search

tobychui / zoraxy

A general purpose HTTP reverse proxy and forwarding tool. Now written in Go!
https://zoraxy.arozos.com
GNU Affero General Public License v3.0
2.76k stars 168 forks source link

[ENHANCEMENTS] Support DNS validation for LetsEncrypt #49

Closed ndbroadbent closed 4 months ago

ndbroadbent commented 1 year ago

Related to #6

Is your feature request related to a problem? Please describe.

My server is not publicly accessible on the internet, but I still use a .com domain name to set up SSL with LetsEncrypt. I usually do this by adding DNS records to my Cloudflare. This is also the only way to set up a wildcard SSL certificate.

Describe the solution you'd like

I would like the Acme resolver to support DNS validation so that I can issue a wildcard SSL certificate for my private server.

Describe alternatives you've considered

I'm currently using NginxProxyManager, which supports this out of the box. (You can even give it your Cloudflare API token and it sets up all the DNS records for you automatically.) Zoraxy looks much more powerful so I'd like to switch to this, but can't migrate until I can use DNS validation.

johntdyer commented 1 year ago

100% want this !

drkmtr commented 1 year ago

Snap! this would we hugely welcomed feature!

ExXxtr3me commented 1 year ago

That's also the last feature i miss from NPM, i use split DNS for some dockers with cloudflare tunnels and need a lets encrypt certificate for them without disabling the proxy on cloudflare.

tobychui commented 1 year ago

Well tbh I am not expert in ACME protocol so there are nothing I can do to speed up this feature request. @yeungalan you are the only one who knows how to make it works, so it is on you now!

yeungalan commented 1 year ago

I agree that DNS Validation is a good idea however we are still trying to figure out how to include all kinds of DNS providers (due to there being no common protocols to insert DNS records for now) into Zoraxy. Thanks for your suggestions btw!

nicedevil007 commented 11 months ago

Would like to see this feature for netcup as the DNS provider 👍 take your time! Looking pretty good what you are doing here :)

evandcombs commented 11 months ago

I agree that DNS Validation is a good idea however we are still trying to figure out how to include all kinds of DNS providers (due to there being no common protocols to insert DNS records for now) into Zoraxy. Thanks for your suggestions btw!

With no standardized API there is no good solution to this problem. The best you can do is create your own standard API to streamline the integration process, then use that to create integrations for DNS providers. You then create integrations for the most common DNS providers, then create integrations for other providers on an as demanded basis.

I would say maybe make the app open to plug-ins for those integrations, but that is opening a whole other can of worms that you likely do not want to tackle at this stage.

AIEPhoenix commented 7 months ago

The scripts within this project might just be what you need. https://github.com/acmesh-official/acme.sh

themanbornwithin commented 7 months ago

+1 for this. I'd love to switch!

thytetgc commented 6 months ago

I haven't migrated from NPM to Zoraxy yet, because it lacks this feature.

cirrusflyer commented 5 months ago

Same

donslice commented 5 months ago

+1 for DNS Challenge

Teifun2 commented 5 months ago

Im currently trying to implement this. Im strongly following the nginx proxy manager ui design, and using acme lego proivders to fetch dns certificates.

I was able to get successfull working certificates. I know have to clean the implementation so that it can be extended for multiple dns providers.

Teifun2 commented 5 months ago

image image

Wildcard certificates are working. DNS Challenge aswell. Renew aswell.

Missing is the Generic implementation to actually allow for different DNS Providers.

PastaGringo commented 5 months ago

Great news 🎉 How can we test it? I'm running the latest 3.0.3 and can't find it. It seems all the different settings for all DNS providers can be found here: https://github.com/acmesh-official/acme.sh/tree/master/dnsapi

Could be great to begin with OVH & Cloudflare... :) Thanks for this implementation! A must-have 💯

Teifun2 commented 5 months ago

It is currently on my fork on a branch. I think it needs a little bit of love until it can be tested.

Integrating dns providers is actually very easy as the library itself has many configured: https://github.com/go-acme/lego/tree/master/providers/dns

However i need to find a generic way this can be handled. If this is done it should be an easy breeze :)

Teifun2 commented 5 months ago

A PR is open that should in theory support all 131 DNS providers of go-acme.

I heavily assume that some of them will not work just out of the box, but a lot of testing and feedback would be needed to figure this out!

tobychui commented 5 months ago

Feature added in v3.0.4 release.

cirrusflyer commented 5 months ago

It's not working for me at the moment - tells me it can't find the zone. But wondering if this is a split DNS issue. I have a local DNS with same name as the Cloudflare DNS. I assume it should know to access the Cloudflare DNS, but not sure.

yeungalan commented 4 months ago

Hi, do you mind running the below command and providing us with the Zoraxy log for further investigation?

dig yourdomain.com +trace
cirrusflyer commented 4 months ago

I actually did this and see that it's hitting my local DNS which obviously would cause the issue. I removed the local entry, and it's progressing correctly now, although it's getting an error "propagation: time limit exceeded". I can see the record created in my Cloudflare DNS, so not sure why it's not completing correctly. I'm using NPM on another server and it doesn't have this split DNS issue and works correctly. I'm wondering if you're able to have your software use the DNS servers of the DNS provider that's selected in the dropdown, instead of local DNS. That would resolve my split DNS issue.

cirrusflyer commented 4 months ago

Turns out you can specify the DNS servers:

https://go-acme.github.io/lego/usage/cli/options/

--dns.resolvers value [ --dns.resolvers value ] Set the resolvers to use for performing (recursive) CNAME resolving and apex domain determination. For DNS-01 challenge verification, the authoritative DNS server is queried directly. Supported: host:port. The default is to use the system resolvers, or Google's DNS resolvers if the system's cannot be determined.

cirrusflyer commented 4 months ago

This might be helpful for the timeout issue.

https://community.letsencrypt.org/t/cant-renew-with-dns-01-waiting-for-dns-record-propagation/182750/8

tobychui commented 4 months ago

@cirrusflyer I think this is another issues on its own instead of DNS validation support. I am closing this and please move the follow up discussion to a new issue and tag the ACME module author @yeungalan . Thank you!