If the Powerdns returns a 403 Access Denied (e.g. if the API key is "User", not "Operator") it will just return an error:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certbot/error_handler.py", line 124, in _call_registered
self.funcs[-1]()
File "/usr/lib/python3/dist-packages/certbot/auth_handler.py", line 243, in _cleanup_challenges
self.auth.cleanup(achalls)
File "/usr/local/lib/python3.8/dist-packages/certbot_pdns/authenticator.py", line 75, in cleanup
self.backend.cleanup(achall)
File "/usr/local/lib/python3.8/dist-packages/certbot_pdns/PdnsApiAuthenticator.py", line 113, in cleanup
self.flush_zone(zone["name"])
File "/usr/local/lib/python3.8/dist-packages/certbot_pdns/PdnsApiAuthenticator.py", line 36, in flush_zone
res = self.api.flush_zone_cache(zone_name)
File "/usr/local/lib/python3.8/dist-packages/certbot_pdns/pdnsapi.py", line 110, in flush_zone_cache
return self._query("/servers/localhost/cache/flush?domain=%s" % zone_name, "PUT")
File "/usr/local/lib/python3.8/dist-packages/certbot_pdns/pdnsapi.py", line 61, in _query
return None if request.status_code == 204 else request.json()
File "/usr/lib/python3/dist-packages/requests/models.py", line 897, in json
return complexjson.loads(self.text, **kwargs)
File "/usr/lib/python3.8/json/__init__.py", line 357, in loads
return _default_decoder.decode(s)
File "/usr/lib/python3.8/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python3.8/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
After changing the role to "Operator" it worked.
Also maybe adding a hint to the README that the Operator Role is required would help others, too :)
If the Powerdns returns a 403 Access Denied (e.g. if the API key is "User", not "Operator") it will just return an error:
After changing the role to "Operator" it worked. Also maybe adding a hint to the README that the Operator Role is required would help others, too :)