#!/bin/rc

# This script generates and stores DKIM keypair, using the correct user
# It outputs all paths generated in the following order:
#  - privkey
#  - pubkey
#  - txt record to be used in dns
#
# Example/intended usage:
#  dkimfiles = `$nl{dkim/mkcert <selector>}
#  privkey   = $dkimfiles(1)
#  txtfile   = $dkimfiles(2)
#
# There is no real need for the pubkey to be stored as its own file.

dir      = /etc/mail/dkim
user     =_dkimsign_
selector = $1
privkey  = $dir/$selector.priv.key
pubkey   = $dir/$selector.pub.key
txt      = $dir/$selector.txt

fn err {
	echo $* >[1=2]
}

fn die {
	err fatal error: $*
	exit 1
}

fn mustsucceed {
	if (!$*) {
		err fatal error: essential command failed
		cleanupfailed
		exit 1
	}
}

fn cleanupfailed {
	as rm $privkey
	as rm $pubkey
	as rm $txt
}

fn as {
	doas -u _dkimsign $*
}

if (!~ $#* 1) {
	err 'usage: mkcert <selector>'
	exit 2
}


as test -e $privkey && die $privkey already exists
as test -e $pubkey  && die $pubkey already exists
as test -e $txt     && die $txt already exists

mustsucceed as mkdir -p $dir

mustsucceed as openssl genrsa -out $privkey
mustsucceed as openssl rsa -in $privkey -pubout | \
	mustsucceed as tee $pubkey >/dev/null
mustsucceed as cat $pubkey | \
	mustsucceed as sed '1s/.*/v=DKIM1;p=/;:nl;${s/-----.*//;q;};N;s/\n//g;b nl;' | \
	mustsucceed as tee $txt >/dev/null

err 'Paths generated (privkey, pubkey, txt dns record):'
echo $privkey
echo $pubkey
echo $txt