\n ![\"lego](\"./docs/static/images/lego-logo.min.svg\")
\n
\n\n# Lego\n\n[ACME](https://www.rfc-editor.org/rfc/rfc8555.html) client and library for Let's Encrypt and other ACME CAs written in Go.\n\n[](https://pkg.go.dev/github.com/go-acme/lego/v4)\n[](https://github.com//go-acme/lego/actions)\n[](https://hub.docker.com/r/goacme/lego/)\n\nlego is an independent, free, and open-source project, if you value it, consider [supporting it](https://donate.ldez.dev)! ❤️\n\nEverybody thinks that the others will donate, but in the end, nobody does.\n\nSo if you think that lego is worth it, please consider [donating](https://donate.ldez.dev).\n\n## Features\n\n- ACME v2 [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555.html)\n - Support [RFC 8737](https://www.rfc-editor.org/rfc/rfc8737.html): TLS Application‑Layer Protocol Negotiation (ALPN) Challenge Extension\n - Support [RFC 8738](https://www.rfc-editor.org/rfc/rfc8738.html): certificates for IP addresses\n - Support [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773.html): Renewal Information (ARI) Extension\n - Support [draft-ietf-acme-profiles-00](https://datatracker.ietf.org/doc/draft-ietf-acme-profiles/): Profiles Extension\n- Comes with about [180 DNS providers](https://go-acme.github.io/lego/dns)\n- Register with CA\n- Obtain certificates, both from scratch or with an existing CSR\n- Renew certificates\n- Revoke certificates\n- Robust implementation of ACME challenges:\n - HTTP (http-01)\n - DNS (dns-01)\n - TLS (tls-alpn-01)\n- SAN certificate support\n- [CNAME support](https://letsencrypt.org/2019/10/09/onboarding-your-customers-with-lets-encrypt-and-acme.html) by default\n- [Custom challenge solvers](https://go-acme.github.io/lego/usage/library/writing-a-challenge-solver/)\n- Certificate bundling\n- OCSP helper function\n\n## Installation\n\nHow to [install](https://go-acme.github.io/lego/installation/).\n\n## Usage\n\n- as a [CLI](https://go-acme.github.io/lego/usage/cli)\n- as a [library](https://go-acme.github.io/lego/usage/library)\n\n## Documentation\n\nDocumentation is hosted live at https://go-acme.github.io/lego/.\n\n## DNS providers\n\nDetailed documentation is available [here](https://go-acme.github.io/lego/dns).\n\nIf your DNS provider is not supported, please open an [issue](https://github.com/go-acme/lego/issues/new?assignees=&labels=enhancement%2C+new-provider&template=new_dns_provider.yml).\n\n\n\n\n Automatic Certificates and HTTPS for everyone.
\n![\"lego](\"/lego/images/lego-logo-white.min.svg\"){kind=logo}
\n"
},
{
"path": "docs/layouts/shortcodes/clihelp.html",
"content": "{{ $tabs := slice }}\n\n{{ $commands := index $.Site.Data.zz_cli_help \"command\" }}\n{{ range $idx, $tab := $commands }}\n {{ $content := (print \"```\\n\" $tab.content \"\\n```\") }}\n {{ $tabs = $tabs | append (dict \"title\" $tab.title \"content\" ($content | page.RenderString) \"icon\" \"terminal\") }}\n{{ end }}\n\n{{ partial \"shortcodes/tabs.html\" (dict\n \"page\" page\n \"content\" $tabs\n) }}\n"
},
{
"path": "docs/layouts/shortcodes/tableofdnsproviders.html",
"content": "{{ $_hugo_config := `{ \"version\": 1 }` }}\n\n| Provider name | \nCLI flag name | \nRequired lego version | \n|
|---|---|---|---|
| \n {{ .Title }}\n | \n\n {{- if $params.url -}}\n Website\n {{- end -}}\n | \n\n {{ $params.code }}\n | \n {{ $params.since }} | \n
| {{if .Code }}{{ .Name }}{{end}} | \n {{- end }}\n
Error Occurred While Processing Request :
\n\n - badysys : Der System Parameter ist ungültig.\n\n" }, { "path": "providers/dns/ddnss/internal/fixtures/success.html", "content": "\n \n
\n - badauth : Die Authorisation ist fehlgeschlagen. Die Parameter username und/oder password sind falsch.
\n - notfqdn : Hostname fehlt oder ist falsch.
Updated 1 hostname.
\n\n" }, { "path": "providers/dns/ddnss/internal/types.go", "content": "package internal\n\nimport (\n\t\"errors\"\n\t\"net/url\"\n)\n\ntype Authentication struct {\n\tUsername string `url:\"user,omitempty\"`\n\tPassword string `url:\"pwd,omitempty\"`\n\tKey string `url:\"key,omitempty\"`\n}\n\nfunc (a *Authentication) validate() error {\n\tif a.Username == \"\" && a.Password == \"\" && a.Key == \"\" {\n\t\treturn errors.New(\"missing credentials\")\n\t}\n\n\tif a.Username != \"\" && a.Password != \"\" && a.Key != \"\" {\n\t\treturn errors.New(\"only one of username, password or key can be set\")\n\t}\n\n\tif (a.Username != \"\" && a.Password == \"\") || a.Username == \"\" && a.Password != \"\" {\n\t\treturn errors.New(\"username and password must be set together\")\n\t}\n\n\treturn nil\n}\n\nfunc (a *Authentication) set(query url.Values) {\n\tif a.Key != \"\" {\n\t\tquery.Set(\"key\", a.Key)\n\n\t\treturn\n\t}\n\n\tquery.Set(\"user\", a.Username)\n\tquery.Set(\"pwd\", a.Password)\n}\n" }, { "path": "providers/dns/derak/derak.go", "content": "// Package derak implements a DNS provider for solving the DNS-01 challenge using Derak Cloud.\npackage derak\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge\"\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/go-acme/lego/v4/providers/dns/derak/internal\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug\"\n\t\"github.com/miekg/dns\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DERAK_\"\n\n\tEnvAPIKey = envNamespace + \"API_KEY\"\n\tEnvWebsiteID = envNamespace + \"WEBSITE_ID\"\n\n\tEnvTTL = envNamespace + \"TTL\"\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\tEnvHTTPTimeout = envNamespace + \"HTTP_TIMEOUT\"\n)\n\nvar _ challenge.ProviderTimeout = (*DNSProvider)(nil)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tAPIKey string\n\tWebsiteID string\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tTTL int\n\tHTTPClient *http.Client\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tTTL: env.GetOrDefaultInt(EnvTTL, dns01.DefaultTTL),\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 2*time.Minute),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 5*time.Second),\n\t\tHTTPClient: &http.Client{\n\t\t\tTimeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),\n\t\t},\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tconfig *Config\n\tclient *internal.Client\n\n\trecordIDs map[string]string\n\trecordIDsMu sync.Mutex\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for Derak Cloud.\n// Credentials must be passed in the environment variable: DERAK_API_KEY.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tvalues, err := env.Get(EnvAPIKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"derak: %w\", err)\n\t}\n\n\tconfig := NewDefaultConfig()\n\tconfig.APIKey = values[EnvAPIKey]\n\tconfig.WebsiteID = env.GetOrDefaultString(EnvWebsiteID, \"\")\n\n\treturn NewDNSProviderConfig(config)\n}\n\n// NewDNSProviderConfig return a DNSProvider instance configured for Derak Cloud.\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"derak: the configuration of the DNS provider is nil\")\n\t}\n\n\tif config.APIKey == \"\" {\n\t\treturn nil, errors.New(\"derak: missing credentials\")\n\t}\n\n\tclient := internal.NewClient(config.APIKey)\n\n\tif config.HTTPClient != nil {\n\t\tclient.HTTPClient = config.HTTPClient\n\t}\n\n\tclient.HTTPClient = clientdebug.Wrap(client.HTTPClient)\n\n\treturn &DNSProvider{\n\t\tconfig: config,\n\t\tclient: client,\n\t\trecordIDs: make(map[string]string),\n\t}, nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\n// Present creates a TXT record using the specified parameters.\nfunc (d *DNSProvider) Present(domain, token, keyAuth string) error {\n\tctx := context.Background()\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"derak: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\trecordName, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"derak: %w\", err)\n\t}\n\n\tzoneID, err := d.getZoneID(ctx, info)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"derak: get zone ID: %w\", err)\n\t}\n\n\tr := internal.Record{\n\t\tType: \"TXT\",\n\t\tHost: recordName,\n\t\tContent: info.Value,\n\t\tTTL: d.config.TTL,\n\t}\n\n\trecord, err := d.client.CreateRecord(ctx, zoneID, r)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"derak: create record: %w\", err)\n\t}\n\n\td.recordIDsMu.Lock()\n\td.recordIDs[token] = record.ID\n\td.recordIDsMu.Unlock()\n\n\treturn nil\n}\n\n// CleanUp removes the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {\n\tctx := context.Background()\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tzoneID, err := d.getZoneID(ctx, info)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"derak: get zone ID: %w\", err)\n\t}\n\n\t// gets the record's unique ID\n\td.recordIDsMu.Lock()\n\trecordID, ok := d.recordIDs[token]\n\td.recordIDsMu.Unlock()\n\n\tif !ok {\n\t\treturn fmt.Errorf(\"derak: unknown record ID for '%s' '%s'\", info.EffectiveFQDN, token)\n\t}\n\n\terr = d.client.DeleteRecord(ctx, zoneID, recordID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"derak: delete record: %w\", err)\n\t}\n\n\t// deletes record ID from map\n\td.recordIDsMu.Lock()\n\tdelete(d.recordIDs, token)\n\td.recordIDsMu.Unlock()\n\n\treturn nil\n}\n\nfunc (d *DNSProvider) getZoneID(ctx context.Context, info dns01.ChallengeInfo) (string, error) {\n\tzoneID := d.config.WebsiteID\n\tif zoneID != \"\" {\n\t\treturn zoneID, nil\n\t}\n\n\tzones, err := d.client.GetZones(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"get zones: %w\", err)\n\t}\n\n\tfor _, zone := range zones {\n\t\tif strings.HasSuffix(info.EffectiveFQDN, dns.Fqdn(zone.HumanReadable)) {\n\t\t\treturn zone.ID, nil\n\t\t}\n\t}\n\n\treturn \"\", fmt.Errorf(\"zone/website not found %s\", info.EffectiveFQDN)\n}\n" }, { "path": "providers/dns/derak/derak.toml", "content": "Name = \"Derak Cloud\"\nDescription = ''''''\nURL = \"https://derak.cloud/\"\nCode = \"derak\"\nSince = \"v4.12.0\"\n\nExample = '''\nDERAK_API_KEY=\"xxxxxxxxxxxxxxxxxxxxx\" \\\nlego --dns derak -d '*.example.com' -d example.com run\n'''\n\n[Configuration]\n [Configuration.Credentials]\n DERAK_API_KEY = \"The API key\"\n [Configuration.Additional]\n DERAK_WEBSITE_ID = \"Force the zone/website ID\"\n DERAK_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 5)\"\n DERAK_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 120)\"\n DERAK_TTL = \"The TTL of the TXT record used for the DNS challenge in seconds (Default: 120)\"\n DERAK_HTTP_TIMEOUT = \"API request timeout in seconds (Default: 30)\"\n" }, { "path": "providers/dns/derak/derak_test.go", "content": "package derak\n\nimport (\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nconst envDomain = envNamespace + \"DOMAIN\"\n\nvar envTest = tester.NewEnvTest(EnvAPIKey, EnvWebsiteID).WithDomain(envDomain)\n\nfunc TestNewDNSProvider(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAPIKey: \"key\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing API key\",\n\t\t\tenvVars: map[string]string{},\n\t\t\texpected: \"derak: some credentials information are missing: DERAK_API_KEY\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t\trequire.NotNil(t, p.client)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tapiKey string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tapiKey: \"key\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing API key\",\n\t\t\texpected: \"derak: missing credentials\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.APIKey = test.apiKey\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t\trequire.NotNil(t, p.client)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestLivePresent(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.Present(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestLiveCleanUp(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.CleanUp(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/derak/internal/client.go", "content": "package internal\n\nimport (\n\t\"bytes\"\n\t\"context\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/errutils\"\n\tquerystring \"github.com/google/go-querystring/query\"\n)\n\nconst defaultBaseURL = \"https://api.derak.cloud/v1.0\"\n\ntype Client struct {\n\tbaseURL *url.URL\n\tHTTPClient *http.Client\n\tzoneEndpoint string\n\n\tapiKey string\n}\n\nfunc NewClient(apiKey string) *Client {\n\tbaseURL, _ := url.Parse(defaultBaseURL)\n\n\treturn &Client{\n\t\tHTTPClient: &http.Client{Timeout: 10 * time.Second},\n\t\tbaseURL: baseURL,\n\t\tzoneEndpoint: \"https://api.derak.cloud/api/v2/service/cdn/zones\",\n\t\tapiKey: apiKey,\n\t}\n}\n\n// GetRecords gets all records.\n// Note: the response is not influenced by the query parameters, so the documentation seems wrong.\nfunc (c *Client) GetRecords(ctx context.Context, zoneID string, params *GetRecordsParameters) (*GetRecordsResponse, error) {\n\tendpoint := c.baseURL.JoinPath(\"zones\", zoneID, \"dnsrecords\")\n\n\tv, err := querystring.Values(params)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tendpoint.RawQuery = v.Encode()\n\n\treq, err := newJSONRequest(ctx, http.MethodGet, endpoint, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tresponse := &GetRecordsResponse{}\n\n\terr = c.do(req, response)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn response, nil\n}\n\n// GetRecord gets a record by ID.\nfunc (c *Client) GetRecord(ctx context.Context, zoneID, recordID string) (*Record, error) {\n\tendpoint := c.baseURL.JoinPath(\"zones\", zoneID, \"dnsrecords\", recordID)\n\n\treq, err := newJSONRequest(ctx, http.MethodGet, endpoint, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tresponse := &Record{}\n\n\terr = c.do(req, response)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn response, nil\n}\n\n// CreateRecord creates a new record.