Add opendkim-genkey to the './inst CA' command.

diff --git a/README.org b/README.org
index b0c55ee87c0deb798325ecfb04e685729bf777aa..c6cc5ce7164be09342e0cece77f213df5ea41e22 100644 (file)
--- a/README.org
+++ b/README.org
@@ -6175,9 +6175,8 @@ the appropriate names (or just to set ~EASYRSA_DN~ to ~cn_only~).
 Running ~./inst CA~ creates the new CA and keys.  The command prompts
 for the Common Name (or several levels of Organizational names) of the
 certificate authority.  The ~full_name~ is given: ~Small Institute
-LLC~.  The CA is used to issue certificates for ~front~, ~gate~ and
-~core~, which are installed on the servers during the next ~./inst
-config~.
+LLC~.  The CA is used to issue certificates for ~front~ and ~core~
+that will be installed on their servers by the next ~./inst config~.
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
@@ -6187,6 +6186,8 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
   die "Secret/CA/easyrsa: not an executable\n"
     if ! -x "Secret/CA/easyrsa";
   die "Secret/CA/pki/: already exists\n" if -e "Secret/CA/pki";
+  die "gpg: command not found" if system "which -s gpg";
+  die "ssh-keygen: command not found" if system "which -s ssh-keygen";
 
   umask 077;
   mysystem "cd Secret/CA; ./easyrsa init-pki";
@@ -6195,9 +6196,11 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
 
   my $dom = $domain_name;
   my $pvt = $domain_priv;
-  mysystem "cd Secret/CA; ./easyrsa build-server-full $dom nopass";
-  mysystem "cd Secret/CA; ./easyrsa build-server-full core.$pvt nopass";
-  umask 077;
+
+  mysystem ("cd Secret/CA;",
+           "./easyrsa build-server-full $dom nopass");
+  mysystem ("cd Secret/CA;",
+           "./easyrsa build-server-full core.$pvt nopass");
 
   mysystem "mkdir --mode=700 Secret/root.gnupg";
   mysystem ("gpg --homedir Secret/root.gnupg",
@@ -6208,7 +6211,8 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
            "root\@core.$pvt");
   chmod 0440, "root-pub.pem";
   mysystem ("gpg --homedir Secret/root.gnupg",
-           "--export-secret-key --armor --output Secret/root-sec.pem",
+           "--export-secret-key --armor",
+           "--output Secret/root-sec.pem",
            "root\@core.$pvt");
   chmod 0400, "root-sec.pem";
 
@@ -6221,9 +6225,16 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
   mysystem "mkdir Secret/ssh_monkey";
   chmod 0700, "Secret/ssh_monkey";
   mysystem "echo 'HashKnownHosts  no' >Secret/ssh_monkey/config";
-  mysystem ("ssh-keygen -q -t ed25519",
-           "-C monkey\@core.$domain_priv",
+  mysystem ("ssh-keygen -q -t ed25519 -C monkey\@core.$pvt",
            "-N '' -f Secret/ssh_monkey/id_ed25519");
+
+  mysystem "mkdir --mode=700 Secret/opendkim";
+  if (system "which opendkim-genkey") {
+    warn "opendkim-genkey: command not found, skipped"
+  } else {
+    mysystem ("opendkim-genkey -D Secret/opendkim",
+             "-b 2048 -d $dom -s default -S");
+  }
   exit;
 }
 #+END_SRC

diff --git a/inst b/inst
index fc08806f00c3216dcae310eb76a396e293d5252e..7d7975ed934f0bd15222a3244de885813825e305 100755 (executable)
--- a/inst
+++ b/inst
@@ -74,6 +74,8 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
   die "Secret/CA/easyrsa: not an executable\n"
     if ! -x "Secret/CA/easyrsa";
   die "Secret/CA/pki/: already exists\n" if -e "Secret/CA/pki";
+  die "gpg: command not found" if system "which -s gpg";
+  die "ssh-keygen: command not found" if system "which -s ssh-keygen";
 
   umask 077;
   mysystem "cd Secret/CA; ./easyrsa init-pki";
@@ -82,9 +84,11 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
 
   my $dom = $domain_name;
   my $pvt = $domain_priv;
-  mysystem "cd Secret/CA; ./easyrsa build-server-full $dom nopass";
-  mysystem "cd Secret/CA; ./easyrsa build-server-full core.$pvt nopass";
-  umask 077;
+
+  mysystem ("cd Secret/CA;",
+           "./easyrsa build-server-full $dom nopass");
+  mysystem ("cd Secret/CA;",
+           "./easyrsa build-server-full core.$pvt nopass");
 
   mysystem "mkdir --mode=700 Secret/root.gnupg";
   mysystem ("gpg --homedir Secret/root.gnupg",
@@ -95,7 +99,8 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
            "root\@core.$pvt");
   chmod 0440, "root-pub.pem";
   mysystem ("gpg --homedir Secret/root.gnupg",
-           "--export-secret-key --armor --output Secret/root-sec.pem",
+           "--export-secret-key --armor",
+           "--output Secret/root-sec.pem",
            "root\@core.$pvt");
   chmod 0400, "root-sec.pem";
 
@@ -108,9 +113,16 @@ if (defined $ARGV[0] && $ARGV[0] eq "CA") {
   mysystem "mkdir Secret/ssh_monkey";
   chmod 0700, "Secret/ssh_monkey";
   mysystem "echo 'HashKnownHosts  no' >Secret/ssh_monkey/config";
-  mysystem ("ssh-keygen -q -t ed25519",
-           "-C monkey\@core.$domain_priv",
+  mysystem ("ssh-keygen -q -t ed25519 -C monkey\@core.$pvt",
            "-N '' -f Secret/ssh_monkey/id_ed25519");
+
+  mysystem "mkdir --mode=700 Secret/opendkim";
+  if (system "which opendkim-genkey") {
+    warn "opendkim-genkey: command not found, skipped"
+  } else {
+    mysystem ("opendkim-genkey -D Secret/opendkim",
+             "-b 2048 -d $dom -s default -S");
+  }
   exit;
 }