include_recipe 'opendkim'

# metadata.rb
# [...]

depends 'opendkim'

{
  "name": "mail.onddo.com",
  "[...]": "[...]",
  "run_list": [
    "recipe[opendkim]"
  ]
}

domain = 'example.com'
selector = '20150522'
key_name = "#{selector}._domainkey.#{domain} "\

directory '/etc/opendkim' do
  mode '00755'
end

# Configure and Create OpenDKIM Tables

# Defines a table that will be queried to convert key names to sets of data of
# the form (signing domain, signing selector, private key). The private key can
# either contain a PEM-formatted private key, a base64-encoded DER format
# private key, or a path to a file containing one of those.
node.default['opendkim']['conf']['KeyTable'] = 'refile:/etc/opendkim/KeyTable'

file '/etc/opendkim/KeyTable' do
  mode '00644'
  content(
    "#{key_name} "\
    "#{domain}:#{selector}:/etc/opendkim/keys/#{domain}/#{selector}.private\n"
  )
end

# Defines a dataset that will be queried for the message sender's address
# to determine which private key(s) (if any) should be used to sign the
# message. The sender is determined from the value of the sender
# header fields as described with SenderHeaders above. The key for this
# lookup should be an address or address pattern that matches senders;
# see the opendkim.conf(5) man page for more information. The value
# of the lookup should return the name of a key found in the KeyTable
# that should be used to sign the message. If MultipleSignatures
# is set, all possible lookup keys will be attempted which may result
# in multiple signatures being applied.
node.default['opendkim']['conf']['SigningTable'] =
  'refile:/etc/opendkim/SigningTable'

file '/etc/opendkim/SigningTable' do
  mode '00644'
  content "*@#{domain} #{key_name}\n"
end

# Install OpenDKIM

include_recipe 'opendkim'

# Read DKIM keys from chef-vault

# node#save avoids chef-vault chicken & egg problem (a bit tricky)
node.save unless Chef::Config[:solo]
include_recipe 'chef-vault'
key = chef_vault_item('dkim_keys', domain)

# Create the credential files

directory "/etc/opendkim/keys/#{domain}" do
  owner node['opendkim']['user']
  group node['opendkim']['group']
  recursive true
end

file "/etc/opendkim/keys/#{domain}/#{selector}.private" do
  owner node['opendkim']['user']
  group node['opendkim']['group']
  mode '00640'
  sensitive true if Chef::Resource.method_defined?(:sensitive)
  content key['private']
end

# The txt is optional
file "/etc/opendkim/keys/#{domain}/#{selector}.txt" do
  owner node['opendkim']['user']
  group node['opendkim']['group']
  mode '00644'
  content key['txt']
  only_if { key['txt'].is_a?(String) }
end

{
  "id": "example.com",
  "private": "-----BEGIN RSA PRIVATE KEY-----\n [...] \n-----END RSA PRIVATE KEY-----\n",
  "txt": "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB [...]"
}

opendkim_port = 8891

# Configure Postfix
node.default['postfix']['main']['milter_protocol'] = 2
node.default['postfix']['main']['milter_default_action'] = 'accept'
node.default['postfix']['main']['smtpd_milters'] =
  "inet:localhost:#{opendkim_port}"
node.default['postfix']['main']['non_smtpd_milters'] =
  "inet:localhost:#{opendkim_port}"

# [...]
include_recipe 'postfix-full'

# Configure OpenDKIM
node.default['opendkim']['conf']['Mode'] = 'sv'
node.default['opendkim']['conf']['Socket'] = "inet:#{opendkim_port}@localhost"

# [...]
include_recipe 'opendkim'

FROM zuazo/chef-local:debian-7

COPY . /tmp/opendkim
RUN berks vendor -b /tmp/opendkim/Berksfile $COOKBOOK_PATH
RUN chef-client -r "recipe[apt],recipe[opendkim]"

EXPOSE 8891

CMD ["/usr/sbin/opendkim", "-f", "-x", "/etc/opendkim.conf", "-u", "opendkim", "-P", "/var/run/opendkim/opendkim.pid"]