\nfunc (c *Client) CreateRecord(ctx context.Context, zoneID string, record Record) (*Record, error) {\n\tendpoint := c.baseURL.JoinPath(\"zones\", zoneID, \"dnsrecords\")\n\n\treq, err := newJSONRequest(ctx, http.MethodPut, endpoint, record)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tresponse := &Record{}\n\n\terr = c.do(req, response)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn response, nil\n}\n\n// EditRecord edits an existing record.\nfunc (c *Client) EditRecord(ctx context.Context, zoneID, recordID string, record Record) (*Record, error) {\n\tendpoint := c.baseURL.JoinPath(\"zones\", zoneID, \"dnsrecords\", recordID)\n\n\treq, err := newJSONRequest(ctx, http.MethodPatch, endpoint, record)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tresponse := &Record{}\n\n\terr = c.do(req, response)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn response, nil\n}\n\n// DeleteRecord deletes an existing record.\nfunc (c *Client) DeleteRecord(ctx context.Context, zoneID, recordID string) error {\n\tendpoint := c.baseURL.JoinPath(\"zones\", zoneID, \"dnsrecords\", recordID)\n\n\treq, err := newJSONRequest(ctx, http.MethodDelete, endpoint, nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tresponse := &APIResponse[any]{}\n\n\terr = c.do(req, response)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif !response.Success {\n\t\treturn fmt.Errorf(\"API error: %d %s\", response.Error, codeText(response.Error))\n\t}\n\n\treturn nil\n}\n\n// GetZones gets zones.\n// Note: it's not a part of the official API, there is no documentation about this.\n// The endpoint comes from UI calls analysis.\nfunc (c *Client) GetZones(ctx context.Context) ([]Zone, error) {\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, c.zoneEndpoint, http.NoBody)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tresponse := &APIResponse[[]Zone]{}\n\n\terr = c.do(req, response)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif !response.Success {\n\t\treturn nil, fmt.Errorf(\"API error: %d %s\", response.Error, codeText(response.Error))\n\t}\n\n\treturn response.Result, nil\n}\n\nfunc (c *Client) do(req *http.Request, result any) error {\n\treq.SetBasicAuth(\"api\", c.apiKey)\n\n\tresp, err := c.HTTPClient.Do(req)\n\tif err != nil {\n\t\treturn errutils.NewHTTPDoError(req, err)\n\t}\n\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tswitch req.Method {\n\tcase http.MethodPut:\n\t\tif resp.StatusCode != http.StatusCreated {\n\t\t\treturn parseError(req, resp)\n\t\t}\n\tdefault:\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn parseError(req, resp)\n\t\t}\n\t}\n\n\traw, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn errutils.NewReadResponseError(req, resp.StatusCode, err)\n\t}\n\n\terr = json.Unmarshal(raw, result)\n\tif err != nil {\n\t\treturn errutils.NewUnmarshalError(req, resp.StatusCode, raw, err)\n\t}\n\n\treturn nil\n}\n\nfunc newJSONRequest(ctx context.Context, method string, endpoint *url.URL, payload any) (*http.Request, error) {\n\tbuf := new(bytes.Buffer)\n\n\tif payload != nil {\n\t\terr := json.NewEncoder(buf).Encode(payload)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create request JSON body: %w\", err)\n\t\t}\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, method, endpoint.String(), buf)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create request: %w\", err)\n\t}\n\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\tif payload != nil {\n\t\treq.Header.Set(\"Content-Type\", \"application/json\")\n\t}\n\n\treturn req, nil\n}\n\nfunc parseError(req *http.Request, resp *http.Response) error {\n\traw, _ := io.ReadAll(resp.Body)\n\n\tvar response APIResponse[any]\n\n\terr := json.Unmarshal(raw, &response)\n\tif err != nil {\n\t\treturn errutils.NewUnexpectedStatusCodeError(req, resp.StatusCode, raw)\n\t}\n\n\treturn fmt.Errorf(\"[status code %d] %d: %s\", resp.StatusCode, response.Error, codeText(response.Error))\n}\n" }, { "path": "providers/dns/derak/internal/client_test.go", "content": "package internal\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"net/url\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc setupClient(server *httptest.Server) (*Client, error) {\n\tclient := NewClient(\"secret\")\n\tclient.baseURL, _ = url.Parse(server.URL)\n\tclient.zoneEndpoint = server.URL\n\tclient.HTTPClient = server.Client()\n\n\treturn client, nil\n}\n\nfunc mockBuilder() *servermock.Builder[*Client] {\n\treturn servermock.NewBuilder[*Client](setupClient,\n\t\tservermock.CheckHeader().WithJSONHeaders().\n\t\t\tWithBasicAuth(\"api\", \"secret\"))\n}\n\nfunc TestGetRecords(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"GET /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords\",\n\t\t\tservermock.ResponseFromFixture(\"records-GET.json\")).\n\t\tBuild(t)\n\n\trecords, err := client.GetRecords(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", &GetRecordsParameters{DNSType: \"TXT\", Content: `\"test\"'`})\n\trequire.NoError(t, err)\n\n\texcepted := &GetRecordsResponse{Data: []Record{\n\t\t{\n\t\t\tType: \"A\",\n\t\t\tHost: \"example.com\",\n\t\t\tContent: \"188.114.97.3\",\n\t\t\tID: \"812bee17a0b440b0bd5ee099a78b839c\",\n\t\t},\n\t\t{\n\t\t\tType: \"A\",\n\t\t\tHost: \"example.com\",\n\t\t\tContent: \"188.114.96.3\",\n\t\t\tID: \"90e6029da45d4a36bf31056cf85d0cab\",\n\t\t},\n\t\t{\n\t\t\tType: \"AAAA\",\n\t\t\tHost: \"example.com\",\n\t\t\tContent: \"2a06:98c1:3121::7\",\n\t\t\tID: \"0ac0320da0d24b5ca4f1648986a17340\",\n\t\t},\n\t\t{\n\t\t\tType: \"AAAA\",\n\t\t\tHost: \"example.com\",\n\t\t\tContent: \"2a06:98c1:3120::7\",\n\t\t\tID: \"c91599694aea413498a0b3cd0a54a585\",\n\t\t},\n\t\t{\n\t\t\tType: \"A\",\n\t\t\tHost: \"www\",\n\t\t\tContent: \"188.114.96.7\",\n\t\t\tID: \"c21f974992d549499f92e768bc468374\",\n\t\t},\n\t\t{\n\t\t\tType: \"A\",\n\t\t\tHost: \"www\",\n\t\t\tContent: \"188.114.97.7\",\n\t\t\tID: \"90c3c1f05dca426893f10f122d18ad7a\",\n\t\t},\n\t\t{\n\t\t\tType: \"AAAA\",\n\t\t\tHost: \"www\",\n\t\t\tContent: \"2a06:98c1:3121::\",\n\t\t\tID: \"379ab0ac0e434bc9aee5287e497f88a5\",\n\t\t},\n\t\t{\n\t\t\tType: \"AAAA\",\n\t\t\tHost: \"www\",\n\t\t\tContent: \"2a06:98c1:3120::\",\n\t\t\tID: \"a1c4f9e50ba74791a4d70dc96999474c\",\n\t\t},\n\t}, Count: 8}\n\n\tassert.Equal(t, excepted, records)\n}\n\nfunc TestGetRecords_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"GET /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusUnauthorized)).\n\t\tBuild(t)\n\n\t_, err := client.GetRecords(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", &GetRecordsParameters{DNSType: \"TXT\", Content: `\"test\"'`})\n\trequire.Error(t, err)\n}\n\nfunc TestGetRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"GET /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/812bee17a0b440b0bd5ee099a78b839c\",\n\t\t\tservermock.ResponseFromFixture(\"record-GET.json\")).\n\t\tBuild(t)\n\n\trecord, err := client.GetRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", \"812bee17a0b440b0bd5ee099a78b839c\")\n\trequire.NoError(t, err)\n\n\texcepted := &Record{\n\t\tType: \"A\",\n\t\tHost: \"example.com\",\n\t\tContent: \"188.114.97.3\",\n\t\tID: \"812bee17a0b440b0bd5ee099a78b839c\",\n\t}\n\n\tassert.Equal(t, excepted, record)\n}\n\nfunc TestGetRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"GET /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusUnauthorized)).\n\t\tBuild(t)\n\n\t_, err := client.GetRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", \"812bee17a0b440b0bd5ee099a78b839c\")\n\trequire.Error(t, err)\n}\n\nfunc TestCreateRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"PUT /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords\",\n\t\t\tservermock.ResponseFromFixture(\"record-PUT.json\").\n\t\t\t\tWithStatusCode(http.StatusCreated)).\n\t\tBuild(t)\n\n\tr := Record{\n\t\tType: \"TXT\",\n\t\tHost: \"test\",\n\t\tContent: \"test\",\n\t\tTTL: 120,\n\t}\n\n\trecord, err := client.CreateRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", r)\n\trequire.NoError(t, err)\n\n\texcepted := &Record{\n\t\tType: \"A\",\n\t\tHost: \"example.com\",\n\t\tContent: \"188.114.97.3\",\n\t\tID: \"812bee17a0b440b0bd5ee099a78b839c\",\n\t}\n\n\tassert.Equal(t, excepted, record)\n}\n\nfunc TestCreateRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"PUT /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusUnauthorized)).\n\t\tBuild(t)\n\n\tr := Record{\n\t\tType: \"TXT\",\n\t\tHost: \"test\",\n\t\tContent: \"test\",\n\t\tTTL: 120,\n\t}\n\n\t_, err := client.CreateRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", r)\n\trequire.Error(t, err)\n}\n\nfunc TestEditRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"PATCH /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/eebc813de2f94d67b09d91e10e2d65c2\",\n\t\t\tservermock.ResponseFromFixture(\"record-PATCH.json\")).\n\t\tBuild(t)\n\n\trecord, err := client.EditRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", \"eebc813de2f94d67b09d91e10e2d65c2\", Record{\n\t\tContent: \"foo\",\n\t})\n\trequire.NoError(t, err)\n\n\texcepted := &Record{\n\t\tType: \"A\",\n\t\tHost: \"example.com\",\n\t\tContent: \"188.114.97.3\",\n\t\tID: \"812bee17a0b440b0bd5ee099a78b839c\",\n\t}\n\n\tassert.Equal(t, excepted, record)\n}\n\nfunc TestEditRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"PATCH /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/eebc813de2f94d67b09d91e10e2d65c2\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusUnauthorized)).\n\t\tBuild(t)\n\n\t_, err := client.EditRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", \"eebc813de2f94d67b09d91e10e2d65c2\", Record{\n\t\tContent: \"foo\",\n\t})\n\trequire.Error(t, err)\n}\n\nfunc TestDeleteRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"DELETE /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/653464211b7447a1bee6b8fcb9fb86df\",\n\t\t\tservermock.ResponseFromFixture(\"record-DELETE.json\")).\n\t\tBuild(t)\n\n\terr := client.DeleteRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", \"653464211b7447a1bee6b8fcb9fb86df\")\n\trequire.NoError(t, err)\n}\n\nfunc TestDeleteRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"DELETE /zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/653464211b7447a1bee6b8fcb9fb86df\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusUnauthorized)).\n\t\tBuild(t)\n\n\terr := client.DeleteRecord(t.Context(), \"47c0ecf6c91243308c649ad1d2d618dd\", \"653464211b7447a1bee6b8fcb9fb86df\")\n\trequire.Error(t, err)\n}\n\nfunc TestGetZones(t *testing.T) {\n\tclient := servermock.NewBuilder[*Client](setupClient,\n\t\tservermock.CheckHeader().\n\t\t\tWithBasicAuth(\"api\", \"secret\"),\n\t).\n\t\tRoute(\"GET /\", servermock.ResponseFromFixture(\"service-cdn-zones.json\")).\n\t\tBuild(t)\n\n\tzones, err := client.GetZones(t.Context())\n\trequire.NoError(t, err)\n\n\texcepted := []Zone{{\n\t\tID: \"47c0ecf6c91243308c649ad1d2d618dd\",\n\t\tTags: []string{},\n\t\tContextID: \"47c0ecf6c91243308c649ad1d2d618dd\",\n\t\tContextType: \"CDN\",\n\t\tHumanReadable: \"example.com\",\n\t\tSerial: \"2301449956\",\n\t\tCreationTime: 1679090659902,\n\t\tCreationTimeDate: time.Date(2023, time.March, 17, 22, 4, 19, 902000000, time.UTC),\n\t\tStatus: \"active\",\n\t\tIsMoved: true,\n\t\tPaused: false,\n\t\tServiceType: \"CDN\",\n\t\tLimbo: false,\n\t\tTeamName: \"test\",\n\t\tTeamID: \"640ef58496738d38fa7246a4\",\n\t\tMyTeam: true,\n\t\tRoleName: \"owner\",\n\t\tIsBoard: true,\n\t\tBoardRole: []string{\"owner\"},\n\t}}\n\n\tassert.Equal(t, excepted, zones)\n}\n\nfunc TestGetZones_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"GET /\", servermock.ResponseFromFixture(\"error.json\").\n\t\t\tWithStatusCode(http.StatusUnauthorized)).\n\t\tBuild(t)\n\n\t_, err := client.GetZones(t.Context())\n\trequire.Error(t, err)\n}\n" }, { "path": "providers/dns/derak/internal/fixtures/error.json", "content": "{\"success\":false,\"error\":1010}\n" }, { "path": "providers/dns/derak/internal/fixtures/record-DELETE.json", "content": "{\n \"success\": true\n}\n" }, { "path": "providers/dns/derak/internal/fixtures/record-GET.json", "content": "{\n \"recordId\": \"812bee17a0b440b0bd5ee099a78b839c\",\n \"type\": \"A\",\n \"host\": \"example.com\",\n \"content\": \"188.114.97.3\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n}\n" }, { "path": "providers/dns/derak/internal/fixtures/record-PATCH.json", "content": "{\n \"recordId\": \"812bee17a0b440b0bd5ee099a78b839c\",\n \"type\": \"A\",\n \"host\": \"example.com\",\n \"content\": \"188.114.97.3\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n}\n" }, { "path": "providers/dns/derak/internal/fixtures/record-PUT.json", "content": "{\n \"recordId\": \"812bee17a0b440b0bd5ee099a78b839c\",\n \"type\": \"A\",\n \"host\": \"example.com\",\n \"content\": \"188.114.97.3\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n}\n" }, { "path": "providers/dns/derak/internal/fixtures/records-GET.json", "content": "{\n \"data\": [\n {\n \"recordId\": \"812bee17a0b440b0bd5ee099a78b839c\",\n \"type\": \"A\",\n \"host\": \"example.com\",\n \"content\": \"188.114.97.3\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"90e6029da45d4a36bf31056cf85d0cab\",\n \"type\": \"A\",\n \"host\": \"example.com\",\n \"content\": \"188.114.96.3\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"0ac0320da0d24b5ca4f1648986a17340\",\n \"type\": \"AAAA\",\n \"host\": \"example.com\",\n \"content\": \"2a06:98c1:3121::7\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"c91599694aea413498a0b3cd0a54a585\",\n \"type\": \"AAAA\",\n \"host\": \"example.com\",\n \"content\": \"2a06:98c1:3120::7\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"c21f974992d549499f92e768bc468374\",\n \"type\": \"A\",\n \"host\": \"www\",\n \"content\": \"188.114.96.7\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"90c3c1f05dca426893f10f122d18ad7a\",\n \"type\": \"A\",\n \"host\": \"www\",\n \"content\": \"188.114.97.7\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"379ab0ac0e434bc9aee5287e497f88a5\",\n \"type\": \"AAAA\",\n \"host\": \"www\",\n \"content\": \"2a06:98c1:3121::\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n },\n {\n \"recordId\": \"a1c4f9e50ba74791a4d70dc96999474c\",\n \"type\": \"AAAA\",\n \"host\": \"www\",\n \"content\": \"2a06:98c1:3120::\",\n \"ttl\": 0,\n \"cloud\": false,\n \"advanced\": false,\n \"customSSLType\": \"\"\n }\n ],\n \"count\": 8\n}\n" }, { "path": "providers/dns/derak/internal/fixtures/service-cdn-zones.json", "content": "{\n \"success\": true,\n \"result\": [\n {\n \"zoneId\": \"47c0ecf6c91243308c649ad1d2d618dd\",\n \"tags\": [],\n \"contextId\": \"47c0ecf6c91243308c649ad1d2d618dd\",\n \"contextType\": \"CDN\",\n \"humanReadable\": \"example.com\",\n \"serial\": \"2301449956\",\n \"creationTime\": 1679090659902,\n \"creationTimeDate\": \"2023-03-17T22:04:19.902Z\",\n \"status\": \"active\",\n \"is_moved\": true,\n \"paused\": false,\n \"cache\": {\n \"developmentMode\": false\n },\n \"securityOptions\": {\n \"level\": \"off\"\n },\n \"ssl\": {\n \"active\": true\n },\n \"dns\": {\n \"length\": 8\n },\n \"serviceType\": \"CDN\",\n \"limbo\": false,\n \"teamName\": \"test\",\n \"teamId\": \"640ef58496738d38fa7246a4\",\n \"myTeam\": true,\n \"roleName\": \"owner\",\n \"isBoard\": true,\n \"boardRole\": [\n \"owner\"\n ]\n }\n ]\n}\n" }, { "path": "providers/dns/derak/internal/readme.md", "content": "# Notes\n\n## Forum\n\n- https://derak.cloud/faq/programming/%da%86%da%af%d9%88%d9%86%d9%87-%d9%85%db%8c%d8%aa%d9%88%d8%a7%d9%86-%d8%a8%d9%87-api%d9%87%d8%a7-%d8%af%d8%b3%d8%aa%d8%b1%d8%b3%db%8c-%d8%af%d8%a7%d8%b4%d8%aa%d8%9f/\n- https://derak.cloud/faq/programming/%d8%af%d8%b1%db%8c%d8%a7%d9%81%d8%aa-%da%a9%d9%84%db%8c%d8%af-api-api-key/\n\n---\n\n## DNS records (API)\n\n### GET: Get a list of all DNS records\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords`\n\n#### Query\n\n| The name of the parameter | Description |\n|---------------------------|----------------------------------|\n| dnsType | dnsType query |\n| content | The Host value of the DNS record |\n\n#### Errors\n\n| type error | Error code |\n|-------------------|------------|\n| ForbiddenError | 1003 |\n| RateLimitExceeded | 1013 |\n\n\n#### Example\n\n```bash\ncurl -X GET --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords\n```\n```bash\ncurl -X GET --user \"api:api-MbmnxdpIBvk14nk5LFFdG1CV9PdMDfqi3tZAixBZLXYzM3qc187d7ede2de\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords \\\n-F dnsType=\"TXT\" \n```\n\n\n### PUT: Creating a new DNS record on the desired website\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords`\n\n#### parameters\n\n| The name of the parameter | Description |\n|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| *type | DNS record type [of types Aand AAAAand CNAMEand MXand NSand CAAand TXTand SPFand PTRand SRV] |\n| *host | The Host value of the DNS record |\n| *content | The Host value of the DNS record |\n| ttl | TTL of DNS record [default: 0] |\n| cloud | This parameter specifies whether the traffic of this record passes through the cloud or not [Default: false] |\n| priority | Priority of MX and SRV records [Default: 0] |\n| service | SRV record service |\n| protocol | SRV record protocol [default: _tcp] |\n| weight | SRV Record Weight [Default: 0] |\n| port | Priority of MX and SRV records [Default: 0] |\n| advanced | This parameter specifies whether this record has advanced settings or not [default: false] |\n| upstreamPort | Upstream Port of DNS record [Default: 80] |\n| upstreamProtocol | Upstream protocol related to DNS records. Note that if you change these settings for another record of the same subdomain, the settings will be overwritten. [Default: http] |\n| customSSLType | Custom SSL related DNS record. Note that if you change these settings for another record of the same subdomain, the settings will be overwritten. |\n\n#### Errors\n\n| type error | Error code |\n|--------------------|------------|\n| ForbiddenError | 1003 |\n| RateLimitExceeded | 1013 |\n| DNSValidationError | 1008 |\n\n#### Example\n\n```bash\ncurl -X PUT --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords \\\n-F type=\"A\" \\\n-F host=\"app\" \\\n-F content=\"1.2.3.4\"\n```\n\n### GET: Get the information of a single DNS record\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/:recordId`\n\n#### Errors\n\n| type error | Error code |\n|---------------------|------------|\n| ForbiddenError | 1003 |\n| RateLimitExceeded | 1013 |\n| RecordNotFoundError | 1021 |\n\n#### Example\n\n```bash\ncurl -X GET --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/:recordId\n```\n\n### PATCH: Edit the parameters of a DNS record\n\n`https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/:recordId`\n\n#### parameters\n\n| The name of the parameter | Description |\n|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| type | DNS record type [of types Aand AAAAand CNAMEand MXand NSand CAAand TXTand SPFand PTRand SRV] |\n| host | The Host value of the DNS record |\n| content | The Host value of the DNS record |\n| ttl | TTL of DNS record [default: 0] |\n| cloud | This parameter specifies whether the traffic of this record passes through the cloud or not [Default: false] |\n| priority | Priority of MX and SRV records [Default: 0] |\n| service | SRV record service |\n| protocol | SRV record protocol [default: _tcp] |\n| weight | SRV Record Weight [Default: 0] |\n| port | Priority of MX and SRV records [Default: 0] |\n| advanced | This parameter specifies whether this record has advanced settings or not [default: false] |\n| upstreamPort | Upstream Port of DNS record [Default: 80] |\n| upstreamProtocol | Upstream protocol related to DNS records. Note that if you change these settings for another record of the same subdomain, the settings will be overwritten. [Default: http] |\n| customSSLType | Custom SSL related DNS record. Note that if you change these settings for another record of the same subdomain, the settings will be overwritten. |\n\n#### Errors\n\n| type error | Error code |\n|---------------------|------------|\n| ForbiddenError | 1003 |\n| RateLimitExceeded | 1013 |\n| RecordNotFoundError | 1021 |\n| DNSValidationError | 1008 |\n\n#### Example\n\n```bash\ncurl -X PATCH --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/:recordId \\\n-F cloud=\"true\"\n```\n\n### DELETE: Delete a DNS record\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/:recordId`\n\n#### Errors\n\n| type error | Error code |\n|---------------------|------------|\n| ForbiddenError | 1003 |\n| RateLimitExceeded | 1013 |\n| RecordNotFoundError | 1021 |\n\n#### Example\n\n```bash\ncurl -X DELETE --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/dnsrecords/:recordId\n```\n\n---\n\n## Cache clearing (API)\n\n### POST: Clearing (Purge Cache) specified parameters, if no parameter is specified, the entire cache is deleted.\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/cache/purge`\n\n#### parameters\n\n| The name of the parameter | Description |\n|---------------------------|-------------------------------------|\n| hostname | The hostname to be deleted |\n| hostnames | An array of hostnames to be cleared |\n| url | The URL to be deleted |\n| urls | An array of URLs to be purged |\n\n#### Errors\n\n| type error | Error code |\n|-------------------|------------|\n| ForbiddenError | 1003 |\n| RateLimitExceeded | 1013 |\n\n#### Examples\n\nPurge URLS:\n\n```bash\ncurl -X POST --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/cache/purge \\\n-F urls[]=\"https://www.derak.cloud/post/1\" \\\n-F urls[]=\"https://www.derak.cloud/post/2\"\n```\n\nPurge HOSTNAMES:\n\n```bash\ncurl -X POST --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/cache/purge \\\n-F hostnames[]=\"www.derak.cloud\" \\\n-F hostnames[]=\"app.derak.cloud\"\n```\n\nPurge EVERYTHING:\n\n```bash\ncurl -X POST --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/cache/purge\n```\n\n---\n\n## API for SSL certificates\n\n### PUT: Enable SSL for a domain\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/ssl/`\n\n#### Errors\n\n| type error | Error code |\n|----------------|------------|\n| ForbiddenError | 1003 |\n\n#### Example\n\n```bash\ncurl -X PUT --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/ssl/\n```\n\n### DELETE: Disable SSL for a domain\n\nex: `https://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/ssl/`\n\n#### Errors\n\n| type error | Error code |\n|----------------|------------|\n| ForbiddenError | 1003 |\n\n#### Example\n\n```bash\ncurl -X DELETE --user \"api:YOUR_API_KEY\" \\\nhttps://api.derak.cloud/v1.0/zones/47c0ecf6c91243308c649ad1d2d618dd/ssl/\n```\n" }, { "path": "providers/dns/derak/internal/types.go", "content": "package internal\n\nimport \"time\"\n\ntype GetRecordsParameters struct {\n\tDNSType string `url:\"dnsType,omitempty\"`\n\tContent string `url:\"content,omitempty\"`\n}\n\ntype GetRecordsResponse struct {\n\tData []Record `json:\"data\"`\n\tCount int `json:\"count\"`\n}\n\ntype Record struct {\n\tType string `json:\"type,omitempty\"`\n\tHost string `json:\"host,omitempty\"`\n\tContent string `json:\"content,omitempty\"`\n\n\tID string `json:\"recordId,omitempty\"`\n\n\tTTL int `json:\"ttl,omitempty\"`\n\tCloud bool `json:\"cloud,omitempty\"`\n\tPriority int `json:\"priority,omitempty\"`\n\tService string `json:\"service,omitempty\"`\n\tProtocol string `json:\"protocol,omitempty\"`\n\tWeight int `json:\"weight,omitempty\"`\n\tPort int `json:\"port,omitempty\"`\n\tAdvanced bool `json:\"advanced,omitempty\"`\n\tUpstreamPort int `json:\"upstreamPort,omitempty\"`\n\tUpstreamProtocol string `json:\"upstreamProtocol,omitempty\"`\n\tCustomSSLType string `json:\"customSSLType,omitempty\"`\n}\n\ntype APIResponse[T any] struct {\n\tSuccess bool `json:\"success\"`\n\tResult T `json:\"result\"`\n\tError int `json:\"error\"`\n}\n\ntype Zone struct {\n\tID string `json:\"zoneId,omitempty\"`\n\tTags []string `json:\"tags,omitempty\"`\n\tContextID string `json:\"contextId,omitempty\"`\n\tContextType string `json:\"contextType,omitempty\"`\n\tHumanReadable string `json:\"humanReadable,omitempty\"`\n\tSerial string `json:\"serial,omitempty\"`\n\tCreationTime int64 `json:\"creationTime,omitempty\"`\n\tCreationTimeDate time.Time `json:\"creationTimeDate,omitzero\"`\n\tStatus string `json:\"status,omitempty\"`\n\tIsMoved bool `json:\"is_moved,omitempty\"`\n\tPaused bool `json:\"paused,omitempty\"`\n\tServiceType string `json:\"serviceType,omitempty\"`\n\tLimbo bool `json:\"limbo,omitempty\"`\n\tTeamName string `json:\"teamName,omitempty\"`\n\tTeamID string `json:\"teamId,omitempty\"`\n\tMyTeam bool `json:\"myTeam,omitempty\"`\n\tRoleName string `json:\"roleName,omitempty\"`\n\tIsBoard bool `json:\"isBoard,omitempty\"`\n\tBoardRole []string `json:\"boardRole,omitempty\"`\n}\n\nfunc codeText(code int) string {\n\tswitch code {\n\tcase 1008:\n\t\treturn \"DNSValidationError\"\n\tcase 1003:\n\t\treturn \"ForbiddenError\"\n\tcase 1013:\n\t\treturn \"RateLimitExceeded\"\n\tcase 1021:\n\t\treturn \"RecordNotFoundError\"\n\tdefault:\n\t\treturn \"\"\n\t}\n}\n" }, { "path": "providers/dns/desec/desec.go", "content": "// Package desec implements a DNS provider for solving the DNS-01 challenge using deSEC DNS.\npackage desec\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n\t\"net/http\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge\"\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug\"\n\t\"github.com/nrdcg/desec\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DESEC_\"\n\n\tEnvToken = envNamespace + \"TOKEN\"\n\n\tEnvTTL = envNamespace + \"TTL\"\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\tEnvHTTPTimeout = envNamespace + \"HTTP_TIMEOUT\"\n)\n\n// https://github.com/desec-io/desec-stack/issues/216\n// https://desec.readthedocs.io/_/downloads/en/latest/pdf/\nconst defaultTTL int = 3600\n\nvar _ challenge.ProviderTimeout = (*DNSProvider)(nil)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tToken string\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tTTL int\n\tHTTPClient *http.Client\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tTTL: env.GetOrDefaultInt(EnvTTL, defaultTTL),\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 120*time.Second),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 4*time.Second),\n\t\tHTTPClient: &http.Client{\n\t\t\tTimeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),\n\t\t},\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tconfig *Config\n\tclient *desec.Client\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for deSEC.\n// Credentials must be passed in the environment variable: DESEC_TOKEN.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tvalues, err := env.Get(EnvToken)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"desec: %w\", err)\n\t}\n\n\tconfig := NewDefaultConfig()\n\tconfig.Token = values[EnvToken]\n\n\treturn NewDNSProviderConfig(config)\n}\n\n// NewDNSProviderConfig return a DNSProvider instance configured for deSEC.\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"desec: the configuration of the DNS provider is nil\")\n\t}\n\n\tif config.Token == \"\" {\n\t\treturn nil, errors.New(\"desec: incomplete credentials, missing token\")\n\t}\n\n\topts := desec.NewDefaultClientOptions()\n\tif config.HTTPClient != nil {\n\t\topts.HTTPClient = config.HTTPClient\n\t}\n\n\topts.HTTPClient = clientdebug.Wrap(opts.HTTPClient)\n\n\topts.Logger = log.Default()\n\n\tclient := desec.New(config.Token, opts)\n\n\treturn &DNSProvider{config: config, client: client}, nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\n// Present creates a TXT record using the specified parameters.