mail: roll new dkim keys
The existing RSA key is 1024 bit long and needs to be retired. We generate the new keys in place, managing them is imo pretty pointless, as we won't be able to sign new mail that will get validated anyhow. At which point we'll publish new selectors.
Martin Weinelt committed
May 29, 2026 at 02:06 UTC
4fa4dc1a866fca398bb7b9b0c86c2a7f910f21da
1 file changed
+21
non-critical-infra/modules/mailserver/default.nix
+21
@@ -1,6 +1,7 @@
1
{
2
inputs,
3
config,
4
+ lib,
5
pkgs,
6
...
7
}:
@@ -38,6 +39,26 @@
39
"nixos.org"
40
];
41
42
+ dkim.domains =
43
+ let
44
+ selectors = {
45
+ "mail" = {
46
+ # legacy managed key
47
+ };
48
+ "r202605" = {
49
+ keyType = "rsa";
50
+ keyLength = 2048;
51
+ };
52
+ "e202605" = {
53
+ keyType = "ed25519";
54
+ keyLength = null;
55
+ };
56
+ };
57
+ in
58
+ lib.genAttrs config.mailserver.domains (_: {
59
+ inherit selectors;
60
+ });
61
+
62
srs.enable = true;
63
};
64