search

pan-net-security / certbot-dns-powerdns

PowerDNS DNS Authenticator plugin for Certbot
25 stars 16 forks source link

Add support for the PowerDNS-Admin API #15

Open tmuncks opened 2 years ago

tmuncks commented 2 years ago

The PowerDNS-Admin project provides a PowerDNS compatible API that's scoped to allow an API KEY to access only specific, authenticated domains.

The only change needed to support this in certbot-dns-powerdns, is to accept a few new responses when guessing the zone name.

This PR adds support for this, and have been tested with all (3) available access roles from PowerDNS-Admin (User, Operator, Administrator).

tmuncks commented 2 years ago

This is pretty much functionally identical to #10 but works for all API roles in PowerDNS-Admin

tmuncks commented 2 years ago

For some reason the build fails after pushing an update to README.md. This is most likely a false positive, but please let me know if you need anything to get this merged. :-)

tmuncks commented 2 years ago

Updated the PR as I saw reverse proxy configurations changing the default gunicorn HTTP Status messages from eg. "FORBIDDEN" to "Forbidden" to better honor the RFCs. I have redone the check to use the status_code, which makes more sense since the textual representation is just another representation of the code anyway.

michaelarnauts commented 2 years ago

I can confirm that this change makes it work with the PowerDNS-Admin API. Thanks!

Heshmatkhah commented 1 year ago

Any Updates on this PR?

komodin commented 11 months ago

Hi, we encountered the same error when using the PowerDNS Admin API and I'm glad to found that someone encountered the same issue.

It will be really amazing if someone from @pan-net-security could take a quick look and merge it.

Sorry for the mention but maybe @splashx @beli-sk @mbag @matusf can help us with this.

Thanks in advance!

tmuncks commented 11 months ago

FWIW, I'm still using the same code in production in several places, with no issue since this PR was created.

komodin commented 11 months ago

I also know that we're able to manually build it or whatever, but as this project has the dns-powerdns name I think it will be nice to make it compatible with the tools that we use nowadays.