-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #8 from netmanagers/master
feat(dkim): add state to manage DKIM keys
- Loading branch information
Showing
10 changed files
with
320 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,62 @@ | ||
# -*- coding: utf-8 -*- | ||
# vim: ft=sls | ||
|
||
{% from "rspamd/map.jinja" import rspamd with context %} | ||
{%- if rspamd.manage_dkim_keys -%} | ||
rspamd_dkim_keys_dir: | ||
file.directory: | ||
- name: {{ rspamd.dkim_keys_dir }} | ||
- user: {{ rspamd.user }} | ||
- group: {{ rspamd.group }} | ||
- mode: 755 | ||
- clean: {{ rspamd.clean_dkim_keys_dir }} | ||
- require: | ||
- pkg: rspamd_pkg | ||
{%- for key, params in rspamd.dkim_keys.items() %} | ||
{%- set domain = params.domain | default(key) %} | ||
{%- set selector = params.selector | default(domain) %} | ||
{%- set privkey_file = params.privkey_file | default( rspamd.dkim_keys_dir ~ '/' ~ domain ~ '.key') %} | ||
{%- set txt_file = params.txt_file | default( rspamd.dkim_keys_dir ~ '/' ~ domain ~ '.txt') %} | ||
{%- set bits = params.bits | default(2048) %} | ||
{%- set type = params.type | default('rsa') %} | ||
rspamd_dkim_keys_{{ key }}: | ||
cmd.run: | ||
- name: | | ||
mkdir -p {{ rspamd.dkim_keys_dir }} && \ | ||
rspamadm dkim_keygen \ | ||
--selector '{{ selector }}' \ | ||
--bits {{ bits }} \ | ||
--domain {{ domain }} \ | ||
--privkey {{ privkey_file }} \ | ||
> {{ txt_file }} | ||
- unless: test -f {{ txt_file }} | ||
- require_in: | ||
- file: rspamd_dkim_keys_{{ privkey_file }}_perms | ||
- file: rspamd_dkim_keys_{{ txt_file }}_perms | ||
- sls: config | ||
- service: rspamd_service | ||
rspamd_dkim_keys_{{ privkey_file }}_perms: | ||
file.managed: | ||
- name: {{ privkey_file }} | ||
- user: {{ rspamd.user }} | ||
- group: {{ rspamd.group }} | ||
- mode: 640 | ||
- onlyif: test -f {{ privkey_file }} | ||
- require_in: | ||
- file: rspamd_dkim_keys_dir | ||
rspamd_dkim_keys_{{ txt_file }}_perms: | ||
file.managed: | ||
- name: {{ txt_file }} | ||
- user: {{ rspamd.user }} | ||
- group: {{ rspamd.group }} | ||
- mode: 640 | ||
- onlyif: test -f {{ txt_file }} | ||
- require_in: | ||
- file: rspamd_dkim_keys_dir | ||
{%- endfor %} | ||
{%- endif %} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,5 +3,6 @@ | |
|
||
include: | ||
- .install | ||
- .dkim_keys | ||
- .config | ||
- .service |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,70 @@ | ||
# frozen_string_literal: true | ||
|
||
config_dir = '/etc/rspamd' | ||
|
||
rspamd_conf_override = <<~RSPAMD_CONF_OVERRIDE | ||
options { | ||
.include "$CONFDIR/options.inc"; | ||
.include(try=true; priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/options.inc"; | ||
.include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/options.inc"; | ||
pidfile = "$RUNDIR/rspamd.pid"; | ||
} | ||
RSPAMD_CONF_OVERRIDE | ||
|
||
dkim_domains = <<~DKIM_DOMAINS | ||
domain { | ||
example.com { | ||
path = "/var/lib/rspamd/dkim/example.com.key"; | ||
selector = "example.com"; | ||
} | ||
example.net { | ||
path = "/var/lib/rspamd/dkim/example.net.key"; | ||
selector = "fancy_selector"; | ||
} | ||
just.a.domain { | ||
path = "/var/lib/rspamd/dkim/just.a.domain.key"; | ||
selector = "just.a.domain"; | ||
} | ||
this.should.be.merged.too { | ||
path = "/var/lib/rspamd/dkim/should.be.merged.with.the.others.key"; | ||
selector = "dkim"; | ||
} | ||
} | ||
DKIM_DOMAINS | ||
|
||
control 'rspamd configuration' do | ||
impact 1.0 | ||
title 'Manage the Rspamd Configuration' | ||
desc ' | ||
Manage the rspamd configuration | ||
' | ||
tag 'rspamd', 'config' | ||
|
||
%w[ | ||
local.d | ||
override.d | ||
].each do |d| | ||
describe file("#{config_dir}/#{d}") do | ||
it { should be_directory } | ||
it { should be_owned_by 'root' } | ||
it { should be_grouped_into 'root' } | ||
its('mode') { should cmp '0755' } | ||
end | ||
end | ||
|
||
describe file("#{config_dir}/rspamd.conf.override") do | ||
its('content') { should include(rspamd_conf_override) } | ||
end | ||
|
||
describe file("#{config_dir}/local.d/redis.conf") do | ||
its('content') { should match(/^read_servers = "localhost";/) } | ||
its('content') { should match(/^write_servers = "localhost";/) } | ||
end | ||
|
||
describe file("#{config_dir}/local.d/dkim_signing.conf") do | ||
its('content') { should match(/^lis = \["a", "b", "c"\];/) } | ||
its('content') { should match(/^nom = 1234;/) } | ||
its('content') { should match(/^stri = "cadena1";/) } | ||
its('content') { should include(dkim_domains) } | ||
end | ||
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,42 @@ | ||
# frozen_string_literal: true | ||
|
||
case platform[:family] | ||
when 'linux', 'arch' | ||
rspamd_user = rspamd_group = 'root' | ||
else | ||
rspamd_user = rspamd_group = '_rspamd' | ||
end | ||
|
||
control 'rspamd dkim_keys' do | ||
impact 1.0 | ||
title 'Manage the DKIM key files and directory' | ||
desc ' | ||
Manage the DKIM keys and directory | ||
' | ||
tag 'rspamd', 'dkim_keys' | ||
|
||
describe file('/var/lib/rspamd/dkim') do | ||
it { should be_directory } | ||
it { should be_owned_by rspamd_user } | ||
it { should be_grouped_into rspamd_group } | ||
its('mode') { should cmp '0755' } | ||
end | ||
|
||
%w[ | ||
example.com.key | ||
example.com.txt | ||
example.net.key | ||
example.net.txt | ||
example.org.key | ||
example.org.txt | ||
just.a.domain.key | ||
just.a.domain.txt | ||
].each do |f| | ||
describe file("/var/lib/rspamd/dkim/#{f}") do | ||
it { should be_file } | ||
it { should be_owned_by rspamd_user } | ||
it { should be_grouped_into rspamd_group } | ||
its('mode') { should cmp '0640' } | ||
end | ||
end | ||
end |
Oops, something went wrong.