\nfunc (d *DNSProvider) Present(domain, token, keyAuth string) error {\n\tctx := context.Background()\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\trecordName, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: %w\", err)\n\t}\n\n\tdomainName := dns01.UnFqdn(authZone)\n\n\tquotedValue := fmt.Sprintf(`%q`, info.Value)\n\n\trrSet, err := d.client.Records.Get(ctx, domainName, recordName, \"TXT\")\n\tif err != nil {\n\t\tvar nf *desec.NotFoundError\n\t\tif !errors.As(err, &nf) {\n\t\t\treturn fmt.Errorf(\"desec: failed to get records: domainName=%s, recordName=%s: %w\", domainName, recordName, err)\n\t\t}\n\n\t\t// Not found case -> create\n\t\t_, err = d.client.Records.Create(ctx, desec.RRSet{\n\t\t\tDomain: domainName,\n\t\t\tSubName: recordName,\n\t\t\tType: \"TXT\",\n\t\t\tRecords: []string{quotedValue},\n\t\t\tTTL: d.config.TTL,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"desec: failed to create records: domainName=%s, recordName=%s: %w\", domainName, recordName, err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\t// update\n\trecords := append(rrSet.Records, quotedValue)\n\n\t_, err = d.client.Records.Update(ctx, domainName, recordName, \"TXT\", desec.RRSet{Records: records})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: failed to update records: domainName=%s, recordName=%s: %w\", domainName, recordName, err)\n\t}\n\n\treturn nil\n}\n\n// CleanUp removes the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {\n\tctx := context.Background()\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\trecordName, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: %w\", err)\n\t}\n\n\tdomainName := dns01.UnFqdn(authZone)\n\n\trrSet, err := d.client.Records.Get(ctx, domainName, recordName, \"TXT\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: failed to get records: domainName=%s, recordName=%s: %w\", domainName, recordName, err)\n\t}\n\n\trecords := make([]string, 0)\n\n\tfor _, record := range rrSet.Records {\n\t\tif record != fmt.Sprintf(`%q`, info.Value) {\n\t\t\trecords = append(records, record)\n\t\t}\n\t}\n\n\t_, err = d.client.Records.Update(ctx, domainName, recordName, \"TXT\", desec.RRSet{Records: records})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"desec: failed to update records: domainName=%s, recordName=%s: %w\", domainName, recordName, err)\n\t}\n\n\treturn nil\n}\n" }, { "path": "providers/dns/desec/desec.toml", "content": "Name = \"deSEC.io\"\nDescription = ''''''\nURL = \"https://desec.io\"\nCode = \"desec\"\nSince = \"v3.7.0\"\n\nExample = '''\nDESEC_TOKEN=x-xxxxxxxxxxxxxxxxxxxxxxxxxx \\\nlego --dns desec -d '*.example.com' -d example.com run\n'''\n\n[Configuration]\n [Configuration.Credentials]\n DESEC_TOKEN = \"Domain token\"\n [Configuration.Additional]\n DESEC_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 4)\"\n DESEC_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 120)\"\n DESEC_TTL = \"The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600)\"\n DESEC_HTTP_TIMEOUT = \"API request timeout in seconds (Default: 30)\"\n\n[Links]\n API = \"https://desec.readthedocs.io/en/latest/\"\n" }, { "path": "providers/dns/desec/desec_test.go", "content": "package desec\n\nimport (\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nconst envDomain = envNamespace + \"DOMAIN\"\n\nvar envTest = tester.NewEnvTest(EnvToken).WithDomain(envDomain)\n\nfunc TestNewDNSProvider(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvToken: \"123\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvToken: \"\",\n\t\t\t},\n\t\t\texpected: \"desec: some credentials information are missing: DESEC_TOKEN\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\texpected string\n\t\ttoken string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\ttoken: \"api_key\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\texpected: \"desec: incomplete credentials, missing token\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.Token = test.token\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestLivePresent(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.Present(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestLiveCleanUp(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\ttime.Sleep(1 * time.Second)\n\n\terr = provider.CleanUp(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/designate/designate.go", "content": "// Package designate implements a DNS provider for solving the DNS-01 challenge using the Designate DNSaaS for Openstack.\npackage designate\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n\t\"os\"\n\t\"slices\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge\"\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/gophercloud/gophercloud\"\n\t\"github.com/gophercloud/gophercloud/openstack\"\n\t\"github.com/gophercloud/gophercloud/openstack/dns/v2/recordsets\"\n\t\"github.com/gophercloud/gophercloud/openstack/dns/v2/zones\"\n\t\"github.com/gophercloud/utils/openstack/clientconfig\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DESIGNATE_\"\n\n\tEnvTTL = envNamespace + \"TTL\"\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\n\tEnvZoneName = envNamespace + \"ZONE_NAME\"\n\n\tenvNamespaceClient = \"OS_\"\n\n\tEnvAuthURL = envNamespaceClient + \"AUTH_URL\"\n\tEnvUsername = envNamespaceClient + \"USERNAME\"\n\tEnvPassword = envNamespaceClient + \"PASSWORD\"\n\tEnvUserID = envNamespaceClient + \"USER_ID\"\n\tEnvAppCredID = envNamespaceClient + \"APPLICATION_CREDENTIAL_ID\"\n\tEnvAppCredName = envNamespaceClient + \"APPLICATION_CREDENTIAL_NAME\"\n\tEnvAppCredSecret = envNamespaceClient + \"APPLICATION_CREDENTIAL_SECRET\"\n\tEnvTenantName = envNamespaceClient + \"TENANT_NAME\"\n\tEnvRegionName = envNamespaceClient + \"REGION_NAME\"\n\tEnvProjectID = envNamespaceClient + \"PROJECT_ID\"\n\tEnvCloud = envNamespaceClient + \"CLOUD\"\n)\n\nvar _ challenge.ProviderTimeout = (*DNSProvider)(nil)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tZoneName string\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tTTL int\n\topts gophercloud.AuthOptions\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tZoneName: env.GetOrFile(EnvZoneName),\n\t\tTTL: env.GetOrDefaultInt(EnvTTL, 10),\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 10*time.Minute),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 10*time.Second),\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tconfig *Config\n\tclient *gophercloud.ServiceClient\n\n\tdnsEntriesMu sync.Mutex\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for Designate.\n// Credentials must be passed in the environment variables:\n// OS_AUTH_URL, OS_USERNAME, OS_PASSWORD, OS_REGION_NAME.\n// Or you can specify OS_CLOUD to read the credentials from the according cloud entry.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tconfig := NewDefaultConfig()\n\n\tval, err := env.Get(EnvCloud)\n\tif err == nil {\n\t\topts, erro := clientconfig.AuthOptions(&clientconfig.ClientOpts{\n\t\t\tCloud: val[EnvCloud],\n\t\t})\n\t\tif erro != nil {\n\t\t\treturn nil, fmt.Errorf(\"designate: %w\", erro)\n\t\t}\n\n\t\tconfig.opts = *opts\n\t} else {\n\t\topts, err := openstack.AuthOptionsFromEnv()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"designate: %w\", err)\n\t\t}\n\n\t\tconfig.opts = opts\n\t}\n\n\treturn NewDNSProviderConfig(config)\n}\n\n// NewDNSProviderConfig return a DNSProvider instance configured for Designate.\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"designate: the configuration of the DNS provider is nil\")\n\t}\n\n\tprovider, err := openstack.AuthenticatedClient(config.opts)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"designate: failed to authenticate: %w\", err)\n\t}\n\n\tdnsClient, err := openstack.NewDNSV2(provider, gophercloud.EndpointOpts{\n\t\tRegion: os.Getenv(\"OS_REGION_NAME\"),\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"designate: failed to get DNS provider: %w\", err)\n\t}\n\n\treturn &DNSProvider{client: dnsClient, config: config}, nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\n// Present creates a TXT record to fulfill the dns-01 challenge.\nfunc (d *DNSProvider) Present(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tzone, err := d.getZoneName(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: %w\", err)\n\t}\n\n\tzoneID, err := d.getZoneID(zone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: couldn't get zone ID in Present: %w\", err)\n\t}\n\n\t// use mutex to prevent race condition between creating the record and verifying it\n\td.dnsEntriesMu.Lock()\n\tdefer d.dnsEntriesMu.Unlock()\n\n\texistingRecord, err := d.getRecord(zoneID, info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: %w\", err)\n\t}\n\n\tif existingRecord != nil {\n\t\tif slices.Contains(existingRecord.Records, info.Value) {\n\t\t\tlog.Printf(\"designate: the record already exists: %s\", info.Value)\n\t\t\treturn nil\n\t\t}\n\n\t\treturn d.updateRecord(existingRecord, info.Value)\n\t}\n\n\terr = d.createRecord(zoneID, info.EffectiveFQDN, info.Value)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// CleanUp removes the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tzone, err := d.getZoneName(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: %w\", err)\n\t}\n\n\tzoneID, err := d.getZoneID(zone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: couldn't get zone ID in CleanUp: %w\", err)\n\t}\n\n\t// use mutex to prevent race condition between getting the record and deleting it\n\td.dnsEntriesMu.Lock()\n\tdefer d.dnsEntriesMu.Unlock()\n\n\trecord, err := d.getRecord(zoneID, info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: couldn't get Record ID in CleanUp: %w\", err)\n\t}\n\n\tif record == nil {\n\t\t// Record is already deleted\n\t\treturn nil\n\t}\n\n\terr = recordsets.Delete(d.client, zoneID, record.ID).ExtractErr()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"designate: error for %s in CleanUp: %w\", info.EffectiveFQDN, err)\n\t}\n\n\treturn nil\n}\n\nfunc (d *DNSProvider) createRecord(zoneID, fqdn, value string) error {\n\tcreateOpts := recordsets.CreateOpts{\n\t\tName: fqdn,\n\t\tType: \"TXT\",\n\t\tTTL: d.config.TTL,\n\t\tDescription: \"ACME verification record\",\n\t\tRecords: []string{value},\n\t}\n\n\tactual, err := recordsets.Create(d.client, zoneID, createOpts).Extract()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error for %s in Present while creating record: %w\", fqdn, err)\n\t}\n\n\tif actual.Name != fqdn || actual.TTL != d.config.TTL {\n\t\treturn errors.New(\"the created record doesn't match what we wanted to create\")\n\t}\n\n\treturn nil\n}\n\nfunc (d *DNSProvider) updateRecord(record *recordsets.RecordSet, value string) error {\n\tif slices.Contains(record.Records, value) {\n\t\tlog.Printf(\"skip: the record already exists: %s\", value)\n\t\treturn nil\n\t}\n\n\tvalues := append([]string{value}, record.Records...)\n\n\tupdateOpts := recordsets.UpdateOpts{\n\t\tDescription: &record.Description,\n\t\tTTL: &record.TTL,\n\t\tRecords: values,\n\t}\n\n\tresult := recordsets.Update(d.client, record.ZoneID, record.ID, updateOpts)\n\n\treturn result.Err\n}\n\nfunc (d *DNSProvider) getZoneID(wanted string) (string, error) {\n\tlistOpts := zones.ListOpts{\n\t\tName: wanted,\n\t}\n\n\tallPages, err := zones.List(d.client, listOpts).AllPages()\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tallZones, err := zones.ExtractZones(allPages)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tfor _, zone := range allZones {\n\t\tif zone.Name == wanted {\n\t\t\treturn zone.ID, nil\n\t\t}\n\t}\n\n\treturn \"\", fmt.Errorf(\"zone id not found for %s\", wanted)\n}\n\nfunc (d *DNSProvider) getRecord(zoneID, wanted string) (*recordsets.RecordSet, error) {\n\tlistOpts := recordsets.ListOpts{\n\t\tName: wanted,\n\t\tType: \"TXT\",\n\t}\n\n\tallPages, err := recordsets.ListByZone(d.client, zoneID, listOpts).AllPages()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tallRecords, err := recordsets.ExtractRecordSets(allPages)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tfor _, record := range allRecords {\n\t\tif record.Name == wanted && record.Type == \"TXT\" {\n\t\t\treturn &record, nil\n\t\t}\n\t}\n\n\treturn nil, nil\n}\n\nfunc (d *DNSProvider) getZoneName(fqdn string) (string, error) {\n\tif d.config.ZoneName != \"\" {\n\t\treturn d.config.ZoneName, nil\n\t}\n\n\tauthZone, err := dns01.FindZoneByFqdn(fqdn)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not find zone for %s: %w\", fqdn, err)\n\t}\n\n\tif authZone == \"\" {\n\t\treturn \"\", errors.New(\"empty zone name\")\n\t}\n\n\treturn authZone, nil\n}\n" }, { "path": "providers/dns/designate/designate.toml", "content": "Name = \"Designate DNSaaS for Openstack\"\nDescription = ''''''\nURL = \"https://docs.openstack.org/designate/latest/\"\nCode = \"designate\"\nSince = \"v2.2.0\"\n\nExample = '''\n# With a `clouds.yaml`\nOS_CLOUD=my_openstack \\\nlego --dns designate -d '*.example.com' -d example.com run\n\n# or\n\nOS_AUTH_URL=https://openstack.example.org \\\nOS_REGION_NAME=RegionOne \\\nOS_PROJECT_ID=23d4522a987d4ab529f722a007c27846\nOS_USERNAME=myuser \\\nOS_PASSWORD=passw0rd \\\nlego --dns designate -d '*.example.com' -d example.com run\n\n# or\n\nOS_AUTH_URL=https://openstack.example.org \\\nOS_REGION_NAME=RegionOne \\\nOS_AUTH_TYPE=v3applicationcredential \\\nOS_APPLICATION_CREDENTIAL_ID=imn74uq0or7dyzz20dwo1ytls4me8dry \\\nOS_APPLICATION_CREDENTIAL_SECRET=68FuSPSdQqkFQYH5X1OoriEIJOwyLtQ8QSqXZOc9XxFK1A9tzZT6He2PfPw0OMja \\\nlego --dns designate -d '*.example.com' -d example.com run\n'''\n\nAdditional = '''\n## Description\n\nThere are three main ways of authenticating with Designate:\n\n1. The first one is by using the `OS_CLOUD` environment variable and a `clouds.yaml` file.