code wiki / _hdl_build / nx_email_provision.nx
nx_email_provision.nx source
↩ module page · 41 lines · 2186 B
1// nx_email_provision.nx -- CLI: provision a domain's sovereign email (DKIM keypair + publishable DNS zone +
2// artifacts). Data-driven so EVERY one of our sites is provisioned the same way (operator: "not just andelinwest
3// but all our sites"). Idempotent -- re-running reuses the domain's existing key so a published DKIM pubkey stays
4// valid. Composes nx_email_provision_lib.
5// nx_email_provision <domain> [host] [ip] [selector]
6// defaults: host=mail.<domain> ip=203.0.113.10 (placeholder -- set your server's public IPv4) selector=nishi1
7// license_tier: ORIGINAL
8import "nx_email_provision_lib.nx"
9const K_MAGIC_4096: i64 = 4096
10const K_MAGIC_4090: i64 = 4090
11
12func epc_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
13
14func main(argc: i64, argv: *i64) -> i64 {
15 if argc < 2 {
16 epc_puts("usage: nx_email_provision <domain> [host] [ip] [selector]\n" as *u8)
17 sys_exit(2); return 2
18 }
19 let domain: *u8 = argv[1] as *u8
20 // default host = mail.<domain>
21 let hostbuf: *u8 = sys_mmap(512)
22 var ho: i64 = ep_cat(hostbuf, 0, "mail." as *u8)
23 ho = ep_cat(hostbuf, ho, domain); hostbuf[ho] = 0 as u8
24 var host: *u8 = hostbuf
25 if argc >= 3 { host = argv[2] as *u8 }
26 var ip: *u8 = "203.0.113.10" as *u8
27 if argc >= 4 { ip = argv[3] as *u8 }
28 var selector: *u8 = "nishi1" as *u8
29 if argc >= 5 { selector = argv[4] as *u8 }
30
31 let priv: *u8 = sys_mmap(32)
32 let pub: *u8 = sys_mmap(32)
33 let zone: *u8 = sys_mmap(K_MAGIC_4096)
34 let zlen: i64 = ep_provision(domain, host, ip, selector, priv, pub, zone, K_MAGIC_4090)
35
36 epc_puts("PROVISIONED email domain="); epc_puts(domain); epc_puts(" selector="); epc_puts(selector); epc_puts(" host="); epc_puts(host); epc_puts("\n" as *u8)
37 epc_puts(" artifacts (knowledge/status/): "); epc_puts(domain); epc_puts("_dns_zone.txt [publish] "); epc_puts(domain); epc_puts("_dkim_priv.bin [SECRET 0600]\n" as *u8)
38 epc_puts(" next: publish the zone at your DNS provider; the MTA accepts @"); epc_puts(domain); epc_puts(" and signs outbound with this key.\n\n" as *u8)
39 epc_puts(zone)
40 sys_exit(0); return 0
41}