From 04fafd64e252adeedadd90c4612a97387908fde6 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 22 Mar 2026 16:06:40 +0100
Subject: [PATCH] Add dkim to stalwart

---
 dns/domains/rubenhensen.nl.yaml     |  8 ++++++++
 nix-infra-machine/nodes/node001.nix | 30 +++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/dns/domains/rubenhensen.nl.yaml b/dns/domains/rubenhensen.nl.yaml
index cd91916..3f99ce3 100644
--- a/dns/domains/rubenhensen.nl.yaml
+++ b/dns/domains/rubenhensen.nl.yaml
@@ -67,6 +67,14 @@ records:
     expire: 86400
     type: TXT
     content: "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxVEP+pDBE8/KdL34dYMVAoQW6cr9ARE/kho7KF2MP7lCjkigcjbbkgn3wGRdhoVjuoMlShaup0Bsycb4pJtalFObRUOxMkZG6yK2w67Hz1Lq5MtUMvVANCsdsoztkTmaWpnU5UYXYYGOtetupvNdIJTg6qEg5AJO51LrqqTDpv5CM0cgFbXkQiyF5srZ+B7czjFOiJkGQ9y4xqT4nggl+Ph/l9sA/VXJYB7WjvhzxrBVKcOlI32AMJkIJZYUg+9wbjJ1TBkpFpyClORTsTaF2SJOwWMm5q64OUf4/pTpTmG6TPXZ7lO429G0ulZcTkdq/fTrZZA6G5fruD7pyIkGNwIDAQAB"
+  - name: "202603e2._domainkey"
+    expire: 86400
+    type: TXT
+    content: "v=DKIM1; k=ed25519; h=sha256; p=6m4ORRmP9njy97OoQI6LNCebE2AJVLVo4Vkn/5cNfPI="
+  - name: "202603r2._domainkey"
+    expire: 86400
+    type: TXT
+    content: "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApBm+QIOPtVAWlnpcd1Sh/FjTLU4oXNdyYMZ4uo+uj+8PkewhzN+6gb9CD/M6NB8Wa+8kchcVlziB1GD4z07QAAJg8pGSs1UZ7Ggfp7RgE6CkiPvMxAE6PkP9mBKcPH9YFR0xQaoi0BHQD1EKmPq2vXOc3BFtgkoeO+Myo6ELenpf17Iv6PcBxyLBOBnnFB4Uhos8qJ8qHb+hHhL6wR8sxk+OAPLXDWVRtrTXvOrlDoRBjz9X0xKdyE3aOQ6xg+qHusVIszLFz8iO6L5ia/rtwnm9v92NR9g0r3/lJE3AJFYqKIF7kPcdjyowvuUjlpDQedXSaEkytGzc84JbkHE+jQIDAQAB"
   - name: stalwart
     expire: 86400
     type: TXT
diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index 18436e7..40814c5 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -136,6 +136,34 @@
         };
       };
 
+      signature."rsa" = {
+        private-key = "%{file:/run/credentials/stalwart-mail.service/dkim-rsa.key}%";
+        domain = "rubenhensen.nl";
+        selector = "202603r2";
+        headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id"];
+        algorithm = "rsa-sha-256";
+        canonicalization = "relaxed/relaxed";
+        expire = "10d";
+        set-body-length = false;
+        report = true;
+      };
+
+      signature."ed25519" = {
+        private-key = "%{file:/run/credentials/stalwart-mail.service/dkim-ed25519.key}%";
+        domain = "rubenhensen.nl";
+        selector = "202603e2";
+        headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id"];
+        algorithm = "ed25519-sha256";
+        canonicalization = "relaxed/relaxed";
+        set-body-length = false;
+        report = false;
+      };
+
+      auth.dkim.sign = [
+        { "if" = "listener != 'smtp'"; "then" = "['rsa', 'ed25519']"; }
+        { "else" = false; }
+      ];
+
       authentication.fallback-admin = {
         user = "admin";
         secret = "%{file:/run/credentials/stalwart-mail.service/stalwart-admin-password}%";
@@ -146,6 +174,8 @@
   systemd.services.stalwart-mail.serviceConfig.LoadCredentialEncrypted = [
     "stalwart-admin-password:/root/secrets/[%%secrets/stalwart-admin-password%%]"
     "ldap_bind_password:/root/secrets/[%%secrets/ldap_bind_password%%]"
+    "dkim-rsa.key:/root/secrets/[%%secrets/dkim-rsa.key%%]"
+    "dkim-ed25519.key:/root/secrets/[%%secrets/dkim-ed25519.key%%]"
   ];
 
   users.users.stalwart-mail.extraGroups = [ "acme" ];