diff options
Diffstat (limited to 'mail')
| -rwxr-xr-x | mail/dns/setup-route53.py | 34 | ||||
| -rwxr-xr-x | mail/install.sh | 11 |
2 files changed, 27 insertions, 18 deletions
diff --git a/mail/dns/setup-route53.py b/mail/dns/setup-route53.py index a3c69a4..0864c9a 100755 --- a/mail/dns/setup-route53.py +++ b/mail/dns/setup-route53.py @@ -6,12 +6,10 @@ Route 53 DNS 設定スクリプト: SPF / DKIM / DMARC pip3 install boto3 export AWS_ACCESS_KEY_ID=... export AWS_SECRET_ACCESS_KEY=... - export HOSTED_ZONE_ID=Z... # Route 53 ホストゾーン ID (yyamashita.com) - export SERVER_IP=<HetznerサーバーIP> # 自動検出不可の場合のみ python3 /app/infra/mail/dns/setup-route53.py -domains.txt に記載されたサービスドメインと hetzner.yyamashita.com に対して -SPF / DKIM / DMARC TXT レコードを UPSERT する。 +HOSTED_ZONE_ID は yyamashita.com のゾーンを自動検出する。 +SERVER_IP は自動取得（必要に応じて環境変数で上書き可能）。 """ import os @@ -27,10 +25,9 @@ except ImportError: SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) DOMAINS_FILE = os.environ.get("DOMAINS_FILE", os.path.join(SCRIPT_DIR, "..", "domains.txt")) -HOSTED_ZONE_ID = os.environ.get("HOSTED_ZONE_ID", "") -AWS_REGION = os.environ.get("AWS_REGION", "us-east-1") SELECTOR = "mail" PRIMARY = "hetzner.yyamashita.com" +ZONE_DOMAIN = "yyamashita.com" def get_server_ip(): @@ -45,6 +42,17 @@ def get_server_ip(): return "" +def get_hosted_zone_id(client): + if zone_id := os.environ.get("HOSTED_ZONE_ID", ""): + return zone_id + paginator = client.get_paginator("list_hosted_zones") + for page in paginator.paginate(): + for zone in page["HostedZones"]: + if zone["Name"].rstrip(".") == ZONE_DOMAIN: + return zone["Id"].split("/")[-1] + return "" + + def read_domains(path): domains = [] with open(path) as f: @@ -78,9 +86,12 @@ def txt_record(fqdn, raw_value): def main(): - if not HOSTED_ZONE_ID: - print("ERROR: HOSTED_ZONE_ID が未設定です", file=sys.stderr) - print(" export HOSTED_ZONE_ID=Z...", file=sys.stderr) + client = boto3.client("route53") + + zone_id = get_hosted_zone_id(client) + if not zone_id: + print(f"ERROR: {ZONE_DOMAIN} のホストゾーンが見つかりません", file=sys.stderr) + print(" export HOSTED_ZONE_ID=Z... で手動指定してください", file=sys.stderr) sys.exit(1) server_ip = get_server_ip() @@ -100,7 +111,7 @@ def main(): service_domains = read_domains(DOMAINS_FILE) print(f"サーバー IP : {server_ip}") - print(f"ホストゾーン: {HOSTED_ZONE_ID}") + print(f"ホストゾーン: {zone_id} ({ZONE_DOMAIN})") print(f"ドメイン : {[PRIMARY] + service_domains}") print() @@ -122,9 +133,8 @@ def main(): rrs = c["ResourceRecordSet"] print(f" {rrs['Type']} {rrs['Name']}") - client = boto3.client("route53", region_name=AWS_REGION) resp = client.change_resource_record_sets( - HostedZoneId=HOSTED_ZONE_ID, + HostedZoneId=zone_id, ChangeBatch={ "Comment": "Mail auth records (SPF/DKIM/DMARC) via hetzner-infra", "Changes": changes, diff --git a/mail/install.sh b/mail/install.sh index a913938..8f57c7d 100755 --- a/mail/install.sh +++ b/mail/install.sh @@ -32,19 +32,18 @@ chmod 700 "$KEY_DIR" if [[ -f "$KEY_DIR/${SELECTOR}.private" ]]; then echo " 既存の鍵を使用: $KEY_DIR/${SELECTOR}.private" else + echo " opendkim-tools をインストール..." + DEBIAN_FRONTEND=noninteractive apt-get install -y -qq opendkim-tools echo " 2048bit RSA 鍵を生成中..." - docker run --rm -v "${KEY_DIR}:/keys" debian:bookworm-slim bash -c " - apt-get update -qq && apt-get install -y -qq opendkim-tools 2>/dev/null - cd /keys && opendkim-genkey -b 2048 -s ${SELECTOR} -d yyamashita.com - chmod 600 /keys/${SELECTOR}.private - " + cd "$KEY_DIR" + opendkim-genkey -b 2048 -s "$SELECTOR" -d yyamashita.com + chmod 600 "$KEY_DIR/${SELECTOR}.private" echo " 生成完了" fi # OpenDKIM テーブル生成 echo "" echo "=== OpenDKIM テーブル生成 ===" -mkdir -p "$OPENDKIM_DIR" { for d in "${SERVICE_DOMAINS[@]}"; do |