Add DNS provider for Technitium (#2332)

README.md

@@ -200,37 +200,37 @@ Detailed documentation is available [here](https://go-acme.github.io/lego/dns).
   <td><a href="https://go-acme.github.io/lego/dns/simply/">Simply.com</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/sonic/">Sonic</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/stackpath/">Stackpath</a></td>
-  <td><a href="https://go-acme.github.io/lego/dns/tencentcloud/">Tencent Cloud DNS</a></td>
+  <td><a href="https://go-acme.github.io/lego/dns/technitium/">Technitium</a></td>
 </tr><tr>
+  <td><a href="https://go-acme.github.io/lego/dns/tencentcloud/">Tencent Cloud DNS</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/timewebcloud/">Timeweb Cloud</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/transip/">TransIP</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/safedns/">UKFast SafeDNS</a></td>
-  <td><a href="https://go-acme.github.io/lego/dns/ultradns/">Ultradns</a></td>
 </tr><tr>
+  <td><a href="https://go-acme.github.io/lego/dns/ultradns/">Ultradns</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/variomedia/">Variomedia</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/vegadns/">VegaDNS</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/vercel/">Vercel</a></td>
-  <td><a href="https://go-acme.github.io/lego/dns/versio/">Versio.[nl|eu|uk]</a></td>
 </tr><tr>
+  <td><a href="https://go-acme.github.io/lego/dns/versio/">Versio.[nl|eu|uk]</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/vinyldns/">VinylDNS</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/vkcloud/">VK Cloud</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/volcengine/">Volcano Engine/火山引擎</a></td>
-  <td><a href="https://go-acme.github.io/lego/dns/vscale/">Vscale</a></td>
 </tr><tr>
+  <td><a href="https://go-acme.github.io/lego/dns/vscale/">Vscale</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/vultr/">Vultr</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/webnames/">Webnames</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/websupport/">Websupport</a></td>
-  <td><a href="https://go-acme.github.io/lego/dns/wedos/">WEDOS</a></td>
 </tr><tr>
+  <td><a href="https://go-acme.github.io/lego/dns/wedos/">WEDOS</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/yandex360/">Yandex 360</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/yandexcloud/">Yandex Cloud</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/yandex/">Yandex PDD</a></td>
-  <td><a href="https://go-acme.github.io/lego/dns/zoneee/">Zone.ee</a></td>
 </tr><tr>
+  <td><a href="https://go-acme.github.io/lego/dns/zoneee/">Zone.ee</a></td>
   <td><a href="https://go-acme.github.io/lego/dns/zonomi/">Zonomi</a></td>
   <td></td>
   <td></td>
-  <td></td>
 </tr></table>
 
 <!-- END DNS PROVIDERS LIST -->

cmd/zz_gen_cmd_dnshelp.go

@@ -132,6 +132,7 @@ func allDNSCodes() string {
 		"simply",
 		"sonic",
 		"stackpath",
+		"technitium",
 		"tencentcloud",
 		"timewebcloud",
 		"transip",
@@ -2728,6 +2729,27 @@ func displayDNSHelp(w io.Writer, name string) error {
 		ew.writeln()
 		ew.writeln(`More information: https://go-acme.github.io/lego/dns/stackpath`)
 
+	case "technitium":
+		// generated from: providers/dns/technitium/technitium.toml
+		ew.writeln(`Configuration for Technitium.`)
+		ew.writeln(`Code:	'technitium'`)
+		ew.writeln(`Since:	'v4.20.0'`)
+		ew.writeln()
+
+		ew.writeln(`Credentials:`)
+		ew.writeln(`	- "TECHNITIUM_API_TOKEN":	API token`)
+		ew.writeln(`	- "TECHNITIUM_SERVER_BASE_URL":	Server base URL`)
+		ew.writeln()
+
+		ew.writeln(`Additional Configuration:`)
+		ew.writeln(`	- "TECHNITIUM_HTTP_TIMEOUT":	API request timeout`)
+		ew.writeln(`	- "TECHNITIUM_POLLING_INTERVAL":	Time between DNS propagation check`)
+		ew.writeln(`	- "TECHNITIUM_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation`)
+		ew.writeln(`	- "TECHNITIUM_TTL":	The TTL of the TXT record used for the DNS challenge`)
+
+		ew.writeln()
+		ew.writeln(`More information: https://go-acme.github.io/lego/dns/technitium`)
+
 	case "tencentcloud":
 		// generated from: providers/dns/tencentcloud/tencentcloud.toml
 		ew.writeln(`Configuration for Tencent Cloud DNS.`)