\n2. The second one is using your username and password, via the `OS_USERNAME`, `OS_PASSWORD` and `OS_PROJECT_NAME` environment variables.\n3. The third one is by using an application credential, via the `OS_APPLICATION_CREDENTIAL_*` and `OS_USER_ID` environment variables.\n\nFor the username/password and application methods, the `OS_AUTH_URL` and `OS_REGION_NAME` environment variables are required.\n\nFor more information, you can read about the different methods of authentication with OpenStack in the Keystone's documentation and the gophercloud documentation:\n\n- [Keystone username/password](https://docs.openstack.org/keystone/latest/user/supported_clients.html)\n- [Keystone application credentials](https://docs.openstack.org/keystone/latest/user/application_credentials.html)\n\nPublic cloud providers with support for Designate:\n\n- [Fuga Cloud](https://fuga.cloud/)\n'''\n\n[Configuration]\n [Configuration.Credentials]\n OS_AUTH_URL = \"Identity endpoint URL\"\n OS_USERNAME = \"Username\"\n OS_PASSWORD = \"Password\"\n OS_USER_ID = \"User ID\"\n OS_APPLICATION_CREDENTIAL_ID = \"Application credential ID\"\n OS_APPLICATION_CREDENTIAL_NAME = \"Application credential name\"\n OS_APPLICATION_CREDENTIAL_SECRET = \"Application credential secret\"\n OS_PROJECT_NAME = \"Project name\"\n OS_REGION_NAME = \"Region name\"\n [Configuration.Additional]\n OS_PROJECT_ID = \"Project ID\"\n OS_TENANT_NAME = \"Tenant name (deprecated see OS_PROJECT_NAME and OS_PROJECT_ID)\"\n DESIGNATE_ZONE_NAME = \"The zone name to use in the OpenStack Project to manage TXT records.\"\n DESIGNATE_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 10)\"\n DESIGNATE_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 600)\"\n DESIGNATE_TTL = \"The TTL of the TXT record used for the DNS challenge in seconds (Default: 10)\"\n\n[Links]\n API = \"https://docs.openstack.org/designate/latest/\"\n GoClient = \"https://pkg.go.dev/github.com/gophercloud/gophercloud/openstack/dns/v2\"\n" }, { "path": "providers/dns/designate/designate_test.go", "content": "package designate\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"os\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/gophercloud/utils/openstack/clientconfig\"\n\t\"github.com/stretchr/testify/require\"\n\t\"gopkg.in/yaml.v2\"\n)\n\nconst (\n\tenvDomain = envNamespace + \"DOMAIN\"\n\tenvOSClientConfigFile = \"OS_CLIENT_CONFIG_FILE\"\n)\n\nvar envTest = tester.NewEnvTest(\n\tEnvCloud,\n\tEnvAuthURL,\n\tEnvUsername,\n\tEnvPassword,\n\tEnvUserID,\n\tEnvAppCredID,\n\tEnvAppCredName,\n\tEnvAppCredSecret,\n\tEnvTenantName,\n\tEnvRegionName,\n\tEnvProjectID,\n\tenvOSClientConfigFile).\n\tWithDomain(envDomain)\n\nfunc TestNewDNSProvider_fromEnv(t *testing.T) {\n\tserverURL := setupTestProvider(t)\n\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\tEnvUsername: \"B\",\n\t\t\t\tEnvPassword: \"C\",\n\t\t\t\tEnvRegionName: \"D\",\n\t\t\t\tEnvProjectID: \"E\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthURL: \"\",\n\t\t\t\tEnvUsername: \"\",\n\t\t\t\tEnvPassword: \"\",\n\t\t\t\tEnvRegionName: \"\",\n\t\t\t},\n\t\t\texpected: \"designate: Missing environment variable [OS_AUTH_URL]\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing auth url\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthURL: \"\",\n\t\t\t\tEnvUsername: \"B\",\n\t\t\t\tEnvPassword: \"C\",\n\t\t\t\tEnvRegionName: \"D\",\n\t\t\t},\n\t\t\texpected: \"designate: Missing environment variable [OS_AUTH_URL]\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing username\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\tEnvUsername: \"\",\n\t\t\t\tEnvPassword: \"C\",\n\t\t\t\tEnvRegionName: \"D\",\n\t\t\t},\n\t\t\texpected: \"designate: Missing one of the following environment variables [OS_USERID, OS_USERNAME]\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing password\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\tEnvUsername: \"B\",\n\t\t\t\tEnvPassword: \"\",\n\t\t\t\tEnvRegionName: \"D\",\n\t\t\t},\n\t\t\texpected: \"designate: Missing environment variable [OS_PASSWORD]\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing application credential secret\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\tEnvRegionName: \"D\",\n\t\t\t\tEnvAppCredID: \"F\",\n\t\t\t},\n\t\t\texpected: \"designate: Missing environment variable [OS_APPLICATION_CREDENTIAL_SECRET]\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProvider_fromCloud(t *testing.T) {\n\tserverURL := setupTestProvider(t)\n\n\ttestCases := []struct {\n\t\tdesc string\n\t\tosCloud string\n\t\tcloud clientconfig.Cloud\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tosCloud: \"good_cloud\",\n\t\t\tcloud: clientconfig.Cloud{\n\t\t\t\tAuthInfo: &clientconfig.AuthInfo{\n\t\t\t\t\tAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\t\tUsername: \"B\",\n\t\t\t\t\tPassword: \"C\",\n\t\t\t\t\tProjectName: \"E\",\n\t\t\t\t\tProjectID: \"F\",\n\t\t\t\t},\n\t\t\t\tRegionName: \"D\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing auth url\",\n\t\t\tosCloud: \"missing_auth_url\",\n\t\t\tcloud: clientconfig.Cloud{\n\t\t\t\tAuthInfo: &clientconfig.AuthInfo{\n\t\t\t\t\tUsername: \"B\",\n\t\t\t\t\tPassword: \"C\",\n\t\t\t\t\tProjectName: \"E\",\n\t\t\t\t\tProjectID: \"F\",\n\t\t\t\t},\n\t\t\t\tRegionName: \"D\",\n\t\t\t},\n\t\t\texpected: \"designate: Missing input for argument [auth_url]\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing username\",\n\t\t\tosCloud: \"missing_username\",\n\t\t\tcloud: clientconfig.Cloud{\n\t\t\t\tAuthInfo: &clientconfig.AuthInfo{\n\t\t\t\t\tAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\t\tPassword: \"C\",\n\t\t\t\t\tProjectName: \"E\",\n\t\t\t\t\tProjectID: \"F\",\n\t\t\t\t},\n\t\t\t\tRegionName: \"D\",\n\t\t\t},\n\t\t\texpected: \"designate: failed to authenticate: Missing input for argument [Username]\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing password\",\n\t\t\tosCloud: \"missing_auth_url\",\n\t\t\tcloud: clientconfig.Cloud{\n\t\t\t\tAuthInfo: &clientconfig.AuthInfo{\n\t\t\t\t\tAuthURL: serverURL + \"/v2.0/\",\n\t\t\t\t\tUsername: \"B\",\n\t\t\t\t\tProjectName: \"E\",\n\t\t\t\t\tProjectID: \"F\",\n\t\t\t\t},\n\t\t\t\tRegionName: \"D\",\n\t\t\t},\n\t\t\texpected: \"designate: failed to authenticate: Exactly one of PasswordCredentials and TokenCredentials must be provided\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(map[string]string{\n\t\t\t\tEnvCloud: test.osCloud,\n\t\t\t\tenvOSClientConfigFile: createCloudsYaml(t, test.osCloud, test.cloud),\n\t\t\t})\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\tserverURL := setupTestProvider(t)\n\n\ttestCases := []struct {\n\t\tdesc string\n\t\ttenantName string\n\t\tpassword string\n\t\tuserName string\n\t\tauthURL string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\ttenantName: \"A\",\n\t\t\tpassword: \"B\",\n\t\t\tuserName: \"C\",\n\t\t\tauthURL: serverURL + \"/v2.0/\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"wrong auth url\",\n\t\t\ttenantName: \"A\",\n\t\t\tpassword: \"B\",\n\t\t\tuserName: \"C\",\n\t\t\tauthURL: serverURL,\n\t\t\texpected: \"designate: failed to authenticate: No supported version available from endpoint \" + serverURL + \"/\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.opts.TenantName = test.tenantName\n\t\t\tconfig.opts.Password = test.password\n\t\t\tconfig.opts.Username = test.userName\n\t\t\tconfig.opts.IdentityEndpoint = test.authURL\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\n// createCloudsYaml creates a temporary cloud file for testing purpose.\nfunc createCloudsYaml(t *testing.T, cloudName string, cloud clientconfig.Cloud) string {\n\tt.Helper()\n\n\tfile, err := os.CreateTemp(t.TempDir(), \"lego_test\")\n\trequire.NoError(t, err)\n\n\tt.Cleanup(func() { _ = file.Close() })\n\n\tclouds := clientconfig.Clouds{\n\t\tClouds: map[string]clientconfig.Cloud{\n\t\t\tcloudName: cloud,\n\t\t},\n\t}\n\n\terr = yaml.NewEncoder(file).Encode(&clouds)\n\trequire.NoError(t, err)\n\n\treturn file.Name()\n}\n\nfunc setupTestProvider(t *testing.T) string {\n\tt.Helper()\n\n\tmux := http.NewServeMux()\n\tserver := httptest.NewServer(mux)\n\tt.Cleanup(server.Close)\n\n\tmux.HandleFunc(\"/\", func(w http.ResponseWriter, _ *http.Request) {\n\t\t_, _ = w.Write([]byte(`{\n\t\"access\": {\n\t\t\"token\": {\n\t\t\t\"id\": \"a\",\n\t\t\t\"expires\": \"9015-06-05T16:24:57.637Z\"\n\t\t},\n\t\t\"user\": {\n\t\t\t\"name\": \"a\",\n\t\t\t\"roles\": [ ],\n\t\t\t\"role_links\": [ ]\n\t\t},\n\t\t\"serviceCatalog\": [\n\t\t\t{\n\t\t\t\t\"endpoints\": [\n\t\t\t\t\t{\n\t\t\t\t\t\t\"adminURL\": \"http://23.253.72.207:9696/\",\n\t\t\t\t\t\t\"region\": \"D\",\n\t\t\t\t\t\t\"internalURL\": \"http://23.253.72.207:9696/\",\n\t\t\t\t\t\t\"id\": \"97c526db8d7a4c88bbb8d68db1bdcdb8\",\n\t\t\t\t\t\t\"publicURL\": \"http://23.253.72.207:9696/\"\n\t\t\t\t\t}\n\t\t\t\t],\n\t\t\t\t\"endpoints_links\": [ ],\n\t\t\t\t\"type\": \"dns\",\n\t\t\t\t\"name\": \"designate\"\n\t\t\t}\n\t\t]\n\t}\n}`))\n\t\tw.WriteHeader(http.StatusOK)\n\t})\n\n\treturn server.URL\n}\n\nfunc TestLivePresent(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.Present(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestLiveCleanUp(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\ttime.Sleep(1 * time.Second)\n\n\terr = provider.CleanUp(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/digitalocean/digitalocean.go", "content": "// Package digitalocean implements a DNS provider for solving the DNS-01 challenge using digitalocean DNS.\npackage digitalocean\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge\"\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/go-acme/lego/v4/providers/dns/digitalocean/internal\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DO_\"\n\n\tEnvAuthToken = envNamespace + \"AUTH_TOKEN\"\n\tEnvAPIUrl = envNamespace + \"API_URL\"\n\n\tEnvTTL = envNamespace + \"TTL\"\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\tEnvHTTPTimeout = envNamespace + \"HTTP_TIMEOUT\"\n)\n\nvar _ challenge.ProviderTimeout = (*DNSProvider)(nil)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tBaseURL string\n\tAuthToken string\n\tTTL int\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tHTTPClient *http.Client\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tBaseURL: env.GetOrDefaultString(EnvAPIUrl, internal.DefaultBaseURL),\n\t\tTTL: env.GetOrDefaultInt(EnvTTL, 30),\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, dns01.DefaultPropagationTimeout),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 5*time.Second),\n\t\tHTTPClient: &http.Client{\n\t\t\tTimeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),\n\t\t},\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tconfig *Config\n\tclient *internal.Client\n\n\trecordIDs map[string]int\n\trecordIDsMu sync.Mutex\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for Digital\n// Ocean. Credentials must be passed in the environment variable:\n// DO_AUTH_TOKEN.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tvalues, err := env.Get(EnvAuthToken)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"digitalocean: %w\", err)\n\t}\n\n\tconfig := NewDefaultConfig()\n\tconfig.AuthToken = values[EnvAuthToken]\n\n\treturn NewDNSProviderConfig(config)\n}\n\n// NewDNSProviderConfig return a DNSProvider instance configured for Digital Ocean.\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"digitalocean: the configuration of the DNS provider is nil\")\n\t}\n\n\tif config.AuthToken == \"\" {\n\t\treturn nil, errors.New(\"digitalocean: credentials missing\")\n\t}\n\n\tclient := internal.NewClient(\n\t\tclientdebug.Wrap(\n\t\t\tinternal.OAuthStaticAccessToken(config.HTTPClient, config.AuthToken),\n\t\t),\n\t)\n\n\tif config.BaseURL != \"\" {\n\t\tvar err error\n\n\t\tclient.BaseURL, err = url.Parse(config.BaseURL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"digitalocean: %w\", err)\n\t\t}\n\t}\n\n\treturn &DNSProvider{\n\t\tconfig: config,\n\t\tclient: client,\n\t\trecordIDs: make(map[string]int),\n\t}, nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\n// Present creates a TXT record using the specified parameters.\nfunc (d *DNSProvider) Present(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"digitalocean: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\trecord := internal.Record{Type: \"TXT\", Name: info.EffectiveFQDN, Data: info.Value, TTL: d.config.TTL}\n\n\trespData, err := d.client.AddTxtRecord(context.Background(), authZone, record)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"digitalocean: %w\", err)\n\t}\n\n\td.recordIDsMu.Lock()\n\td.recordIDs[token] = respData.DomainRecord.ID\n\td.recordIDsMu.Unlock()\n\n\treturn nil\n}\n\n// CleanUp removes the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"digitalocean: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\t// get the record's unique ID from when we created it\n\td.recordIDsMu.Lock()\n\trecordID, ok := d.recordIDs[token]\n\td.recordIDsMu.Unlock()\n\n\tif !ok {\n\t\treturn fmt.Errorf(\"digitalocean: unknown record ID for '%s'\", info.EffectiveFQDN)\n\t}\n\n\terr = d.client.RemoveTxtRecord(context.Background(), authZone, recordID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"digitalocean: %w\", err)\n\t}\n\n\t// Delete record ID from map\n\td.recordIDsMu.Lock()\n\tdelete(d.recordIDs, token)\n\td.recordIDsMu.Unlock()\n\n\treturn nil\n}\n" }, { "path": "providers/dns/digitalocean/digitalocean.toml", "content": "Name = \"Digital Ocean\"\nDescription = ''''''\nURL = \"https://www.digitalocean.com/docs/networking/dns/\"\nCode = \"digitalocean\"\nSince = \"v0.3.0\"\n\nExample = '''\nDO_AUTH_TOKEN=xxxxxx \\\nlego --dns digitalocean -d '*.example.com' -d example.com run\n'''\n\n[Configuration]\n [Configuration.Credentials]\n DO_AUTH_TOKEN = \"Authentication token\"\n [Configuration.Additional]\n DO_API_URL = \"The URL of the API\"\n DO_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 5)\"\n DO_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 60)\"\n DO_TTL = \"The TTL of the TXT record used for the DNS challenge in seconds (Default: 30)\"\n DO_HTTP_TIMEOUT = \"API request timeout in seconds (Default: 30)\"\n\n[Links]\n API = \"https://developers.digitalocean.com/documentation/v2/#domain-records\"\n" }, { "path": "providers/dns/digitalocean/digitalocean_test.go", "content": "package digitalocean\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nvar envTest = tester.NewEnvTest(EnvAuthToken)\n\nfunc mockProvider() *servermock.Builder[*DNSProvider] {\n\treturn servermock.NewBuilder(\n\t\tfunc(server *httptest.Server) (*DNSProvider, error) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.AuthToken = \"asdf1234\"\n\t\t\tconfig.BaseURL = server.URL\n\t\t\tconfig.HTTPClient = server.Client()\n\n\t\t\treturn NewDNSProviderConfig(config)\n\t\t},\n\t\tservermock.CheckHeader().