#!/bin/bash

SLAVE_IP=129.146.187.63
MASTER_IP=149.28.12.253

dnssec_add () {
    DOMAIN=$1

    ## Go to /var/cache/bind/
    echo "Changing directory to /var/cache/bind/"
    cd /var/cache/bind || exit

    echo "Domain: $DOMAIN"

    # Create a Zone Signing Key(ZSK)
    echo "Creating Zone Signing Key (ZSK)"
    dnssec-keygen -a ED25519 -b 2048 -n ZONE "$DOMAIN"

    # Create a Key Signing Key(KSK)
    echo "Creating Key Signing Key (KSK)"
    dnssec-keygen -f KSK -a ED25519 -b 4096 -n ZONE "$DOMAIN"

    # Set proper permissions on key files
    echo "Setting proper permissions on key files"
    chown bind:root *.{key,private}
    chmod ug+rw *.{key,private}

    # Copy keys to /etc/bind from /var/cache/bind
    echo "Copying keys to /etc/bind"
    cp *$DOMAIN*.{key,private} /etc/bind/

    # Add keys to zone file in /etc/bind/
    echo "Adding keys to zone file in /etc/bind/"
    for key in $(find . -type f -name "K$DOMAIN*.key" | sed 's/.\///g'); do echo "\$INCLUDE $key" >> /etc/bind/db.$DOMAIN; done

    # Sign Zone
    echo "Signing Zone"
    dnssec-signzone -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -A -N INCREMENT -o "$DOMAIN" /etc/bind/db.$DOMAIN

    # Add Zone config to /etc/bind/named.conf.local
    echo "Adding Zone config to /etc/bind/named.conf.local"
    echo -e "\n\nzone \"$DOMAIN\" IN {\n    type master;\n    file \"/etc/bind/db.$DOMAIN.signed\";\n    allow-transfer { $SLAVE_IP; };\n    dnssec-policy standard;\n    inline-signing yes;\n};\n" >> /etc/bind/named.conf.local

    # Copy /etc/bind/db.$DOMAIN to /var/cache/bind
    echo "Copying /etc/bind/db.$DOMAIN to /var/cache/bind"
    cp /etc/bind/db.$DOMAIN /var/cache/bind/

    # Reload the bind service and display status
    echo "Reloading bind service"
    service bind9 restart
    echo "Bind service status:"
    service bind9 status

    # Output DS records to be added to Registrar
    echo "DS records to be added to Registrar:"
    cat dsset-$DOMAIN.
}

# Check if domain argument is provided
if [ -z "$1" ]; then
    echo "Usage: $0 <domain>"
    exit 1
fi

# Run dnssec_add function with the provided domain argument
dnssec_add "$1"

#!/bin/bash

dnssec_add () {
    DOMAIN=$1

    ## Go to /var/cache/bind/
    echo "Changing directory to /var/cache/bind/"
    cd /var/cache/bind || exit

    echo "Domain: $DOMAIN"

    # Create a Zone Signing Key(ZSK)
    echo "Creating Zone Signing Key (ZSK)"
    dnssec-keygen -a ED25519 -b 2048 -n ZONE "$DOMAIN"

    # Create a Key Signing Key(KSK)
    echo "Creating Key Signing Key (KSK)"
    dnssec-keygen -f KSK -a ED25519 -b 4096 -n ZONE "$DOMAIN"

    # Set proper permissions on key files
    echo "Setting proper permissions on key files"
    chown bind:root *.{key,private}
    chmod ug+rw *.{key,private}

    # Copy keys to /etc/bind from /var/cache/bind
    echo "Copying keys to /etc/bind"
    cp *$DOMAIN*.{key,private} /etc/bind/

    # Add keys to zone file in /etc/bind/
    echo "Adding keys to zone file in /etc/bind/"
    for key in $(find . -type f -name "K$DOMAIN*.key" | sed 's/.\///g'); do echo "\$INCLUDE $key" >> /etc/bind/db.$DOMAIN; done

    # Sign Zone
    echo "Signing Zone"
    dnssec-signzone -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -A -N INCREMENT -o "$DOMAIN" /etc/bind/db.$DOMAIN

    # Add Zone config to /etc/bind/named.conf.local
    echo "Adding Zone config to /etc/bind/named.conf.local"
    echo -e "\n\nzone \"$DOMAIN\" IN {\n    type master;\n    file \"/etc/bind/db.$DOMAIN.signed\";\n    allow-transfer { $SLAVE_IP; };\n    dnssec-policy standard;\n    inline-signing yes;\n};\n" >> /etc/bind/named.conf.local

    # Copy /etc/bind/db.$DOMAIN to /var/cache/bind
    echo "Copying /etc/bind/db.$DOMAIN to /var/cache/bind"
    cp /etc/bind/db.$DOMAIN /var/cache/bind/

    # Reload the bind service and display status
    echo "Reloading bind service"
    service bind9 restart
    echo "Bind service status:"
    service bind9 status

    # Output DS records to be added to Registrar
    echo "DS records to be added to Registrar:"
    cat dsset-$DOMAIN.
}

# Check if domain argument is provided
if [ -z "$1" ]; then
    echo "Usage: $0 <domain>"
    exit 1
fi

# Run dnssec_add function with the provided domain argument
dnssec_add "$1"

In reply to @hashborgir:mozilla.org
salt_rock_lamp: hey welcome, what's going on?