2018-10-09 18:22:45 +02:00
|
|
|
// Package acmedns implements a DNS provider for solving DNS-01 challenges using Joohoi's acme-dns project.
|
|
|
|
// For more information see the ACME-DNS homepage: https://github.com/joohoi/acme-dns
|
2019-03-11 18:56:48 +02:00
|
|
|
package acmedns
|
2018-07-09 19:28:01 +02:00
|
|
|
|
|
|
|
import (
|
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
|
|
|
|
"github.com/cpu/goacmedns"
|
2019-07-30 21:19:32 +02:00
|
|
|
"github.com/go-acme/lego/v3/challenge/dns01"
|
|
|
|
"github.com/go-acme/lego/v3/platform/config/env"
|
2018-07-09 19:28:01 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
// envNamespace is the prefix for ACME-DNS environment variables.
|
|
|
|
envNamespace = "ACME_DNS_"
|
2020-03-12 00:51:10 +02:00
|
|
|
|
|
|
|
// EnvAPIBase is the environment variable name for the ACME-DNS API address
|
2018-07-09 19:28:01 +02:00
|
|
|
// (e.g. https://acmedns.your-domain.com).
|
2020-03-12 00:51:10 +02:00
|
|
|
EnvAPIBase = envNamespace + "API_BASE"
|
|
|
|
// EnvStoragePath is the environment variable name for the ACME-DNS JSON account data file.
|
2018-12-06 23:50:17 +02:00
|
|
|
// A per-domain account will be registered/persisted to this file and used for TXT updates.
|
2020-03-12 00:51:10 +02:00
|
|
|
EnvStoragePath = envNamespace + "STORAGE_PATH"
|
2018-07-09 19:28:01 +02:00
|
|
|
)
|
|
|
|
|
2018-12-06 23:50:17 +02:00
|
|
|
// acmeDNSClient is an interface describing the goacmedns.Client functions the DNSProvider uses.
|
|
|
|
// It makes it easier for tests to shim a mock Client into the DNSProvider.
|
2018-07-09 19:28:01 +02:00
|
|
|
type acmeDNSClient interface {
|
2018-12-06 23:50:17 +02:00
|
|
|
// UpdateTXTRecord updates the provided account's TXT record
|
|
|
|
// to the given value or returns an error.
|
2018-07-09 19:28:01 +02:00
|
|
|
UpdateTXTRecord(goacmedns.Account, string) error
|
2018-12-06 23:50:17 +02:00
|
|
|
// RegisterAccount registers and returns a new account
|
|
|
|
// with the given allowFrom restriction or returns an error.
|
2018-07-09 19:28:01 +02:00
|
|
|
RegisterAccount([]string) (goacmedns.Account, error)
|
|
|
|
}
|
|
|
|
|
2020-05-08 19:35:25 +02:00
|
|
|
// DNSProvider implements the challenge.Provider interface.
|
2018-07-09 19:28:01 +02:00
|
|
|
type DNSProvider struct {
|
|
|
|
client acmeDNSClient
|
|
|
|
storage goacmedns.Storage
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewDNSProvider creates an ACME-DNS provider using file based account storage.
|
2020-03-12 00:51:10 +02:00
|
|
|
// Its configuration is loaded from the environment by reading EnvAPIBase and EnvStoragePath.
|
2018-07-09 19:28:01 +02:00
|
|
|
func NewDNSProvider() (*DNSProvider, error) {
|
2020-03-12 00:51:10 +02:00
|
|
|
values, err := env.Get(EnvAPIBase, EnvStoragePath)
|
2018-07-09 19:28:01 +02:00
|
|
|
if err != nil {
|
2020-02-27 20:14:46 +02:00
|
|
|
return nil, fmt.Errorf("acme-dns: %w", err)
|
2018-07-09 19:28:01 +02:00
|
|
|
}
|
|
|
|
|
2020-03-12 00:51:10 +02:00
|
|
|
client := goacmedns.NewClient(values[EnvAPIBase])
|
2020-07-10 01:48:18 +02:00
|
|
|
storage := goacmedns.NewFileStorage(values[EnvStoragePath], 0o600)
|
2018-07-09 19:28:01 +02:00
|
|
|
return NewDNSProviderClient(client, storage)
|
|
|
|
}
|
|
|
|
|
2018-12-06 23:50:17 +02:00
|
|
|
// NewDNSProviderClient creates an ACME-DNS DNSProvider with the given acmeDNSClient and goacmedns.Storage.
|
2018-07-09 19:28:01 +02:00
|
|
|
func NewDNSProviderClient(client acmeDNSClient, storage goacmedns.Storage) (*DNSProvider, error) {
|
|
|
|
if client == nil {
|
|
|
|
return nil, errors.New("ACME-DNS Client must be not nil")
|
|
|
|
}
|
|
|
|
|
|
|
|
if storage == nil {
|
|
|
|
return nil, errors.New("ACME-DNS Storage must be not nil")
|
|
|
|
}
|
|
|
|
|
|
|
|
return &DNSProvider{
|
|
|
|
client: client,
|
|
|
|
storage: storage,
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// ErrCNAMERequired is returned by Present when the Domain indicated had no
|
|
|
|
// existing ACME-DNS account in the Storage and additional setup is required.
