dokku-letsencrypt
dokku-letsencrypt copied to clipboard
[WIP] Added DNS-01 challange support
I'm a very rookie with bash, so this PR can't be really called production ready. For now it works by passing in the environment variables required for each supported DNS provider.
Known issues:
- Credentials leaking into bash history, because you have to use
dokku config:set <app> DOKKU_LETSENCRYPT_LEGO_ENV_VARS="MY_SECRET=214;MY_OTHER_SECRET=sdfdsf"
to make the dns challange work. - If you set
DOKKU_LETSENCRYPT_CHALLANGE_MODE
todns
but if you don't setDOKKU_LETSENCRYPT_DNS_PROVIDER
the script won't notify you that you are doing something wrong. - Untested wildcard support. (#189)
More info about env vars here; https://go-acme.github.io/lego/dns/
Added new env vars for the plugin's configuration:
- DOKKU_LETSENCRYPT_LEGO_ENV_VARS
- DOKKU_LETSENCRYPT_DNS_PROVIDER
- DOKKU_LETSENCRYPT_CHALLANGE_MODE
Variable | Default | Description |
---|---|---|
DOKKU_LETSENCRYPT_CHALLANGE_MODE |
http | The challange mode you'd like to use. Valid values are http and dns . |
DOKKU_LETSENCRYPT_DNS_PROVIDER |
(none) | You must set this to a dns provider code from the lego docs if DOKKU_LETSENCRYPT_CHALLANGE_MODE is dns . |
DOKKU_LETSENCRYPT_LEGO_ENV_VARS |
(none) | Additional environment variables for lego CLI. |
I'm opening this here in hope that the community will pitch in some ideas for solving the issues described above. 😸
This is great work!
One thing I'd like to get away from is using new environment variables for plugin config. It clutters actual app environment variables. Would you be willing to make an MR to first migrate away from environment variables and into using the properties system? Here is an example MR doing so for the old registry plugin: https://github.com/dokku/dokku-registry/pull/8/files
No problem, will do.
I can't pull this in now due to a few merge conflicts (both new and old) but I am working on this functionality now. Thanks for the initial contribution!