\n\t\t\tWithJSONHeaders().\n\t\t\tWith(\"Authorization\", \"Bearer asdf1234\"))\n}\n\nfunc TestNewDNSProvider(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthToken: \"123\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAuthToken: \"\",\n\t\t\t},\n\t\t\texpected: \"digitalocean: some credentials information are missing: DO_AUTH_TOKEN\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t\trequire.NotNil(t, p.recordIDs)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tauthToken string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tauthToken: \"123\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\texpected: \"digitalocean: credentials missing\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.AuthToken = test.authToken\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t\trequire.NotNil(t, p.recordIDs)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestDNSProvider_Present(t *testing.T) {\n\tprovider := mockProvider().\n\t\tRoute(\"POST /v2/domains/example.com/records\",\n\t\t\tservermock.RawStringResponse(`{\n\t\t\t\"domain_record\": {\n\t\t\t\t\"id\": 1234567,\n\t\t\t\t\"type\": \"TXT\",\n\t\t\t\t\"name\": \"_acme-challenge\",\n\t\t\t\t\"data\": \"w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI\",\n\t\t\t\t\"priority\": null,\n\t\t\t\t\"port\": null,\n\t\t\t\t\"weight\": null\n\t\t\t}\n\t\t}`).\n\t\t\t\tWithStatusCode(http.StatusCreated),\n\t\t\tservermock.CheckRequestJSONBody(`{\"type\":\"TXT\",\"name\":\"_acme-challenge.example.com.\",\"data\":\"w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI\",\"ttl\":30}`)).\n\t\tBuild(t)\n\n\terr := provider.Present(\"example.com\", \"\", \"foobar\")\n\trequire.NoError(t, err)\n}\n\nfunc TestDNSProvider_CleanUp(t *testing.T) {\n\tprovider := mockProvider().\n\t\tRoute(\"DELETE /v2/domains/example.com/records/1234567\",\n\t\t\tservermock.Noop().\n\t\t\t\tWithStatusCode(http.StatusNoContent)).\n\t\tBuild(t)\n\n\tprovider.recordIDsMu.Lock()\n\tprovider.recordIDs[\"token\"] = 1234567\n\tprovider.recordIDsMu.Unlock()\n\n\terr := provider.CleanUp(\"example.com\", \"token\", \"\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/digitalocean/internal/client.go", "content": "package internal\n\nimport (\n\t\"bytes\"\n\t\"context\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strconv\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/errutils\"\n\t\"golang.org/x/oauth2\"\n)\n\n// DefaultBaseURL default API endpoint.\nconst DefaultBaseURL = \"https://api.digitalocean.com\"\n\n// Client the Digital Ocean API client.\ntype Client struct {\n\tBaseURL *url.URL\n\thttpClient *http.Client\n}\n\n// NewClient creates a new Client.\nfunc NewClient(hc *http.Client) *Client {\n\tbaseURL, _ := url.Parse(DefaultBaseURL)\n\n\tif hc == nil {\n\t\thc = &http.Client{Timeout: 5 * time.Second}\n\t}\n\n\treturn &Client{BaseURL: baseURL, httpClient: hc}\n}\n\nfunc (c *Client) AddTxtRecord(ctx context.Context, zone string, record Record) (*TxtRecordResponse, error) {\n\tendpoint := c.BaseURL.JoinPath(\"v2\", \"domains\", dns01.UnFqdn(zone), \"records\")\n\n\treq, err := newJSONRequest(ctx, http.MethodPost, endpoint, record)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\trespData := &TxtRecordResponse{}\n\n\terr = c.do(req, respData)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn respData, nil\n}\n\nfunc (c *Client) RemoveTxtRecord(ctx context.Context, zone string, recordID int) error {\n\tendpoint := c.BaseURL.JoinPath(\"v2\", \"domains\", dns01.UnFqdn(zone), \"records\", strconv.Itoa(recordID))\n\n\treq, err := newJSONRequest(ctx, http.MethodDelete, endpoint, nil)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn c.do(req, nil)\n}\n\nfunc (c *Client) do(req *http.Request, result any) error {\n\tresp, err := c.httpClient.Do(req)\n\tif err != nil {\n\t\treturn errutils.NewHTTPDoError(req, err)\n\t}\n\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode >= http.StatusBadRequest {\n\t\treturn parseError(req, resp)\n\t}\n\n\tif result == nil {\n\t\treturn nil\n\t}\n\n\traw, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn errutils.NewReadResponseError(req, resp.StatusCode, err)\n\t}\n\n\terr = json.Unmarshal(raw, result)\n\tif err != nil {\n\t\treturn errutils.NewUnmarshalError(req, resp.StatusCode, raw, err)\n\t}\n\n\treturn nil\n}\n\nfunc newJSONRequest(ctx context.Context, method string, endpoint *url.URL, payload any) (*http.Request, error) {\n\tbuf := new(bytes.Buffer)\n\n\tif payload != nil {\n\t\terr := json.NewEncoder(buf).Encode(payload)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create request JSON body: %w\", err)\n\t\t}\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, method, endpoint.String(), buf)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create request: %w\", err)\n\t}\n\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\t// NOTE: Even though the body is empty, DigitalOcean API docs still show setting this Content-Type...\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\n\treturn req, nil\n}\n\nfunc parseError(req *http.Request, resp *http.Response) error {\n\traw, _ := io.ReadAll(resp.Body)\n\n\tvar errInfo APIError\n\n\terr := json.Unmarshal(raw, &errInfo)\n\tif err != nil {\n\t\treturn errutils.NewUnexpectedStatusCodeError(req, resp.StatusCode, raw)\n\t}\n\n\treturn fmt.Errorf(\"[status code %d] %w\", resp.StatusCode, errInfo)\n}\n\nfunc OAuthStaticAccessToken(client *http.Client, accessToken string) *http.Client {\n\tif client == nil {\n\t\tclient = &http.Client{Timeout: 5 * time.Second}\n\t}\n\n\tclient.Transport = &oauth2.Transport{\n\t\tSource: oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken}),\n\t\tBase: client.Transport,\n\t}\n\n\treturn client\n}\n" }, { "path": "providers/dns/digitalocean/internal/client_test.go", "content": "package internal\n\nimport (\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"net/url\"\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc mockBuilder() *servermock.Builder[*Client] {\n\treturn servermock.NewBuilder[*Client](\n\t\tfunc(server *httptest.Server) (*Client, error) {\n\t\t\tclient := NewClient(OAuthStaticAccessToken(server.Client(), \"secret\"))\n\t\t\tclient.BaseURL, _ = url.Parse(server.URL)\n\n\t\t\treturn client, nil\n\t\t},\n\t\tservermock.CheckHeader().WithJSONHeaders().\n\t\t\tWithAuthorization(\"Bearer secret\"))\n}\n\nfunc TestClient_AddTxtRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /v2/domains/example.com/records\",\n\t\t\tservermock.ResponseFromFixture(\"domains-records_POST.json\").\n\t\t\t\tWithStatusCode(http.StatusCreated),\n\t\t\tservermock.CheckRequestJSONBody(`{\"type\":\"TXT\",\"name\":\"_acme-challenge.example.com.\",\"data\":\"w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI\",\"ttl\":30}`)).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tType: \"TXT\",\n\t\tName: \"_acme-challenge.example.com.\",\n\t\tData: \"w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI\",\n\t\tTTL: 30,\n\t}\n\n\tnewRecord, err := client.AddTxtRecord(t.Context(), \"example.com\", record)\n\trequire.NoError(t, err)\n\n\texpected := &TxtRecordResponse{DomainRecord: Record{\n\t\tID: 1234567,\n\t\tType: \"TXT\",\n\t\tName: \"_acme-challenge\",\n\t\tData: \"w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI\",\n\t\tTTL: 0,\n\t}}\n\n\tassert.Equal(t, expected, newRecord)\n}\n\nfunc TestClient_RemoveTxtRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"DELETE /v2/domains/example.com/records/1234567\",\n\t\t\tservermock.ResponseFromFixture(\"domains-records_POST.json\").\n\t\t\t\tWithStatusCode(http.StatusNoContent)).\n\t\tBuild(t)\n\n\terr := client.RemoveTxtRecord(t.Context(), \"example.com\", 1234567)\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/digitalocean/internal/fixtures/domains-records_POST.json", "content": "{\n \"domain_record\": {\n \"id\": 1234567,\n \"type\": \"TXT\",\n \"name\": \"_acme-challenge\",\n \"data\": \"w6uP8Tcg6K2QR905Rms8iXTlksL6OD1KOWBxTK7wxPI\",\n \"priority\": null,\n \"port\": null,\n \"weight\": null\n }\n}\n" }, { "path": "providers/dns/digitalocean/internal/types.go", "content": "package internal\n\nimport \"fmt\"\n\n// TxtRecordResponse represents a response from DO's API after making a TXT record.\ntype TxtRecordResponse struct {\n\tDomainRecord Record `json:\"domain_record\"`\n}\n\ntype Record struct {\n\tID int `json:\"id,omitempty\"`\n\tType string `json:\"type,omitempty\"`\n\tName string `json:\"name,omitempty\"`\n\tData string `json:\"data,omitempty\"`\n\tTTL int `json:\"ttl,omitempty\"`\n}\n\ntype APIError struct {\n\tID string `json:\"id\"`\n\tMessage string `json:\"message\"`\n}\n\nfunc (a APIError) Error() string {\n\treturn fmt.Sprintf(\"%s: %s\", a.ID, a.Message)\n}\n" }, { "path": "providers/dns/directadmin/directadmin.go", "content": "package directadmin\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge\"\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/go-acme/lego/v4/providers/dns/directadmin/internal\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DIRECTADMIN_\"\n\n\tEnvAPIURL = envNamespace + \"API_URL\"\n\tEnvUsername = envNamespace + \"USERNAME\"\n\tEnvPassword = envNamespace + \"PASSWORD\"\n\tEnvZoneName = envNamespace + \"ZONE_NAME\"\n\n\tEnvTTL = envNamespace + \"TTL\"\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\tEnvHTTPTimeout = envNamespace + \"HTTP_TIMEOUT\"\n)\n\nvar _ challenge.ProviderTimeout = (*DNSProvider)(nil)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tBaseURL string\n\tUsername string\n\tPassword string\n\n\tZoneName string\n\n\tTTL int\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tHTTPClient *http.Client\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tZoneName: env.GetOrFile(EnvZoneName),\n\t\tTTL: env.GetOrDefaultInt(EnvTTL, 30),\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 60*time.Second),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 5*time.Second),\n\t\tHTTPClient: &http.Client{\n\t\t\tTimeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),\n\t\t},\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tclient *internal.Client\n\tconfig *Config\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for DirectAdmin.\n// Credentials must be passed in the environment variables:\n// DIRECTADMIN_API_URL, DIRECTADMIN_USERNAME, DIRECTADMIN_PASSWORD.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tvalues, err := env.Get(EnvAPIURL, EnvUsername, EnvPassword)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"directadmin: %w\", err)\n\t}\n\n\tconfig := NewDefaultConfig()\n\tconfig.BaseURL = values[EnvAPIURL]\n\tconfig.Username = values[EnvUsername]\n\tconfig.Password = values[EnvPassword]\n\n\treturn NewDNSProviderConfig(config)\n}\n\n// NewDNSProviderConfig return a DNSProvider instance configured for DirectAdmin.\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config.BaseURL == \"\" {\n\t\treturn nil, errors.New(\"directadmin: missing API URL\")\n\t}\n\n\tif config.Username == \"\" || config.Password == \"\" {\n\t\treturn nil, errors.New(\"directadmin: some credentials information are missing\")\n\t}\n\n\tclient, err := internal.NewClient(config.BaseURL, config.Username, config.Password)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"directadmin: %w\", err)\n\t}\n\n\tif config.HTTPClient != nil {\n\t\tclient.HTTPClient = config.HTTPClient\n\t}\n\n\tclient.HTTPClient = clientdebug.Wrap(client.HTTPClient)\n\n\treturn &DNSProvider{client: client, config: config}, nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\n// Present creates a TXT record using the specified parameters.