acmednsproxy

README

acme-dns-proxy

A secure bridge between ACME clients and corporate DNS systems, enabling automated certificate management without compromising DNS access control.

What it does

acme-dns-proxy acts as a minimal DNS server that accepts RFC2136 dynamic updates for DNS-01 challenges from ACME clients and proxies them to various DNS providers through their APIs. This allows you to use certbot's dns-rfc2136 plugin with other DNS providers, without having to give direct access to the end DNS system to the users.

For further details, see the architecture document.

Primary Use Case

Your company wants to roll out ACME in internal networks, where:

• HTTP-01 challenges won't work (internal servers not reachable from the Internet)
• DNS-01 challenges therefore are required
• Direct access to corporate DNS must be restricted
• Certificate automation is needed

acme-dns-proxy solves this by:

• Providing a secure DNS proxy that only handles ACME challenge records
• Using unique TSIG keys for each certificate
• Working with the standard certbot-dns-rfc2136 plugin
• Supporting multiple DNS providers through their APIs

Documentation

Index

• type AcmeDNSProxy
  • func NewApp(config Config) (*AcmeDNSProxy, error)
  • func (a *AcmeDNSProxy) Serve() error
• type Certificate
• type Claims
• type Config
• type User

Types

type AcmeDNSProxy

type AcmeDNSProxy struct {
	// contains filtered or unexported fields
}

func NewApp

func NewApp(config Config) (*AcmeDNSProxy, error)

func (*AcmeDNSProxy) Serve

func (a *AcmeDNSProxy) Serve() error

type Certificate

type Certificate struct {
	gorm.Model
	Domains []string `gorm:"serializer:json"`

	UserID *uint
	User   *User `gorm:"foreignKey:UserID"`

	TSIGKey    string
	TSIGSecret string

	DNSProvider   string
	LastRefreshed *time.Time
}

type Claims

type Claims struct {
	Subject string `json:"sub"`
	Name    string `json:"name"`
	Email   string `json:"email"`
}

type Config

type Config struct {
	DNSListenAddress string
	WebListenAddress string
	DBPath           string

	// OpenID Connect config
	ClientID     string
	ClientSecret string
	RedirectURL  string
	Scopes       []string
	Issuer       string

	// Session config
	SessionKey []byte
	CookieName string

	CustomFrontendPath string
}

type User

type User struct {
	gorm.Model
	Name      *string
	Email     string
	LastLogin *time.Time
}