--- /dev/null
+#mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/mail.private
+#mail._domainkey.example.net example.net:mail:/etc/opendkim/keys/example.net/mail.private
+#mail._domainkey.example.org example.org:mail:/etc/opendkim/keys/example.org/mail.private
--- /dev/null
+#*@example.com mail._domainkey.example.com
+#*@example.net mail._domainkey.example.net
+#*@example.org mail._domainkey.example.org
--- /dev/null
+127.0.0.1
+localhost
+192.168.0.1/24
+
+#*.example.com
+#*.example.net
+#*.example.org
--- /dev/null
+# Command-line options specified here will override the contents of
+# /etc/opendkim.conf. See opendkim(8) for a complete list of options.
+#DAEMON_OPTS=""
+#
+# Uncomment to specify an alternate socket
+# Note that setting this will override any Socket value in opendkim.conf
+#SOCKET="local:/var/run/opendkim/opendkim.sock" # default
+#SOCKET="inet:54321" # listen on all interfaces on port 54321
+#SOCKET="inet:12345@localhost" # listen on loopback on port 12345
+#SOCKET="inet:12345@192.0.2.1" # listen on 192.0.2.1 on port 12345
+SOCKET="inet:12301@localhost"
--- /dev/null
+# This is a basic configuration that can easily be adapted to suit a standard
+# installation. For more advanced options, see opendkim.conf(5) and/or
+# /usr/share/doc/opendkim/examples/opendkim.conf.sample.
+
+# Log to syslog
+Syslog yes
+# Required to use local socket with MTAs that access the socket as a non-
+# privileged user (e.g. Postfix)
+UMask 002
+
+# Sign for example.com with key in /etc/mail/dkim.key using
+# selector '2007' (e.g. 2007._domainkey.example.com)
+#Domain example.com
+#KeyFile /etc/mail/dkim.key
+#Selector 2007
+
+# Commonly-used options; the commented-out versions show the defaults.
+#Canonicalization simple
+#Mode sv
+#SubDomains no
+#ADSPDiscard no
+
+# Always oversign From (sign using actual From and a null From to prevent
+# malicious signatures header fields (From and/or others) between the signer
+# and the verifier. From is oversigned by default in the Debian pacakge
+# because it is often the identity key used by reputation systems and thus
+# somewhat security sensitive.
+OversignHeaders From
+
+# List domains to use for RFC 6541 DKIM Authorized Third-Party Signatures
+# (ATPS) (experimental)
+
+#ATPSDomains example.com
+
+AutoRestart Yes
+AutoRestartRate 10/1h
+UMask 002
+Syslog yes
+SyslogSuccess Yes
+LogWhy Yes
+
+Canonicalization relaxed/simple
+
+ExternalIgnoreList refile:/etc/opendkim/TrustedHosts
+InternalHosts refile:/etc/opendkim/TrustedHosts
+KeyTable refile:/etc/opendkim/KeyTable
+SigningTable refile:/etc/opendkim/SigningTable
+
+Mode sv
+PidFile /var/run/opendkim/opendkim.pid
+SignatureAlgorithm rsa-sha256
+
+UserID opendkim:opendkim
+
+Socket inet:12301@localhost
--- /dev/null
+# Recipe from https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy
+class mail::opendkim {
+ include mail::opendkim::packages
+
+ file { '/etc/default/opendkim':
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 0644,
+ source => "puppet:///modules/mail/opendkim/default",
+ require => Package['opendkim'],
+ }
+
+ file { '/etc/opendkim.conf':
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 0644,
+ source => [ "puppet:///modules/mail/opendkim/opendkim.conf",
+ "puppet:///modules/site_mail/opendkim/opendkim.conf" ],
+ require => Package['opendkim'],
+ }
+
+ file { '/etc/opendkim':
+ ensure => directory,
+ owner => root,
+ group => root,
+ mode => 0644,
+ require => Package['opendkim'],
+ }
+
+ file { '/etc/opendkim/keys':
+ ensure => directory,
+ owner => opendkim,
+ group => opendkim,
+ mode => 0750,
+ require => File['/etc/opendkim'],
+ }
+
+ file { '/etc/opendkim/TrustedHosts':
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 0644,
+ source => [ "puppet:///modules/mail/opendkim/TrustedHosts",
+ "puppet:///modules/site_mail/opendkim/TrustedHosts" ],
+ require => File['/etc/opendkim'],
+ }
+
+ file { '/etc/opendkim/KeyTable':
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 0644,
+ source => [ "puppet:///modules/mail/opendkim/KeyTable",
+ "puppet:///modules/site_mail/opendkim/KeyTable" ],
+ require => File['/etc/opendkim'],
+ }
+
+ file { '/etc/opendkim/SigningTable':
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 0644,
+ source => [ "puppet:///modules/mail/opendkim/SigningTable",
+ "puppet:///modules/site_mail/opendkim/SigningTable" ],
+ require => File['/etc/opendkim'],
+ }
+
+ service { 'opendkim' :
+ ensure => running,
+ enable => true,
+ require => [ Package['opendkim'],
+ File['/etc/default/opendkim', '/etc/opendkim.conf',
+ '/etc/opendkim/TrustedHosts', '/etc/opendkim/KeyTable', '/etc/opendkim/SigningTable' ],
+ }
+
+ postfix::config { "milter_protocol": value => '2' }
+ postfix::config { "milter_default_action": value => 'accept' }
+ postfix::config { "osmtpd_milters": value => 'inet:localhost:12301' }
+ postfix::config { "non_smtpd_milters": value => 'inet:localhost:12301' }
+}
--- /dev/null
+define mail::opendkim::key() {
+ file { "/etc/opendkim/keys/${name}" :
+ ensure => directory,
+ owner => 'opendkim',
+ group => 'opendkim',
+ mode => '0750',
+ require => File['/etc/opendkim/keys'],
+ }
+
+ exec { "opendkim-genkey-${name}"
+ command => "opendkim-genkey -s mail -d ${name}",
+ cwd => "/etc/opendkim/keys/${name}",
+ user => root,
+ group => root,
+ creates => File["/etc/opendkim/keys/${name}/mail.private", "/etc/opendkim/keys/${name}/mail.txt" ],
+ require => [ File["/etc/opendkim/keys/${name}"], Package['opendkim-tools'] ],
+ }
+}
--- /dev/null
+class mail::opendkim::packages {
+ package { [ 'opendkim', 'opendkim-tools' ]:
+ ensure => installed,
+ }
+}
include mail::header_checks
include mail::clamav
include mail::spamassassin
+ include mail::opendkim
+
+ # DKIM
+ mail::opendkim::key { "$domain": }
# Default parameters
include mail::firma::params
projects / puppet-mail.git / commitdiff