Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

option to override nameserver used in verify_record() #37

Open
erachen opened this issue Aug 4, 2022 · 0 comments
Open

option to override nameserver used in verify_record() #37

erachen opened this issue Aug 4, 2022 · 0 comments

Comments

@erachen
Copy link

erachen commented Aug 4, 2022

I use successfully dehydrated-hook-ddns-tsig with dns-01 challenge

When the server with dehydrated use a general purpose dns (/etc/resolv.conf) it works.
But, for convenience, I use a local DNS that override public IP of the service with its private IP or simply give a local name to an local (not visible on internet) service.

This allow the server with dehydrated (usually a SSL/TLS http reverse proxy) to use internal name to target local machines, it's more convenient and more meaningful in differents config files.
But if I use an local DNS, for some domain, the DNS check failed.

I think this is related to the verify_record() that use a list of nameserver computed by query_NS_record().
query_NS_record() look for NS record by querying the local resolution config i.e. /etc/resolv.conf.
As it is an internal DNS, NS record may not be consistent with what is expected by let's encrypt (I mean a public view of NS).

So far, I use an external general purpose DNS to solve the problem. It work but I do not have local DNS name anymore.

So I would like to add an optionnal parameter, let say name_server_ip_resolver that, if empty or not specified does not change the behaviour of dehydrated-hook-ddns-tsig.py, but if specified, this IP will be used in query_NS_record().

So that, my general system use local DNS defined in /etc/resolv.conf and if needed, dehydrated-hook-ddns-tsig.py use a different dns for verifying DNS records.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant