permit multiple DKIM selectors

README.md

@@ -19,6 +19,7 @@ on a single host.
 * `mailfruit_admin_email` - *required*
 * `mailfruit_certbot_authenticator` - _optional_, default: `standalone`
 * `mailfruit_trees_git_ref` - _optional_, default: `master`
+* `mailfruit_dkim_selector` - _optional_, default: `mail`. Set this to something unique per-server, unless you syncronize your DKIM keys another way.
 
 ## Example Playbook
 

tasks/main.yml

@@ -30,4 +30,4 @@
 
 - name: Post-deploy reminders
   ansible.builtin.debug:
-    msg: "Please ensure the DKIM TXT record at /etc/opendkim/keys/mail.txt is hosted for each domain. Each server generates its own; be sure to host each server's key for each domain!"
+    msg: "Please ensure the DKIM TXT record at /etc/opendkim/keys/{{ mailfruit_dkim_selector }}.txt is hosted for each domain. Each server generates its own; be sure to host each server's key for each domain!"

tasks/opendkim.yml

@@ -16,10 +16,10 @@
     mode: '0750'
 
 - name: Make opendkim key
-  ansible.builtin.command: "opendkim-genkey -s mail"
+  ansible.builtin.command: "opendkim-genkey -s {{ mailfruit_dkim_selector }}"
   args:
     chdir: /etc/opendkim/keys
-    creates: /etc/opendkim/keys/mail.private
+    creates: "/etc/opendkim/keys/{{ mailfruit_dkim_selector }}.private"
 
 - name: Set dkim key permissions
   ansible.builtin.file:
@@ -35,6 +35,8 @@
     path: /etc/default/opendkim
     regexp: '^SOCKET='
     line: 'SOCKET="inet:[email protected]"'
+  notify:
+    - Restart opendkim
 
 - name: Manage /etc/opendkim.conf
   ansible.builtin.template:

templates/opendkim.conf.j2

@@ -11,7 +11,7 @@ InternalHosts           csl:127.0.0.1/24,localhost
 Domain                  csl:{% for domain in mailfruit_mail_domains %}{{ domain }}{% if not loop.last %},{% endif %}{% endfor %}
 
 KeyFile                 /etc/opendkim/keys/mail.private
-Selector                mail
+Selector                {{ mailfruit_dkim_selector }}
 
 Mode                    sv
 PidFile                 /var/run/opendkim/opendkim.pid

vars/main.yml

@@ -6,3 +6,9 @@ mailfruit_trees_git_ref: 'master'
 # Should you have something running on port 80 already, change this to a certbot
 # plugin that knows better what to do.
 mailfruit_certbot_authenticator: 'standalone'
+
+# The DKIM selector to use. This gets embedded in the DKIM signature in each outbound email,
+# and informs the receiving server what DNS record to query to check the signature.
+# A simple way to deploy this to multiple servers without syncing key material would be to
+# use a distinct value for this variable per-server and host each record independently.
+mailfruit_dkim_selector: 'mail'