\nfunc (d *DNSProvider) Present(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := d.getZoneName(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"directadmin: [domain: %q] %w\", domain, err)\n\t}\n\n\tsubDomain, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"directadmin: %w\", err)\n\t}\n\n\trecord := internal.Record{\n\t\tName: subDomain,\n\t\tType: \"TXT\",\n\t\tValue: info.Value,\n\t\tTTL: d.config.TTL,\n\t}\n\n\terr = d.client.SetRecord(context.Background(), dns01.UnFqdn(authZone), record)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"directadmin: set record for zone %s and subdomain %s: %w\", authZone, subDomain, err)\n\t}\n\n\treturn nil\n}\n\n// CleanUp removes the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := d.getZoneName(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"directadmin: [domain: %q] %w\", domain, err)\n\t}\n\n\tsubDomain, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"directadmin: %w\", err)\n\t}\n\n\trecord := internal.Record{\n\t\tName: subDomain,\n\t\tType: \"TXT\",\n\t\tValue: info.Value,\n\t}\n\n\terr = d.client.DeleteRecord(context.Background(), dns01.UnFqdn(authZone), record)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"directadmin: delete record for zone %s and subdomain %s: %w\", authZone, subDomain, err)\n\t}\n\n\treturn nil\n}\n\nfunc (d *DNSProvider) getZoneName(fqdn string) (string, error) {\n\tif d.config.ZoneName != \"\" {\n\t\treturn d.config.ZoneName, nil\n\t}\n\n\tauthZone, err := dns01.FindZoneByFqdn(fqdn)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not find zone for %s: %w\", fqdn, err)\n\t}\n\n\tif authZone == \"\" {\n\t\treturn \"\", errors.New(\"empty zone name\")\n\t}\n\n\treturn authZone, nil\n}\n" }, { "path": "providers/dns/directadmin/directadmin.toml", "content": "Name = \"DirectAdmin\"\nDescription = ''''''\nURL = \"https://www.directadmin.com\"\nCode = \"directadmin\"\nSince = \"v4.18.0\"\n\nExample = '''\nDIRECTADMIN_API_URL=\"http://example.com:2222\" \\\nDIRECTADMIN_USERNAME=xxxx \\\nDIRECTADMIN_PASSWORD=yyy \\\nlego --dns directadmin -d '*.example.com' -d example.com run\n'''\n\n[Configuration]\n [Configuration.Credentials]\n DIRECTADMIN_API_URL = \"URL of the API\"\n DIRECTADMIN_USERNAME = \"API username\"\n DIRECTADMIN_PASSWORD = \"API password\"\n [Configuration.Additional]\n DIRECTADMIN_ZONE_NAME = \"Zone name used to add the TXT record\"\n DIRECTADMIN_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 5)\"\n DIRECTADMIN_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 60)\"\n DIRECTADMIN_TTL = \"The TTL of the TXT record used for the DNS challenge in seconds (Default: 30)\"\n DIRECTADMIN_HTTP_TIMEOUT = \"API request timeout in seconds (Default: 30)\"\n\n[Links]\n API = \"https://www.directadmin.com/api.php\"\n" }, { "path": "providers/dns/directadmin/directadmin_test.go", "content": "package directadmin\n\nimport (\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nconst envDomain = envNamespace + \"DOMAIN\"\n\nvar envTest = tester.NewEnvTest(EnvAPIURL, EnvUsername, EnvPassword).WithDomain(envDomain)\n\nfunc TestNewDNSProvider(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAPIURL: \"https://example.com:2222\",\n\t\t\t\tEnvUsername: \"test\",\n\t\t\t\tEnvPassword: \"secret\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\tenvVars: map[string]string{},\n\t\t\texpected: \"directadmin: some credentials information are missing: DIRECTADMIN_API_URL,DIRECTADMIN_USERNAME,DIRECTADMIN_PASSWORD\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing API URL\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvUsername: \"test\",\n\t\t\t\tEnvPassword: \"secret\",\n\t\t\t},\n\t\t\texpected: \"directadmin: some credentials information are missing: DIRECTADMIN_API_URL\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing username\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAPIURL: \"https://example.com:2222\",\n\t\t\t\tEnvPassword: \"secret\",\n\t\t\t},\n\t\t\texpected: \"directadmin: some credentials information are missing: DIRECTADMIN_USERNAME\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing password\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAPIURL: \"https://example.com:2222\",\n\t\t\t\tEnvUsername: \"test\",\n\t\t\t},\n\t\t\texpected: \"directadmin: some credentials information are missing: DIRECTADMIN_PASSWORD\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.client)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tbaseURL string\n\t\tusername string\n\t\tpassword string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tbaseURL: \"https://example.com\",\n\t\t\tusername: \"test\",\n\t\t\tpassword: \"secret\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing API URL\",\n\t\t\texpected: \"directadmin: missing API URL\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing username\",\n\t\t\tbaseURL: \"https://example.com\",\n\t\t\texpected: \"directadmin: some credentials information are missing\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing password\",\n\t\t\tbaseURL: \"https://example.com\",\n\t\t\tusername: \"test\",\n\t\t\texpected: \"directadmin: some credentials information are missing\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.BaseURL = test.baseURL\n\t\t\tconfig.Username = test.username\n\t\t\tconfig.Password = test.password\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.client)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestLivePresent(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.Present(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestLiveCleanUp(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.CleanUp(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/directadmin/internal/client.go", "content": "package internal\n\nimport (\n\t\"context\"\n\t\"encoding/json\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strings\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/errutils\"\n\tquerystring \"github.com/google/go-querystring/query\"\n)\n\n// Client the Direct Admin API client.\ntype Client struct {\n\tbaseURL *url.URL\n\tHTTPClient *http.Client\n\n\tusername string\n\tpassword string\n}\n\n// NewClient creates a new Client.\nfunc NewClient(baseURL, username, password string) (*Client, error) {\n\tapi, err := url.Parse(baseURL)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &Client{\n\t\tbaseURL: api,\n\t\tHTTPClient: &http.Client{Timeout: 10 * time.Second},\n\t\tusername: username,\n\t\tpassword: password,\n\t}, nil\n}\n\nfunc (c *Client) SetRecord(ctx context.Context, domain string, record Record) error {\n\tdata, err := querystring.Values(record)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdata.Set(\"action\", \"add\")\n\n\treturn c.do(ctx, domain, data)\n}\n\nfunc (c *Client) DeleteRecord(ctx context.Context, domain string, record Record) error {\n\tdata, err := querystring.Values(record)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdata.Set(\"action\", \"delete\")\n\n\treturn c.do(ctx, domain, data)\n}\n\nfunc (c *Client) do(ctx context.Context, domain string, data url.Values) error {\n\tendpoint := c.baseURL.JoinPath(\"CMD_API_DNS_CONTROL\")\n\n\tquery := endpoint.Query()\n\tquery.Set(\"domain\", domain)\n\tquery.Set(\"json\", \"yes\")\n\tendpoint.RawQuery = query.Encode()\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), strings.NewReader(data.Encode()))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create request: %w\", err)\n\t}\n\n\treq.SetBasicAuth(c.username, c.password)\n\treq.Header.Add(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\n\tresp, err := c.HTTPClient.Do(req)\n\tif err != nil {\n\t\treturn errutils.NewHTTPDoError(req, err)\n\t}\n\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn parseError(req, resp)\n\t}\n\n\treturn nil\n}\n\nfunc parseError(req *http.Request, resp *http.Response) error {\n\traw, _ := io.ReadAll(resp.Body)\n\n\tvar errInfo APIError\n\n\terr := json.Unmarshal(raw, &errInfo)\n\tif err != nil {\n\t\treturn errutils.NewUnexpectedStatusCodeError(req, resp.StatusCode, raw)\n\t}\n\n\treturn fmt.Errorf(\"[status code %d] %w\", resp.StatusCode, errInfo)\n}\n" }, { "path": "providers/dns/directadmin/internal/client_test.go", "content": "package internal\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc mockBuilder() *servermock.Builder[*Client] {\n\treturn servermock.NewBuilder[*Client](\n\t\tfunc(server *httptest.Server) (*Client, error) {\n\t\t\tclient, _ := NewClient(server.URL, \"user\", \"secret\")\n\t\t\tclient.HTTPClient = server.Client()\n\n\t\t\treturn client, nil\n\t\t},\n\t\tservermock.CheckHeader().\n\t\t\tWithContentTypeFromURLEncoded())\n}\n\nfunc newAPIError(reason string, a ...any) APIError {\n\treturn APIError{\n\t\tMessage: \"Cannot View Dns Record\",\n\t\tResult: fmt.Sprintf(reason, a...),\n\t}\n}\n\nfunc TestClient_SetRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /CMD_API_DNS_CONTROL\", nil,\n\t\t\tservermock.CheckQueryParameter().Strict().\n\t\t\t\tWith(\"domain\", \"example.com\").\n\t\t\t\tWith(\"json\", \"yes\"),\n\t\t\tservermock.CheckForm().UsePostForm().Strict().\n\t\t\t\tWith(\"action\", \"add\").\n\t\t\t\tWith(\"name\", \"foo\").\n\t\t\t\tWith(\"type\", \"TXT\").\n\t\t\t\tWith(\"value\", \"txtTXTtxt\").\n\t\t\t\tWith(\"ttl\", \"123\"),\n\t\t).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tName: \"foo\",\n\t\tType: \"TXT\",\n\t\tValue: \"txtTXTtxt\",\n\t\tTTL: 123,\n\t}\n\n\terr := client.SetRecord(t.Context(), \"example.com\", record)\n\trequire.NoError(t, err)\n}\n\nfunc TestClient_SetRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /CMD_API_DNS_CONTROL\",\n\t\t\tservermock.JSONEncode(newAPIError(\"OOPS\")).\n\t\t\t\tWithStatusCode(http.StatusInternalServerError)).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tName: \"foo\",\n\t\tType: \"TXT\",\n\t\tValue: \"txtTXTtxt\",\n\t\tTTL: 123,\n\t}\n\n\terr := client.SetRecord(t.Context(), \"example.com\", record)\n\trequire.EqualError(t, err, \"[status code 500] Cannot View Dns Record: OOPS\")\n}\n\nfunc TestClient_DeleteRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /CMD_API_DNS_CONTROL\", nil,\n\t\t\tservermock.CheckQueryParameter().Strict().\n\t\t\t\tWith(\"domain\", \"example.com\").\n\t\t\t\tWith(\"json\", \"yes\"),\n\t\t\tservermock.CheckForm().UsePostForm().Strict().\n\t\t\t\tWith(\"action\", \"delete\").\n\t\t\t\tWith(\"name\", \"foo\").\n\t\t\t\tWith(\"type\", \"TXT\").\n\t\t\t\tWith(\"value\", \"txtTXTtxt\"),\n\t\t).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tName: \"foo\",\n\t\tType: \"TXT\",\n\t\tValue: \"txtTXTtxt\",\n\t}\n\n\terr := client.DeleteRecord(t.Context(), \"example.com\", record)\n\trequire.NoError(t, err)\n}\n\nfunc TestClient_DeleteRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /CMD_API_DNS_CONTROL\",\n\t\t\tservermock.JSONEncode(newAPIError(\"OOPS\")).\n\t\t\t\tWithStatusCode(http.StatusInternalServerError)).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tName: \"foo\",\n\t\tType: \"TXT\",\n\t\tValue: \"txtTXTtxt\",\n\t}\n\n\terr := client.DeleteRecord(t.Context(), \"example.com\", record)\n\trequire.EqualError(t, err, \"[status code 500] Cannot View Dns Record: OOPS\")\n}\n" }, { "path": "providers/dns/directadmin/internal/types.go", "content": "package internal\n\nimport \"fmt\"\n\n// Record represents a DNS record.\ntype Record struct {\n\tName string `url:\"name,omitempty\"`\n\tType string `url:\"type,omitempty\"`\n\tValue string `url:\"value,omitempty\"`\n\tTTL int `url:\"ttl,omitempty\"`\n}\n\n// APIError represents a API error.\ntype APIError struct {\n\tMessage string `json:\"error,omitempty\"`\n\tResult string `json:\"result,omitempty\"`\n}\n\nfunc (a APIError) Error() string {\n\treturn fmt.Sprintf(\"%s: %s\", a.Message, a.Result)\n}\n" }, { "path": "providers/dns/dns_providers_test.go", "content": "package dns\n\nimport (\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/go-acme/lego/v4/providers/dns/exec\"\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nvar envTest = tester.NewEnvTest(\"EXEC_PATH\")\n\nfunc TestKnownDNSProviderSuccess(t *testing.T) {\n\tdefer envTest.RestoreEnv()\n\n\tenvTest.Apply(map[string]string{\n\t\t\"EXEC_PATH\": \"abc\",\n\t})\n\n\tprovider, err := NewDNSChallengeProviderByName(\"exec\")\n\trequire.NoError(t, err)\n\tassert.NotNil(t, provider)\n\n\tassert.IsType(t, &exec.DNSProvider{}, provider, \"The loaded DNS provider doesn't have the expected type.\")\n}\n\nfunc TestKnownDNSProviderError(t *testing.T) {\n\tdefer envTest.RestoreEnv()\n\n\tenvTest.ClearEnv()\n\n\tprovider, err := NewDNSChallengeProviderByName(\"exec\")\n\trequire.Error(t, err)\n\tassert.Nil(t, provider)\n}\n\nfunc TestUnknownDNSProvider(t *testing.T) {\n\tprovider, err := NewDNSChallengeProviderByName(\"foobar\")\n\trequire.Error(t, err)\n\tassert.Nil(t, provider)\n}\n" }, { "path": "providers/dns/dnsexit/dnsexit.go", "content": "// Package dnsexit implements a DNS provider for solving the DNS-01 challenge using DNSExit.\npackage dnsexit\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/go-acme/lego/v4/providers/dns/dnsexit/internal\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DNSEXIT_\"\n\n\tEnvAPIKey = envNamespace + \"API_KEY\"\n\n\tEnvTTL = envNamespace + \"TTL\"\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\tEnvHTTPTimeout = envNamespace + \"HTTP_TIMEOUT\"\n)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tAPIKey string\n\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tTTL int\n\tHTTPClient *http.Client\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tTTL: env.GetOrDefaultInt(EnvTTL, dns01.DefaultTTL),\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 5*time.Minute),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 10*time.Second),\n\t\tHTTPClient: &http.Client{\n\t\t\tTimeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),\n\t\t},\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tconfig *Config\n\tclient *internal.Client\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for DNSExit.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tvalues, err := env.Get(EnvAPIKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"dnsexit: %w\", err)\n\t}\n\n\tconfig := NewDefaultConfig()\n\tconfig.APIKey = values[EnvAPIKey]\n\n\treturn NewDNSProviderConfig(config)\n}\n\n// NewDNSProviderConfig return a DNSProvider instance configured for DNSExit.\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"dnsexit: the configuration of the DNS provider is nil\")\n\t}\n\n\tclient, err := internal.NewClient(config.APIKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"dnsexit: %w\", err)\n\t}\n\n\tif config.HTTPClient != nil {\n\t\tclient.HTTPClient = config.HTTPClient\n\t}\n\n\tclient.HTTPClient = clientdebug.Wrap(client.HTTPClient)\n\n\treturn &DNSProvider{\n\t\tconfig: config,\n\t\tclient: client,\n\t}, nil\n}\n\n// Present creates a TXT record using the specified parameters.