docs/content/dns/zz_gen_technitium.md

@@ -0,0 +1,74 @@
+---
+title: "Technitium"
+date: 2019-03-03T16:39:46+01:00
+draft: false
+slug: technitium
+dnsprovider:
+  since:    "v4.20.0"
+  code:     "technitium"
+  url:      "https://technitium.com/"
+---
+
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
+<!-- providers/dns/technitium/technitium.toml -->
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
+
+
+Configuration for [Technitium](https://technitium.com/).
+
+
+<!--more-->
+
+- Code: `technitium`
+- Since: v4.20.0
+
+
+Here is an example bash command using the Technitium provider:
+
+```bash
+TECHNITIUM_SERVER_BASE_URL="https://localhost:5380" \
+TECHNITIUM_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
+lego --email you@example.com --dns technitium -d '*.example.com' -d example.com run
+```
+
+
+
+
+## Credentials
+
+| Environment Variable Name | Description |
+|-----------------------|-------------|
+| `TECHNITIUM_API_TOKEN` | API token |
+| `TECHNITIUM_SERVER_BASE_URL` | Server base URL |
+
+The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
+More information [here]({{% ref "dns#configuration-and-credentials" %}}).
+
+
+## Additional Configuration
+
+| Environment Variable Name | Description |
+|--------------------------------|-------------|
+| `TECHNITIUM_HTTP_TIMEOUT` | API request timeout |
+| `TECHNITIUM_POLLING_INTERVAL` | Time between DNS propagation check |
+| `TECHNITIUM_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation |
+| `TECHNITIUM_TTL` | The TTL of the TXT record used for the DNS challenge |
+
+The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
+More information [here]({{% ref "dns#configuration-and-credentials" %}}).
+
+Technitium DNS Server supports Dynamic Updates (RFC2136) for primary zones,
+so you can also use the [RFC2136 provider](https://go-acme.github.io/lego/dns/rfc2136/index.html).
+
+[RFC2136 provider](https://go-acme.github.io/lego/dns/rfc2136/index.html) is much better compared to the HTTP API option from security perspective.
+Technitium recommends to use it in production over the HTTP API.
+
+
+
+## More information
+
+- [API documentation](https://github.com/TechnitiumSoftware/DnsServer/blob/0f83d23e605956b66ac76921199e241d9cc061bd/APIDOCS.md)
+
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
+<!-- providers/dns/technitium/technitium.toml -->
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->

docs/data/zz_cli_help.toml

@@ -141,7 +141,7 @@ To display the documentation for a specific DNS provider, run:
   $ lego dnshelp -c code
 
