on_demand tls fails

[lukepighetti]

when i try to obtain a certificate on demand for customerdomain.com, i get this error from porkbun.

• [x] i have TLS working for my porkbun domain, subdomains, and wildcard subdomains (not pictured in caddyfile)
• [ ] porkbun says the customer on-demand domain is not opted in to api access

this is my first rodeo with TLS/DNS, is it reasonable to expect porkbun (and this integration) to handle this use case? if not, is there a particular dns provider that is known to work?

2024/08/21 12:26:29.649 INFO    http.acme_client    trying to solve challenge   {"identifier": "chadbod.app", "challenge_type": "dns-01", "ca": "https://acme-v02.api.letsencrypt.org/directory"}
2024/08/21 12:26:30.386 ERROR   http.acme_client    cleaning up solver  {"identifier": "chadbod.app", "challenge_type": "dns-01", "error": "no memory of presenting a DNS record for \"_acme-challenge.chadbod.app\" (usually OK if presenting also failed)"}
2024/08/21 12:26:30.457 ERROR   tls.obtain  could not get certificate from issuer   {"identifier": "chadbod.app", "issuer": "acme-v02.api.letsencrypt.org-directory", "error": "[chadbod.app] solving challenges: presenting for challenge: adding temporary record for zone \"chadbod.app.\": Invalid http response status, {\"status\":\"ERROR\",\"message\":\"Domain is not opted in to API access.\"} (order=https://acme-v02.api.letsencrypt.org/acme/order/1902835346/298178291746) (ca=https://acme-v02.api.letsencrypt.org/directory)"}
2024/08/21 12:26:30.457 ERROR   tls.obtain  will retry  {"error": "[chadbod.app] Obtain: [chadbod.app] solving challenges: presenting for challenge: adding temporary record for zone \"chadbod.app.\": Invalid http response status, {\"status\":\"ERROR\",\"message\":\"Domain is not opted in to API access.\"} (order=https://acme-v02.api.letsencrypt.org/acme/order/1902835346/298178291746) (ca=https://acme-v02.api.letsencrypt.org/directory)", "attempt": 1, "retrying_in": 60, "elapsed": 1.222814301, "max_duration": 2592000}

{
    on_demand_tls {
        ask https://ask.tappy.studio
    }
}

https:// {
        # this redirects customerdomain.com to a static http folder at /root/data/customerdomain.com
    root * /root/data/{http.request.host.labels.1}.{http.request.host.labels.0}
    file_server

    # on demand multi-tenant tls
    tls {
        # https://caddyserver.com/on-demand-tls
        on_demand
        dns porkbun {
            api_key <REDACTED>
            api_secret_key <REDACTED>
        }
        # https://caddy.community/t/could-not-determine-zone-for-domain/18720/7
        resolvers 8.8.8.8
    }
}

[Niallfitzy1]

Hi @lukepighetti

In order to use libraries like this, you'll need to enable API access from Porkbun domain management.

Here's the Porkbun guide for configuration API access

Everything should hopefully go smoothly afterwards 🤞