Signs dnssec security keys so our DNS records are always signed.

dnssec-new-sig.sh

#!/bin/bash

# Source: https://www.digitalocean.com/community/tutorials/how-to-setup-dnssec-on-an-authoritative-bind-dns-server--2

DOMAIN="$1"
PKIDIR="${PKIDIR:-/etc/bind/pki}"
ZONEDIR="${ZONEDIR:-/etc/bind/kizano}"
DOMAIN_KEY=""

# Set domain key in a config file under protected permissions.
test -s /etc/default/dnssec && . /etc/default/dnssec

die() { echo $@; exit 8; }
test -z "$DOMAIN" && die "Usage: $0 [domain]"
echo "$DOMAIN" | grep -qiP '^--?h(elp)?' && die "Usage: $0 [domain]"

set -e
test -d "$PKIDIR" || mkdir -p "$PKIDIR"

(
  cd $PKIDIR
  dnssec-keygen -a ${DOMAIN_KEY} -b 4096 -n ZONE "$DOMAIN"
  dnssec-keygen -f KSK -a ${DOMAIN_KEY} -b 4096 -n ZONE "$DOMAIN"
)

dnssec-signzone -3 "`tr -dc '0-9a-f' </dev/urandom | head -c32`" -A -N INCREMENT \
  -o "$DOMAIN" -S -K $PKIDIR -t "$ZONEDIR/$DOMAIN"

echo -e "You will need to set these with your domain registrar:\n$(<dsset-$DOMAIN.)"