 Supported DNS providers:
-  acme-dns, alidns, allinkl, arvancloud, auroradns, autodns, azure, azuredns, bindman, bluecat, brandit, bunny, checkdomain, civo, clouddns, cloudflare, cloudns, cloudru, cloudxns, conoha, constellix, corenetworks, cpanel, derak, desec, designate, digitalocean, directadmin, dnshomede, dnsimple, dnsmadeeasy, dnspod, dode, domeneshop, dreamhost, duckdns, dyn, dynu, easydns, edgedns, efficientip, epik, exec, exoscale, freemyip, gandi, gandiv5, gcloud, gcore, glesys, godaddy, googledomains, hetzner, hostingde, hosttech, httpnet, httpreq, huaweicloud, hurricane, hyperone, ibmcloud, iij, iijdpf, infoblox, infomaniak, internetbs, inwx, ionos, ipv64, iwantmyname, joker, liara, lightsail, limacity, linode, liquidweb, loopia, luadns, mailinabox, manual, metaname, mijnhost, mittwald, mydnsjp, mythicbeasts, namecheap, namedotcom, namesilo, nearlyfreespeech, netcup, netlify, nicmanager, nifcloud, njalla, nodion, ns1, oraclecloud, otc, ovh, pdns, plesk, porkbun, rackspace, rcodezero, regfish, regru, rfc2136, rimuhosting, route53, safedns, sakuracloud, scaleway, selectel, selectelv2, selfhostde, servercow, shellrent, simply, sonic, stackpath, tencentcloud, timewebcloud, transip, ultradns, variomedia, vegadns, vercel, versio, vinyldns, vkcloud, volcengine, vscale, vultr, webnames, websupport, wedos, yandex, yandex360, yandexcloud, zoneee, zonomi
+  acme-dns, alidns, allinkl, arvancloud, auroradns, autodns, azure, azuredns, bindman, bluecat, brandit, bunny, checkdomain, civo, clouddns, cloudflare, cloudns, cloudru, cloudxns, conoha, constellix, corenetworks, cpanel, derak, desec, designate, digitalocean, directadmin, dnshomede, dnsimple, dnsmadeeasy, dnspod, dode, domeneshop, dreamhost, duckdns, dyn, dynu, easydns, edgedns, efficientip, epik, exec, exoscale, freemyip, gandi, gandiv5, gcloud, gcore, glesys, godaddy, googledomains, hetzner, hostingde, hosttech, httpnet, httpreq, huaweicloud, hurricane, hyperone, ibmcloud, iij, iijdpf, infoblox, infomaniak, internetbs, inwx, ionos, ipv64, iwantmyname, joker, liara, lightsail, limacity, linode, liquidweb, loopia, luadns, mailinabox, manual, metaname, mijnhost, mittwald, mydnsjp, mythicbeasts, namecheap, namedotcom, namesilo, nearlyfreespeech, netcup, netlify, nicmanager, nifcloud, njalla, nodion, ns1, oraclecloud, otc, ovh, pdns, plesk, porkbun, rackspace, rcodezero, regfish, regru, rfc2136, rimuhosting, route53, safedns, sakuracloud, scaleway, selectel, selectelv2, selfhostde, servercow, shellrent, simply, sonic, stackpath, technitium, tencentcloud, timewebcloud, transip, ultradns, variomedia, vegadns, vercel, versio, vinyldns, vkcloud, volcengine, vscale, vultr, webnames, websupport, wedos, yandex, yandex360, yandexcloud, zoneee, zonomi
 
 More information: https://go-acme.github.io/lego/dns
 """

providers/dns/technitium/internal/client.go

@@ -0,0 +1,158 @@
+package internal
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/go-acme/lego/v4/providers/dns/internal/errutils"
+	querystring "github.com/google/go-querystring/query"
+)
+
+const statusSuccess = "ok"
+
+// Client the Technitium API client.
+type Client struct {
+	apiToken string
+
+	baseURL    *url.URL
+	HTTPClient *http.Client
+}
+
+// NewClient creates a new Client.
+func NewClient(baseURL, apiToken string) (*Client, error) {
+	if apiToken == "" {
+		return nil, errors.New("missing credentials")
+	}
+
+	if baseURL == "" {
+		return nil, errors.New("missing server URL")
+	}
+
+	apiEndpoint, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Client{
+		apiToken:   apiToken,
+		baseURL:    apiEndpoint,
+		HTTPClient: &http.Client{Timeout: 10 * time.Second},
+	}, nil
+}
+
+// AddRecord adds a resource record for an authoritative zone.
+// https://github.com/TechnitiumSoftware/DnsServer/blob/master/APIDOCS.md#add-record
+func (c *Client) AddRecord(ctx context.Context, record Record) (*Record, error) {
+	endpoint := c.baseURL.JoinPath("api", "zones", "records", "add")
+
+	req, err := c.newFormRequest(ctx, endpoint, record)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	result := &APIResponse[AddRecordResponse]{}
+
+	err = c.do(req, result)
+	if err != nil {
+		return nil, err
+	}
+
+	if result.Status != statusSuccess {
+		return nil, result
+	}
+
+	return result.Response.AddedRecord, nil
+}
+
+// DeleteRecord deletes a record from an authoritative zone.
+// https://github.com/TechnitiumSoftware/DnsServer/blob/master/APIDOCS.md#delete-record
+func (c *Client) DeleteRecord(ctx context.Context, record Record) error {
+	endpoint := c.baseURL.JoinPath("api", "zones", "records", "delete")
+
+	req, err := c.newFormRequest(ctx, endpoint, record)
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+
+	result := &APIResponse[any]{}
+
+	err = c.do(req, result)
+	if err != nil {
+		return err
+	}
+
+	if result.Status != statusSuccess {
+		return result
+	}
+
+	return nil
+}
+
+func (c *Client) do(req *http.Request, result any) error {
+	resp, err := c.HTTPClient.Do(req)
+	if err != nil {
+		return errutils.NewHTTPDoError(req, err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode > http.StatusBadRequest {
+		return parseError(req, resp)
+	}
+
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return errutils.NewReadResponseError(req, resp.StatusCode, err)
+	}
+
+	err = json.Unmarshal(raw, result)
+	if err != nil {
+		return errutils.NewUnmarshalError(req, resp.StatusCode, raw, err)
+	}
+
+	return nil
+}
+
+func (c *Client) newFormRequest(ctx context.Context, endpoint *url.URL, payload any) (*http.Request, error) {
+	values := url.Values{}
+
+	if payload != nil {
+		var err error
+		values, err = querystring.Values(payload)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create request body: %w", err)
+		}
+	}
+
+	values.Set("token", c.apiToken)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), strings.NewReader(values.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("unable to create request: %w", err)
+	}
+
+	if payload != nil {
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	}
+
+	return req, nil
+}
+
+func parseError(req *http.Request, resp *http.Response) error {
+	raw, _ := io.ReadAll(resp.Body)
+
+	var errAPI APIResponse[any]
+	err := json.Unmarshal(raw, &errAPI)
+	if err != nil {
+		return errutils.NewUnexpectedStatusCodeError(req, resp.StatusCode, raw)
+	}
+
+	return &errAPI
+}