|
|
|
|
// The user must create a CNAME in the DNS zone for Domain that aliases FQDN
|
2018-12-06 23:50:17 +02:00
|
|
|
// to Target in order to complete setup for the ACME-DNS account that was created.
|
2018-07-09 19:28:01 +02:00
|
|
|
type ErrCNAMERequired struct {
|
|
|
|
// The Domain that is being issued for.
|
|
|
|
Domain string
|
|
|
|
// The alias of the CNAME (left hand DNS label).
|
|
|
|
FQDN string
|
|
|
|
// The RDATA of the CNAME (right hand side, canonical name).
|
|
|
|
Target string
|
|
|
|
}
|
|
|
|
|
|
|
|
// Error returns a descriptive message for the ErrCNAMERequired instance telling
|
|
|
|
// the user that a CNAME needs to be added to the DNS zone of c.Domain before
|
|
|
|
// the ACME-DNS hook will work. The CNAME to be created should be of the form:
|
|
|
|
// {{ c.FQDN }} CNAME {{ c.Target }}
|
|
|
|
func (e ErrCNAMERequired) Error() string {
|
|
|
|
return fmt.Sprintf("acme-dns: new account created for %q. "+
|
|
|
|
"To complete setup for %q you must provision the following "+
|
|
|
|
"CNAME in your DNS zone and re-run this provider when it is "+
|
|
|
|
"in place:\n"+
|
|
|
|
"%s CNAME %s.",
|
|
|
|
e.Domain, e.Domain, e.FQDN, e.Target)
|
|
|
|
}
|
|
|
|
|
2018-12-06 23:50:17 +02:00
|
|
|
// Present creates a TXT record to fulfill the DNS-01 challenge.
|
|
|
|
// If there is an existing account for the domain in the provider's storage
|
|
|
|
// then it will be used to set the challenge response TXT record with the ACME-DNS server and issuance will continue.
|
|
|
|
// If there is not an account for the given domain present in the DNSProvider storage
|
|
|
|
// one will be created and registered with the ACME DNS server and an ErrCNAMERequired error is returned.
|
|
|
|
// This will halt issuance and indicate to the user that a one-time manual setup is required for the domain.
|
2018-07-09 19:28:01 +02:00
|
|
|
func (d *DNSProvider) Present(domain, _, keyAuth string) error {
|
|
|
|
// Compute the challenge response FQDN and TXT value for the domain based
|
|
|
|
// on the keyAuth.
|
2018-12-06 23:50:17 +02:00
|
|
|
fqdn, value := dns01.GetRecord(domain, keyAuth)
|
2018-07-09 19:28:01 +02:00
|
|
|
|
|
|
|
// Check if credentials were previously saved for this domain.
|
|
|
|
account, err := d.storage.Fetch(domain)
|
|
|
|
// Errors other than goacmeDNS.ErrDomainNotFound are unexpected.
|
|
|
|
if err != nil && err != goacmedns.ErrDomainNotFound {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err == goacmedns.ErrDomainNotFound {
|
|
|
|
// The account did not exist. Create a new one and return an error
|
|
|
|
// indicating the required one-time manual CNAME setup.
|
|
|
|
return d.register(domain, fqdn)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Update the acme-dns TXT record.
|
|
|
|
return d.client.UpdateTXTRecord(account, value)
|
|
|
|
}
|
|
|
|
|
|
|
|
// CleanUp removes the record matching the specified parameters. It is not
|
|
|
|
// implemented for the ACME-DNS provider.
|
|
|
|
func (d *DNSProvider) CleanUp(_, _, _ string) error {
|
2018-12-06 23:50:17 +02:00
|
|
|
// ACME-DNS doesn't support the notion of removing a record.
|
|
|
|
// For users of ACME-DNS it is expected the stale records remain in-place.
|
2018-07-09 19:28:01 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-12-06 23:50:17 +02:00
|
|
|
// register creates a new ACME-DNS account for the given domain.
|
|
|
|
// If account creation works as expected a ErrCNAMERequired error is returned describing
|
|
|
|
// the one-time manual CNAME setup required to complete setup of the ACME-DNS hook for the domain.
|
|
|
|
// If any other error occurs it is returned as-is.
|
2018-07-09 19:28:01 +02:00
|
|
|
func (d *DNSProvider) register(domain, fqdn string) error {
|
|
|
|
// TODO(@cpu): Read CIDR whitelists from the environment
|
|
|
|
newAcct, err := d.client.RegisterAccount(nil)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Store the new account in the storage and call save to persist the data.
|
|
|
|
err = d.storage.Put(domain, newAcct)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
err = d.storage.Save()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2018-12-06 23:50:17 +02:00
|
|
|
// Stop issuance by returning an error.
|
|
|
|
// The user needs to perform a manual one-time CNAME setup in their DNS zone
|
|
|
|
// to complete the setup of the new account we created.
|
2018-07-09 19:28:01 +02:00
|
|
|
return ErrCNAMERequired{
|
|
|
|
Domain: domain,
|
|
|
|
FQDN: fqdn,
|
|
|
|
Target: newAcct.FullDomain,
|
|
|
|
}
|
|
|
|
}
|