dokku-letsencrypt icon indicating copy to clipboard operation
dokku-letsencrypt copied to clipboard

[WIP] Added DNS-01 challange support

Open pushrbx opened this issue 2 years ago • 2 comments

I'm a very rookie with bash, so this PR can't be really called production ready. For now it works by passing in the environment variables required for each supported DNS provider.

Known issues:

  • Credentials leaking into bash history, because you have to use dokku config:set <app> DOKKU_LETSENCRYPT_LEGO_ENV_VARS="MY_SECRET=214;MY_OTHER_SECRET=sdfdsf" to make the dns challange work.
  • If you set DOKKU_LETSENCRYPT_CHALLANGE_MODE to dns but if you don't set DOKKU_LETSENCRYPT_DNS_PROVIDER the script won't notify you that you are doing something wrong.
  • Untested wildcard support. (#189)

More info about env vars here; https://go-acme.github.io/lego/dns/
Added new env vars for the plugin's configuration:

  • DOKKU_LETSENCRYPT_LEGO_ENV_VARS
  • DOKKU_LETSENCRYPT_DNS_PROVIDER
  • DOKKU_LETSENCRYPT_CHALLANGE_MODE
Variable Default Description
DOKKU_LETSENCRYPT_CHALLANGE_MODE http The challange mode you'd like to use. Valid values are http and dns.
DOKKU_LETSENCRYPT_DNS_PROVIDER (none) You must set this to a dns provider code from the lego docs if DOKKU_LETSENCRYPT_CHALLANGE_MODE is dns.
DOKKU_LETSENCRYPT_LEGO_ENV_VARS (none) Additional environment variables for lego CLI.

I'm opening this here in hope that the community will pitch in some ideas for solving the issues described above. 😸

pushrbx avatar May 08 '22 17:05 pushrbx

This is great work!

One thing I'd like to get away from is using new environment variables for plugin config. It clutters actual app environment variables. Would you be willing to make an MR to first migrate away from environment variables and into using the properties system? Here is an example MR doing so for the old registry plugin: https://github.com/dokku/dokku-registry/pull/8/files

josegonzalez avatar May 12 '22 02:05 josegonzalez

No problem, will do.

pushrbx avatar May 12 '22 08:05 pushrbx

I can't pull this in now due to a few merge conflicts (both new and old) but I am working on this functionality now. Thanks for the initial contribution!

josegonzalez avatar Jan 28 '23 09:01 josegonzalez