRY="${SELECTOR}._domainkey.${DKIM_DOMAIN} ${DKIM_DOMAIN}:${SELECTOR}:/etc/opendkim/keys/${DKIM_DOMAIN}/${SELECTOR}.private" if [[ ! -f "/tmp/docker-mailserver/opendkim/KeyTable" ]]; then _log 'debug' 'Creating DKIM KeyTable' echo "${KEYTABLEENTRY}" >/tmp/docker-mailserver/opendkim/KeyTable else if ! grep -q "${KEYTABLEENTRY}" "/tmp/docker-mailserver/opendkim/KeyTable"; then echo "${KEYTABLEENTRY}" >>/tmp/docker-mailserver/opendkim/KeyTable fi fi # write to SigningTable if necessary SIGNINGTABLEENTRY="*@${DKIM_DOMAIN} ${SELECTOR}._domainkey.${DKIM_DOMAIN}" if [[ ! -f /tmp/docker-mailserver/opendkim/SigningTable ]]; then _log 'debug' 'Creating DKIM SigningTable' echo "*@${DKIM_DOMAIN} ${SELECTOR}._domainkey.${DKIM_DOMAIN}" >/tmp/docker-mailserver/opendkim/SigningTable else if ! grep -q "${SIGNINGTABLEENTRY}" /tmp/docker-mailserver/opendkim/SigningTable; then echo "${SIGNINGTABLEENTRY}" >>/tmp/docker-mailserver/opendkim/SigningTable fi fi done < <(_get_valid_lines_from_file "${DATABASE_VHOST}") # create TrustedHosts if missing if [[ -d /tmp/docker-mailserver/opendkim ]] && [[ ! -f /tmp/docker-mailserver/opendkim/TrustedHosts ]]; then _log 'debug' 'Creating DKIM TrustedHosts' echo "127.0.0.1" >/tmp/docker-mailserver/opendkim/TrustedHosts echo "localhost" >>/tmp/docker-mailserver/opendkim/TrustedHosts fi