Open UltraHKR opened 2 years ago
It's an okay feature to implement - as far as I understand some folks just prefer to use CF, however IIRC they don't provide a DNS-native protocol for this. (Well, they do, but it's for Enterprise customers only - and I guess that if you're paying upwards of 10.000+$/year for that then you're using something else to host your mail - source: https://developers.cloudflare.com/dns/zone-setups/zone-transfers/)
However, I feel that there's a better way to approach this from an User Experience perspective - ideally, you'd have a section on either the Custom DNS or External DNS page that would allow you to link the box to your CF account. From that point on the box would automatically and transparently synchronize the records with the CF account. That's it, no more setup needed.
My gripe is that MiAB wants to do everything........ I like certain things separated (FW & DNS for example)
So for example if we go the cloudflare route: The certs are easy https://www.keyvanfatehi.com/2021/09/11/using-acme-sh-in-cloudflare-dns-mode-to-easily-maintain-wildcard-ssl-certificate-for-apache-server-on-ubuntu-20-04/ https://mangolassi.it/topic/18355/setup-letsencrypt-certbot-with-cloudflare-dns-authentication-ubuntu
Updating DNS with cloudflare API: https://api.cloudflare.com/#getting-started-endpoints
I'm thinking about the feature working both ways - whatever record you add/delete on the box or whatever key is regenerated the box is able to post that in the CF DNS right away; and if you add or delete a record directly on CF the box is to take note of that too.
The only issue I find with that is what if you delete/change a record that is managed by the box and that it isn't supposed to be able to be overriden - should the box respect that or should the box just put the record back in as it is supposed to be right away?
Yeah, I was thinking about that........
My line of thinking is [External DNS] > List of records > Toggle - NS Records (The "toggle", a checkbox really allows/denies updating the NS records)
ddavness, so to move forward:
which files create the DNS request on install? https://github.com/ddavness/power-mailinabox/blob/main/setup/start.sh https://github.com/ddavness/power-mailinabox/blob/main/setup/ssl.sh https://github.com/ddavness/power-mailinabox/blob/main/setup/management.sh
which files update the DNS records? https://github.com/ddavness/power-mailinabox/blob/main/management/ssl_certificates.py
I suppose those are the minimum files to be edited..... Without touching the WebUI
This isn't just a CloudFlare issue. There are hundreds of DNS providers each with their own non-standard API, CF is just one. I also like to keep my DNS external, are you also going to support my DNS provider API or allow a provider plugin?
It might be worth evaluating if you can reuse the acme.sh interface which was only meant to support acme validation TXT records...
You also might be interested in this found in ssl_certificates.py
:
# The DANE TLSA record will remain valid so long as the private key # hasn't changed. We don't ever change the private key automatically. # If the user does it, they must manually update DNS.
Meaning your first issue If I create TLSA records they will not be updated, when refreshed.
isn't an issue
There are hundreds of DNS providers each with their own non-standard API, CF is just one. I also like to keep my DNS external, are you also going to support my DNS provider API or allow a provider plugin?
I see - this issue would probably circle back all the way to #46 that way. If there are a ton of DNS providers that use their own API without supporting AXFR, then we should focus on giving a solid base for individual providers to be built on instead of trying to hardcode them all.
About the TLSA records, let's say I tomorrow change them to Cloudflare for HTTP/S then TLSA records need to be updated properly
About the rest of DNS API providers, it's open source you could extend my PR (when done or even faster than me) so XYZ API is usable
About the TLSA records, let's say I tomorrow change them to Cloudflare for HTTP/S then TLSA records need to be updated properly
So if you're changing your certificate and frontend HTTPS concentrator:
This is a mail-in-a-box, not a webserver in a box. It just so happens it can also host static files.
It seems to me you might be unaware you can have multiple certificates issued for the same domain and even subdomain on different servers?
Hi, ddavness
First of all I'm extremely grateful for the rework of MiAB, it looks and feels awesome!
I have this "simple" request, I use Cloudflare as my NS and that poses 2 problems:
What I would try to do is: Add a question before the installer starts requesting, ACME certs saying "Are you using Cloudflare CDN?"
Will you accept a PR, that allows this? (And help me out somewhat with certain files location and logic)