providers/dns/technitium/internal/client_test.go

@@ -0,0 +1,105 @@
+package internal
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupTest(t *testing.T, pattern string, filename string) *Client {
+	t.Helper()
+
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	mux.HandleFunc(pattern, func(rw http.ResponseWriter, req *http.Request) {
+		file, err := os.Open(filepath.Join("fixtures", filename))
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		defer func() { _ = file.Close() }()
+
+		_, err = io.Copy(rw, file)
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	})
+
+	client, err := NewClient(server.URL, "secret")
+	require.NoError(t, err)
+
+	client.HTTPClient = server.Client()
+
+	return client
+}
+
+func TestClient_AddRecord(t *testing.T) {
+	client := setupTest(t, "POST /api/zones/records/add", "add-record.json")
+
+	record := Record{
+		Domain: "_acme-challenge.example.com",
+		Type:   "TXT",
+		Text:   "txtTXTtxt",
+	}
+
+	newRecord, err := client.AddRecord(context.Background(), record)
+	require.NoError(t, err)
+
+	expected := &Record{Name: "example.com", Type: "A"}
+
+	assert.Equal(t, expected, newRecord)
+}
+
+func TestClient_AddRecord_error(t *testing.T) {
+	client := setupTest(t, "POST /api/zones/records/add", "error.json")
+
+	record := Record{
+		Domain: "_acme-challenge.example.com",
+		Type:   "TXT",
+		Text:   "txtTXTtxt",
+	}
+
+	_, err := client.AddRecord(context.Background(), record)
+	require.Error(t, err)
+
+	assert.EqualError(t, err, "Status: error, ErrorMessage: error message, StackTrace: application stack trace, InnerErrorMessage: inner exception message")
+}
+
+func TestClient_DeleteRecord(t *testing.T) {
+	client := setupTest(t, "POST /api/zones/records/delete", "delete-record.json")
+
+	record := Record{
+		Domain: "_acme-challenge.example.com",
+		Type:   "TXT",
+		Text:   "txtTXTtxt",
+	}
+
+	err := client.DeleteRecord(context.Background(), record)
+	require.NoError(t, err)
+}
+
+func TestClient_DeleteRecord_error(t *testing.T) {
+	client := setupTest(t, "POST /api/zones/records/delete", "error.json")
+
+	record := Record{
+		Domain: "_acme-challenge.example.com",
+		Type:   "TXT",
+		Text:   "txtTXTtxt",
+	}
+
+	err := client.DeleteRecord(context.Background(), record)
+	require.Error(t, err)
+
+	assert.EqualError(t, err, "Status: error, ErrorMessage: error message, StackTrace: application stack trace, InnerErrorMessage: inner exception message")
+}

providers/dns/technitium/internal/fixtures/add-record.json

@@ -0,0 +1,23 @@
+{
+  "response": {
+    "zone": {
+      "name": "example.com",
+      "type": "Primary",
+      "internal": false,
+      "dnssecStatus": "SignedWithNSEC",
+      "disabled": false
+    },
+    "addedRecord": {
+      "disabled": false,
+      "name": "example.com",
+      "type": "A",
+      "ttl": 3600,
+      "rData": {
+        "ipAddress": "3.3.3.3"
+      },
+      "dnssecStatus": "Unknown",
+      "lastUsedOn": "0001-01-01T00:00:00"
+    }
+  },
+  "status": "ok"
+}

providers/dns/technitium/internal/fixtures/delete-record.json

@@ -0,0 +1,4 @@
+{
+  "response": {},
+  "status": "ok"
+}

providers/dns/technitium/internal/fixtures/error.json

@@ -0,0 +1,6 @@
+{
+  "status": "error",
+  "errorMessage": "error message",
+  "stackTrace": "application stack trace",
+  "innerErrorMessage": "inner exception message"
+}

providers/dns/technitium/internal/types.go

@@ -0,0 +1,48 @@
+package internal
+
+import "fmt"
+
+type APIResponse[T any] struct {
+	Status string `json:"status"` // ok/error/invalid-token
+
+	Response T `json:"response"`
+
+	ErrorMessage      string `json:"errorMessage"`
+	StackTrace        string `json:"stackTrace"`
+	InnerErrorMessage string `json:"innerErrorMessage"`
+}
+
+func (a *APIResponse[T]) Error() string {
+	msg := fmt.Sprintf("Status: %s", a.Status)
+
+	if a.ErrorMessage != "" {
+		msg += fmt.Sprintf(", ErrorMessage: %s", a.ErrorMessage)
+	}
+
+	if a.StackTrace != "" {
+		msg += fmt.Sprintf(", StackTrace: %s", a.StackTrace)
+	}
+
+	if a.InnerErrorMessage != "" {
+		msg += fmt.Sprintf(", InnerErrorMessage: %s", a.InnerErrorMessage)
+	}
+
+	return msg
+}
+
+type AddRecordResponse struct {
+	Zone        *Zone   `json:"zone"`
+	AddedRecord *Record `json:"addedRecord"`
+}
+
+type Record struct {
+	Name   string `json:"name,omitempty" url:"-"`
+	Domain string `json:"domain,omitempty" url:"domain"`
+	Type   string `json:"type,omitempty" url:"type"`
+	Text   string `json:"text,omitempty" url:"text"`
+}
+
+type Zone struct {
+	Name string `json:"name"`
+	Type string `json:"type"`
+}

