Deploy the roles/mailserver/dkim unit on Hervil.
Add what's missing in Salt.
Generate keys for nasqueron.org and ook.space domains.
Old configuration for Postfix main.cf
# DKIM milter_default_action = accept milter_protocol = 6 smtpd_milters = inet:localhost:12345 non_smtpd_milters = inet:localhost:12345 smtpd_tls_auth_only = yes