search

joohoi / acme-dns

Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.
MIT License
2.13k stars 233 forks source link

Add `server_url` to JSON storage file #341

Open robalexdev opened 1 year ago

robalexdev commented 1 year ago

I noticed that the libdns/acme-dns provider expects a server_url field to be defined in the JSON storage file. The acme-dns server doesn't set the server_url field in the JSON returned by the /register endpoint.

It would be helpful for the register API to include server_url to make these JSON blobs compatible. Currently, software like Caddy, which uses the libdns/acme-dns provider, will error out when this is missing (ServerURL cannot be empty). Other software defaults to https://auth.acme-dns.io which could accidentally leak information intended for a self-hosted installation to that endpoint.

Can acme-dns add the server's domain as a new server_url field? Including the server's URL directly with the username/password in the JSON storage file would make it more self-contained.

maddes-b commented 1 week ago

The client called the API via an URL that is unknown to the acme-dns server. So acme-dns cannot return the URL the client used. There can be multiple ways to reach a single acme-dns instance (internal, external) with proxies and load balancers (e.g. nginx, kubernetes, etc.) before acme-dns. All depending on the setup by the server admin which is out of reach of acme-dns.

Solution: Client must know the URL to register, then the client should store the server URL for updates.

See https://github.com/maddes-b/acme-dns-client-2 or the https://github.com/acme-dns/acme-dns-client

Please close the issue when solved.