providers/dns/technitium/technitium.go

@@ -0,0 +1,133 @@
+// Package technitium implements a DNS provider for solving the DNS-01 challenge using Technitium.
+package technitium
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/go-acme/lego/v4/challenge/dns01"
+	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/technitium/internal"
+)
+
+// Environment variables names.
+const (
+	envNamespace = "TECHNITIUM_"
+
+	EnvServerBaseURL = envNamespace + "SERVER_BASE_URL"
+	EnvAPIToken      = envNamespace + "API_TOKEN"
+
+	EnvTTL                = envNamespace + "TTL"
+	EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
+	EnvPollingInterval    = envNamespace + "POLLING_INTERVAL"
+	EnvHTTPTimeout        = envNamespace + "HTTP_TIMEOUT"
+)
+
+// Config is used to configure the creation of the DNSProvider.
+type Config struct {
+	BaseURL  string
+	APIToken string
+
+	PropagationTimeout time.Duration
+	PollingInterval    time.Duration
+	TTL                int
+	HTTPClient         *http.Client
+}
+
+// NewDefaultConfig returns a default configuration for the DNSProvider.
+func NewDefaultConfig() *Config {
+	return &Config{
+		TTL:                env.GetOrDefaultInt(EnvTTL, dns01.DefaultTTL),
+		PropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, dns01.DefaultPropagationTimeout),
+		PollingInterval:    env.GetOrDefaultSecond(EnvPollingInterval, dns01.DefaultPollingInterval),
+		HTTPClient: &http.Client{
+			Timeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),
+		},
+	}
+}
+
+// DNSProvider implements the challenge.Provider interface.
+type DNSProvider struct {
+	config *Config
+	client *internal.Client
+}
+
+// NewDNSProvider returns a DNSProvider instance configured for Technitium.
+func NewDNSProvider() (*DNSProvider, error) {
+	values, err := env.Get(EnvServerBaseURL, EnvAPIToken)
+	if err != nil {
+		return nil, fmt.Errorf("technitium: %w", err)
+	}
+
+	config := NewDefaultConfig()
+	config.BaseURL = values[EnvServerBaseURL]
+	config.APIToken = values[EnvAPIToken]
+
+	return NewDNSProviderConfig(config)
+}
+
+// NewDNSProviderConfig return a DNSProvider instance configured for Technitium.
+func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
+	if config == nil {
+		return nil, errors.New("technitium: the configuration of the DNS provider is nil")
+	}
+
+	client, err := internal.NewClient(config.BaseURL, config.APIToken)
+	if err != nil {
+		return nil, fmt.Errorf("technitium: %w", err)
+	}
+
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	return &DNSProvider{
+		config: config,
+		client: client,
+	}, nil
+}
+
+// Present creates a TXT record using the specified parameters.
+func (d *DNSProvider) Present(domain, token, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+
+	record := internal.Record{
+		Domain: info.EffectiveFQDN,
+		Type:   "TXT",
+		Text:   info.Value,
+	}
+
+	_, err := d.client.AddRecord(context.Background(), record)
+	if err != nil {
+		return fmt.Errorf("technitium: add record: %w", err)
+	}
+
+	return nil
+}
+
+// CleanUp removes the TXT record matching the specified parameters.
+func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+
+	record := internal.Record{
+		Domain: info.EffectiveFQDN,
+		Type:   "TXT",
+		Text:   info.Value,
+	}
+
+	err := d.client.DeleteRecord(context.Background(), record)
+	if err != nil {
+		return fmt.Errorf("technitium: delete record: %w", err)
+	}
+
+	return nil
+}
+
+// Timeout returns the timeout and interval to use when checking for DNS propagation.
+// Adjusting here to cope with spikes in propagation times.
+func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
+	return d.config.PropagationTimeout, d.config.PollingInterval
+}

providers/dns/technitium/technitium.toml

@@ -0,0 +1,33 @@
+Name = "Technitium"
+Description = ''''''
+URL = "https://technitium.com/"
+Code = "technitium"
+Since = "v4.20.0"
+
+Example = '''
+TECHNITIUM_SERVER_BASE_URL="https://localhost:5380" \
+TECHNITIUM_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
+lego --email you@example.com --dns technitium -d '*.example.com' -d example.com run
+'''
+
+Additional = '''
+Technitium DNS Server supports Dynamic Updates (RFC2136) for primary zones,
+so you can also use the [RFC2136 provider](https://go-acme.github.io/lego/dns/rfc2136/index.html).
+
+[RFC2136 provider](https://go-acme.github.io/lego/dns/rfc2136/index.html) is much better compared to the HTTP API option from security perspective.
+Technitium recommends to use it in production over the HTTP API.
+'''
+
+[Configuration]
+  [Configuration.Credentials]
+    TECHNITIUM_SERVER_BASE_URL = "Server base URL"
+    TECHNITIUM_API_TOKEN = "API token"
+  [Configuration.Additional]
+    TECHNITIUM_POLLING_INTERVAL = "Time between DNS propagation check"
+    TECHNITIUM_PROPAGATION_TIMEOUT = "Maximum waiting time for DNS propagation"
+    TECHNITIUM_TTL = "The TTL of the TXT record used for the DNS challenge"
+    TECHNITIUM_HTTP_TIMEOUT = "API request timeout"
+
+[Links]
+  API = "https://github.com/TechnitiumSoftware/DnsServer/blob/0f83d23e605956b66ac76921199e241d9cc061bd/APIDOCS.md"
+  Article = "https://blog.technitium.com/2023/03/"

