Add DKIM records

dns/cloudflare/main.tf

@@ -10,13 +10,22 @@ data "cloudflare_zones" "domain" {
   }
 }
 
+
+module "dkim" {
+  source           = "../dkim"
+  sudoer_username  = var.sudoer_username
+  public_instances = var.public_instances
+  ssh_private_key  = var.ssh_private_key
+}
+
 module "record_generator" {
   source         = "../record_generator"
   name           = lower(var.name)
   public_instances = var.public_instances
   vhosts           = var.vhosts
   domain_tag       = var.domain_tag
   vhost_tag        = var.vhost_tag
+  dkim_public_key  = module.dkim.public_key
 }
 
 resource "cloudflare_record" "records" {

dns/dkim/main.tf

@@ -0,0 +1,53 @@
+
+variable "sudoer_username" {}
+
+variable "public_instances" {}
+
+variable "ssh_private_key" {
+  type = string
+}
+
+resource "tls_private_key" "dkim" {
+  algorithm = "RSA"
+}
+
+resource "null_resource" "deploy_certs" {
+  for_each = var.public_instances
+
+  triggers = {
+    instance_id    = each.value["id"]
+    certificate_id = tls_private_key.dkim.id
+  }
+
+  connection {
+    type        = "ssh"
+    user        = var.sudoer_username
+    host        = each.value["public_ip"]
+    host_key    = each.value["hostkeys"]["rsa"]
+    private_key = var.ssh_private_key
+  }
+
+  provisioner "file" {
+    content     = tls_private_key.dkim.private_key_pem
+    destination = "default.private"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "sudo mkdir -p /etc/opendkim/keys",
+      "sudo install -m 600 -o root -g root default.private /etc/opendkim/keys/",
+      "rm default.private",
+    ]
+  }
+}
+
+data "external" "rsa2der" {
+  program = ["python", "${path.module}/rsa2der.py"]
+  query = {
+    private_key = tls_private_key.dkim.private_key_pem
+  }
+}
+
+output "public_key" {
+    value = data.external.rsa2der.result["public_key"]
+}

dns/dkim/rsa2der.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+
+import base64
+import json
+import sys
+from subprocess import Popen, PIPE
+
+inputs = json.load(sys.stdin)
+private_key = inputs['private_key']
+
+cmd = ["openssl", "rsa", "-pubout", "-outform", "DER"]
+ssl_cmd = Popen(cmd, stdin=PIPE, stdout=PIPE)
+ssl_out = ssl_cmd.communicate(private_key.encode())[0]
+public_key = base64.b64encode(ssl_out).decode()
+
+output = {'public_key' : public_key}
+print(json.dumps(output))

dns/gcloud/main.tf

@@ -7,13 +7,21 @@ data "google_dns_managed_zone" "domain" {
   project = var.project
 }
 
+module "dkim" {
+  source           = "../dkim"
+  sudoer_username  = var.sudoer_username
+  public_instances = var.public_instances
+  ssh_private_key  = var.ssh_private_key
+}
+
 module "record_generator" {
   source         = "../record_generator"
   name           = lower(var.name)
   public_instances = var.public_instances
   vhosts           = var.vhosts
   domain_tag       = var.domain_tag
   vhost_tag        = var.vhost_tag
+  dkim_public_key  = module.dkim.public_key
 }
 
 resource "google_dns_record_set" "records" {

dns/record_generator/main.tf

@@ -9,6 +9,8 @@ variable "public_instances" {}
 variable "domain_tag" {}
 variable "vhost_tag" {}
 
+variable "dkim_public_key" {}
+
 data "external" "key2fp" {
   for_each = var.public_instances
   program = ["bash", "${path.module}/key2fp.sh"]
@@ -95,7 +97,19 @@ locals {
                 type        = 2
                 fingerprint = try(coalesce([for key, values in var.public_instances: data.external.key2fp[key].result["ed25519_sha256"] if contains(values["tags"], var.domain_tag)]...), 0)
             }
-        }
+        },
+        {
+            type  = "TXT"
+            name  = var.name
+            value = "v=spf1 a -all"
+            data  = null
+        },
+        {
+            type  = "TXT"
+            name  = "default._domainkey.${var.name}"
+            value = "v=DKIM1; k=rsa; p=${var.dkim_public_key}"
+            data  = null
+        },
     ])
 }