sign-zone

#!/bin/bash

# Copyright 2014-2015 Richard Russon (FlatCap)
# Licensed under the GPLv3

PATH="/var/named/bin:/usr/bin:/usr/sbin"
source log.sh

export TZ="UTC"

set -o errexit	# set -e
set -o nounset	# set -u

renice --priority 19 --pid $$ > /dev/null
ionice --class 3     --pid $$ > /dev/null

shopt -s nullglob

function finish()
{
	local RETVAL=$?
	[ $RETVAL = 0 ] || log_error "${0##*/} failed: $RETVAL"
}

trap finish EXIT

cd /var/named

if [ $# != 1 -a $# != 2 ]; then
	echo "Usage: ${0##*/} ZONE [start]"
	exit 2
fi

ZONE=$1
START=${2:-$(date "+%Y%m%d%H%M%S")}
S2="${START:0:4}-${START:4:2}-${START:6:2} ${START:8:2}:${START:10:2}:${START:12:2}"
END=$(date "+%Y%m%d%H%M%S" -d "$S2 UTC + 2 days")

mkdir --parents "$DNSSEC_KEY_DIR"

SALT=$(head --bytes 1024 /dev/random | sha1sum)
SALT=${SALT:0:16}
SALT=${SALT^^}

# Sign the zone, and write it out to a file named zone.signed
log_info "Sign zone $ZONE (Salt: $SALT)"
dnssec-signzone -s "$START" -e "$END" -3 $SALT -S -o $ZONE -K "$DNSSEC_KEY_DIR" $ZONE.db
mv dsset-$ZONE. "$DNSSEC_KEY_DIR"