providers/dns/technitium/technitium_test.go

@@ -0,0 +1,143 @@
+package technitium
+
+import (
+	"testing"
+
+	"github.com/go-acme/lego/v4/platform/tester"
+	"github.com/stretchr/testify/require"
+)
+
+const envDomain = envNamespace + "DOMAIN"
+
+var envTest = tester.NewEnvTest(EnvServerBaseURL, EnvAPIToken).WithDomain(envDomain)
+
+func TestNewDNSProvider(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		envVars  map[string]string
+		expected string
+	}{
+		{
+			desc: "success",
+			envVars: map[string]string{
+				EnvServerBaseURL: "https://localhost:5380",
+				EnvAPIToken:      "secret",
+			},
+		},
+		{
+			desc: "missing server base URL",
+			envVars: map[string]string{
+				EnvServerBaseURL: "",
+				EnvAPIToken:      "secret",
+			},
+			expected: "technitium: some credentials information are missing: TECHNITIUM_SERVER_BASE_URL",
+		},
+		{
+			desc: "missing token",
+			envVars: map[string]string{
+				EnvServerBaseURL: "https://localhost:5380",
+				EnvAPIToken:      "",
+			},
+			expected: "technitium: some credentials information are missing: TECHNITIUM_API_TOKEN",
+		},
+		{
+			desc:     "missing credentials",
+			envVars:  map[string]string{},
+			expected: "technitium: some credentials information are missing: TECHNITIUM_SERVER_BASE_URL,TECHNITIUM_API_TOKEN",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			defer envTest.RestoreEnv()
+			envTest.ClearEnv()
+
+			envTest.Apply(test.envVars)
+
+			p, err := NewDNSProvider()
+
+			if test.expected == "" {
+				require.NoError(t, err)
+				require.NotNil(t, p)
+				require.NotNil(t, p.config)
+				require.NotNil(t, p.client)
+			} else {
+				require.EqualError(t, err, test.expected)
+			}
+		})
+	}
+}
+
+func TestNewDNSProviderConfig(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		baseURL  string
+		token    string
+		expected string
+	}{
+		{
+			desc:    "success",
+			baseURL: "https://localhost:5380",
+			token:   "secret",
+		},
+		{
+			desc:     "missing server base URL",
+			token:    "secret",
+			expected: "technitium: missing server URL",
+		},
+		{
+			desc:     "missing token",
+			baseURL:  "https://localhost:5380",
+			expected: "technitium: missing credentials",
+		},
+		{
+			desc:     "missing credentials",
+			expected: "technitium: missing credentials",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			config := NewDefaultConfig()
+			config.BaseURL = test.baseURL
+			config.APIToken = test.token
+
+			p, err := NewDNSProviderConfig(config)
+
+			if test.expected == "" {
+				require.NoError(t, err)
+				require.NotNil(t, p)
+				require.NotNil(t, p.config)
+				require.NotNil(t, p.client)
+			} else {
+				require.EqualError(t, err, test.expected)
+			}
+		})
+	}
+}
+
+func TestLivePresent(t *testing.T) {
+	if !envTest.IsLiveTest() {
+		t.Skip("skipping live test")
+	}
+
+	envTest.RestoreEnv()
+	provider, err := NewDNSProvider()
+	require.NoError(t, err)
+
+	err = provider.Present(envTest.GetDomain(), "", "123d==")
+	require.NoError(t, err)
+}
+
+func TestLiveCleanUp(t *testing.T) {
+	if !envTest.IsLiveTest() {
+		t.Skip("skipping live test")
+	}
+
+	envTest.RestoreEnv()
+	provider, err := NewDNSProvider()
+	require.NoError(t, err)
+
+	err = provider.CleanUp(envTest.GetDomain(), "", "123d==")
+	require.NoError(t, err)
+}

providers/dns/zz_gen_dns_providers.go

@@ -126,6 +126,7 @@ import (
 	"github.com/go-acme/lego/v4/providers/dns/simply"
 	"github.com/go-acme/lego/v4/providers/dns/sonic"
 	"github.com/go-acme/lego/v4/providers/dns/stackpath"
+	"github.com/go-acme/lego/v4/providers/dns/technitium"
 	"github.com/go-acme/lego/v4/providers/dns/tencentcloud"
 	"github.com/go-acme/lego/v4/providers/dns/timewebcloud"
 	"github.com/go-acme/lego/v4/providers/dns/transip"
@@ -392,6 +393,8 @@ func NewDNSChallengeProviderByName(name string) (challenge.Provider, error) {
 		return sonic.NewDNSProvider()
 	case "stackpath":
 		return stackpath.NewDNSProvider()
+	case "technitium":
+		return technitium.NewDNSProvider()
 	case "tencentcloud":
 		return tencentcloud.NewDNSProvider()
 	case "timewebcloud":