\nfunc (d *DNSProvider) Present(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnsexit: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\tsubDomain, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnsexit: %w\", err)\n\t}\n\n\trecord := internal.Record{\n\t\tType: \"TXT\",\n\t\tName: subDomain,\n\t\tContent: info.Value,\n\t\tTTL: toMinutes(d.config.TTL),\n\t}\n\n\terr = d.client.AddRecord(context.Background(), dns01.UnFqdn(authZone), record)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnsexit: add record: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// CleanUp removes the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\tauthZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnsexit: could not find zone for domain %q: %w\", domain, err)\n\t}\n\n\tsubDomain, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnsexit: %w\", err)\n\t}\n\n\trecord := internal.Record{\n\t\tType: \"TXT\",\n\t\tName: subDomain,\n\t\tContent: info.Value,\n\t}\n\n\terr = d.client.DeleteRecord(context.Background(), dns01.UnFqdn(authZone), record)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnsexit: add record: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\nfunc toMinutes(seconds int) int {\n\ti := seconds / 60\n\tif seconds%60 > 0 {\n\t\ti++\n\t}\n\n\treturn i\n}\n" }, { "path": "providers/dns/dnsexit/dnsexit.toml", "content": "Name = \"DNSExit\"\nDescription = ''''''\nURL = \"https://dnsexit.com\"\nCode = \"dnsexit\"\nSince = \"v4.32.0\"\n\nExample = '''\nDNSEXIT_API_KEY=\"xxxxxxxxxxxxxxxxxxxxx\" \\\nlego --dns dnsexit -d '*.example.com' -d example.com run\n'''\n\n[Configuration]\n [Configuration.Credentials]\n DNSEXIT_API_KEY = \"API key\"\n [Configuration.Additional]\n DNSEXIT_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 10)\"\n DNSEXIT_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 300)\"\n DNSEXIT_TTL = \"The TTL of the TXT record used for the DNS challenge in seconds (Default: 120)\"\n DNSEXIT_HTTP_TIMEOUT = \"API request timeout in seconds (Default: 30)\"\n\n[Links]\n API = \"https://dnsexit.com/dns/dns-api/\"\n" }, { "path": "providers/dns/dnsexit/dnsexit_test.go", "content": "package dnsexit\n\nimport (\n\t\"net/http/httptest\"\n\t\"net/url\"\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nconst envDomain = envNamespace + \"DOMAIN\"\n\nvar envTest = tester.NewEnvTest(EnvAPIKey).WithDomain(envDomain)\n\nfunc TestNewDNSProvider(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvAPIKey: \"key\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\tenvVars: map[string]string{},\n\t\t\texpected: \"dnsexit: some credentials information are missing: DNSEXIT_API_KEY\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t\trequire.NotNil(t, p.client)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tapiKey string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tapiKey: \"key\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\texpected: \"dnsexit: credentials missing\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.APIKey = test.apiKey\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t\trequire.NotNil(t, p.client)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestLivePresent(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.Present(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestLiveCleanUp(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.CleanUp(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc mockBuilder() *servermock.Builder[*DNSProvider] {\n\treturn servermock.NewBuilder(\n\t\tfunc(server *httptest.Server) (*DNSProvider, error) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.APIKey = \"secret\"\n\t\t\tconfig.HTTPClient = server.Client()\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\n\t\t\tp.client.BaseURL, _ = url.Parse(server.URL)\n\n\t\t\treturn p, nil\n\t\t},\n\t\tservermock.CheckHeader().\n\t\t\tWithJSONHeaders().\n\t\t\tWith(\"apikey\", \"secret\"),\n\t)\n}\n\nfunc TestDNSProvider_Present(t *testing.T) {\n\tprovider := mockBuilder().\n\t\tRoute(\"POST /\",\n\t\t\tservermock.ResponseFromInternal(\"success.json\"),\n\t\t\tservermock.CheckRequestJSONBodyFromInternal(\"add_record-request.json\"),\n\t\t).\n\t\tBuild(t)\n\n\terr := provider.Present(\"example.com\", \"abc\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestDNSProvider_CleanUp(t *testing.T) {\n\tprovider := mockBuilder().\n\t\tRoute(\"POST /\",\n\t\t\tservermock.ResponseFromInternal(\"success.json\"),\n\t\t\tservermock.CheckRequestJSONBodyFromInternal(\"delete_record-request.json\"),\n\t\t).\n\t\tBuild(t)\n\n\terr := provider.CleanUp(\"example.com\", \"abc\", \"123d==\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/dnsexit/internal/client.go", "content": "package internal\n\nimport (\n\t\"bytes\"\n\t\"context\"\n\t\"encoding/json\"\n\t\"errors\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/errutils\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/useragent\"\n)\n\nconst defaultBaseURL = \"https://api.dnsexit.com/dns/\"\n\n// Client the DNSExit API client.\ntype Client struct {\n\tapiKey string\n\n\tBaseURL *url.URL\n\tHTTPClient *http.Client\n}\n\n// NewClient creates a new Client.\nfunc NewClient(apiKey string) (*Client, error) {\n\tif apiKey == \"\" {\n\t\treturn nil, errors.New(\"credentials missing\")\n\t}\n\n\tbaseURL, _ := url.Parse(defaultBaseURL)\n\n\treturn &Client{\n\t\tapiKey: apiKey,\n\t\tBaseURL: baseURL,\n\t\tHTTPClient: &http.Client{Timeout: 10 * time.Second},\n\t}, nil\n}\n\n// AddRecord adds a record.\n// https://dnsexit.com/dns/dns-api/#example-add-spf\n// https://dnsexit.com/dns/dns-api/#example-lse\nfunc (c *Client) AddRecord(ctx context.Context, domain string, record Record) error {\n\tpayload := APIRequest{\n\t\tDomain: domain,\n\t\tAdd: []Record{record},\n\t}\n\n\treq, err := newJSONRequest(ctx, http.MethodPost, c.BaseURL, payload)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = c.do(req)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// DeleteRecord deletes a record.\n// https://dnsexit.com/dns/dns-api/#delete-a-record\nfunc (c *Client) DeleteRecord(ctx context.Context, domain string, record Record) error {\n\tpayload := APIRequest{\n\t\tDomain: domain,\n\t\tDelete: []Record{record},\n\t}\n\n\treq, err := newJSONRequest(ctx, http.MethodPost, c.BaseURL, payload)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\terr = c.do(req)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc (c *Client) do(req *http.Request) error {\n\tuseragent.SetHeader(req.Header)\n\n\treq.Header.Set(\"apikey\", c.apiKey)\n\n\tresp, err := c.HTTPClient.Do(req)\n\tif err != nil {\n\t\treturn errutils.NewHTTPDoError(req, err)\n\t}\n\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode > http.StatusBadRequest {\n\t\treturn parseError(req, resp)\n\t}\n\n\traw, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn errutils.NewReadResponseError(req, resp.StatusCode, err)\n\t}\n\n\tresult := &APIResponse{}\n\n\terr = json.Unmarshal(raw, result)\n\tif err != nil {\n\t\treturn errutils.NewUnmarshalError(req, resp.StatusCode, raw, err)\n\t}\n\n\tif result.Code != 0 {\n\t\treturn result\n\t}\n\n\treturn nil\n}\n\nfunc newJSONRequest(ctx context.Context, method string, endpoint *url.URL, payload any) (*http.Request, error) {\n\tbuf := new(bytes.Buffer)\n\n\tif payload != nil {\n\t\terr := json.NewEncoder(buf).Encode(payload)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create request JSON body: %w\", err)\n\t\t}\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, method, endpoint.String(), buf)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create request: %w\", err)\n\t}\n\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\tif payload != nil {\n\t\treq.Header.Set(\"Content-Type\", \"application/json\")\n\t}\n\n\treturn req, nil\n}\n\nfunc parseError(req *http.Request, resp *http.Response) error {\n\traw, _ := io.ReadAll(resp.Body)\n\n\tvar errAPI APIResponse\n\n\terr := json.Unmarshal(raw, &errAPI)\n\tif err != nil {\n\t\treturn errutils.NewUnexpectedStatusCodeError(req, resp.StatusCode, raw)\n\t}\n\n\treturn &errAPI\n}\n" }, { "path": "providers/dns/dnsexit/internal/client_test.go", "content": "package internal\n\nimport (\n\t\"context\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"net/url\"\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc mockBuilder() *servermock.Builder[*Client] {\n\treturn servermock.NewBuilder(\n\t\tfunc(server *httptest.Server) (*Client, error) {\n\t\t\tclient, err := NewClient(\"secret\")\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\n\t\t\tclient.HTTPClient = server.Client()\n\t\t\tclient.BaseURL, _ = url.Parse(server.URL)\n\n\t\t\treturn client, nil\n\t\t},\n\t\tservermock.CheckHeader().\n\t\t\tWithJSONHeaders().\n\t\t\tWith(\"apikey\", \"secret\"),\n\t)\n}\n\nfunc TestClient_AddRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /\",\n\t\t\tservermock.ResponseFromFixture(\"success.json\"),\n\t\t\tservermock.CheckRequestJSONBodyFromFixture(\"add_record-request.json\"),\n\t\t).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tType: \"TXT\",\n\t\tName: \"_acme-challenge\",\n\t\tContent: \"ADw2sEd82DUgXcQ9hNBZThJs7zVJkR5v9JeSbAb9mZY\",\n\t\tTTL: 2,\n\t}\n\n\terr := client.AddRecord(context.Background(), \"example.com\", record)\n\trequire.NoError(t, err)\n}\n\nfunc TestClient_AddRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusBadRequest),\n\t\t).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tType: \"TXT\",\n\t\tName: \"_acme-challenge\",\n\t\tContent: \"ADw2sEd82DUgXcQ9hNBZThJs7zVJkR5v9JeSbAb9mZY\",\n\t\tTTL: 480,\n\t\tOverwrite: true,\n\t}\n\n\terr := client.AddRecord(context.Background(), \"example.com\", record)\n\trequire.Error(t, err)\n\n\trequire.EqualError(t, err, \"JSON Defined Record Type not Supported (code=6)\")\n}\n\nfunc TestClient_DeleteRecord(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /\",\n\t\t\tservermock.ResponseFromFixture(\"success.json\"),\n\t\t\tservermock.CheckRequestJSONBodyFromFixture(\"delete_record-request.json\"),\n\t\t).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tType: \"TXT\",\n\t\tName: \"_acme-challenge\",\n\t\tContent: \"ADw2sEd82DUgXcQ9hNBZThJs7zVJkR5v9JeSbAb9mZY\",\n\t}\n\n\terr := client.DeleteRecord(context.Background(), \"example.com\", record)\n\trequire.NoError(t, err)\n}\n\nfunc TestClient_DeleteRecord_error(t *testing.T) {\n\tclient := mockBuilder().\n\t\tRoute(\"POST /\",\n\t\t\tservermock.ResponseFromFixture(\"error.json\").\n\t\t\t\tWithStatusCode(http.StatusBadRequest),\n\t\t).\n\t\tBuild(t)\n\n\trecord := Record{\n\t\tType: \"TXT\",\n\t\tName: \"foo\",\n\t\tContent: \"txtTXTtxt\",\n\t}\n\n\terr := client.DeleteRecord(context.Background(), \"example.com\", record)\n\n\trequire.Error(t, err)\n\n\trequire.EqualError(t, err, \"JSON Defined Record Type not Supported (code=6)\")\n}\n" }, { "path": "providers/dns/dnsexit/internal/fixtures/add_record-request.json", "content": "{\n \"domain\": \"example.com\",\n \"add\": [\n {\n \"type\": \"TXT\",\n \"name\": \"_acme-challenge\",\n \"content\": \"ADw2sEd82DUgXcQ9hNBZThJs7zVJkR5v9JeSbAb9mZY\",\n \"ttl\": 2\n }\n ]\n}\n" }, { "path": "providers/dns/dnsexit/internal/fixtures/delete_record-request.json", "content": "{\n \"domain\": \"example.com\",\n \"delete\": [\n {\n \"type\": \"TXT\",\n \"name\": \"_acme-challenge\",\n \"content\": \"ADw2sEd82DUgXcQ9hNBZThJs7zVJkR5v9JeSbAb9mZY\"\n }\n ]\n}\n" }, { "path": "providers/dns/dnsexit/internal/fixtures/error.json", "content": "{\n \"code\": 6,\n \"message\": \"JSON Defined Record Type not Supported\"\n}\n" }, { "path": "providers/dns/dnsexit/internal/fixtures/success.json", "content": "{\n \"code\": 0,\n \"details\": [\n \"UPDATE Record A example.com. TTL(hh:mm) 08:00 IP 1.1.1.10\"\n ],\n \"message\": \"Success\"\n}\n" }, { "path": "providers/dns/dnsexit/internal/types.go", "content": "package internal\n\nimport (\n\t\"fmt\"\n\t\"strings\"\n)\n\ntype Record struct {\n\tType string `json:\"type,omitempty\"`\n\tName string `json:\"name,omitempty\"`\n\tContent string `json:\"content,omitempty\"`\n\tTTL int `json:\"ttl,omitempty\"` // NOTE: ttl value is in minutes.\n\tOverwrite bool `json:\"overwrite,omitempty\"`\n}\n\ntype APIRequest struct {\n\tDomain string `json:\"domain,omitempty\"`\n\tAdd []Record `json:\"add,omitempty\"`\n\tDelete []Record `json:\"delete,omitempty\"`\n\tUpdate []Record `json:\"update,omitempty\"`\n}\n\n// https://dnsexit.com/dns/dns-api/#server-reply\n\ntype APIResponse struct {\n\tCode int `json:\"code,omitempty\"`\n\tDetails []string `json:\"details,omitempty\"`\n\tMessage string `json:\"message,omitempty\"`\n}\n\nfunc (a APIResponse) Error() string {\n\tmsg := new(strings.Builder)\n\n\t_, _ = fmt.Fprintf(msg, \"%s (code=%d)\", a.Message, a.Code)\n\n\tfor _, detail := range a.Details {\n\t\t_, _ = fmt.Fprintf(msg, \", %s\", detail)\n\t}\n\n\treturn msg.String()\n}\n" }, { "path": "providers/dns/dnshomede/dnshomede.go", "content": "// Package dnshomede implements a DNS provider for solving the DNS-01 challenge using dnsHome.de.\npackage dnshomede\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/challenge/dns01\"\n\t\"github.com/go-acme/lego/v4/platform/config/env\"\n\t\"github.com/go-acme/lego/v4/providers/dns/dnshomede/internal\"\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug\"\n)\n\n// Environment variables names.\nconst (\n\tenvNamespace = \"DNSHOMEDE_\"\n\n\tEnvCredentials = envNamespace + \"CREDENTIALS\"\n\n\tEnvPropagationTimeout = envNamespace + \"PROPAGATION_TIMEOUT\"\n\tEnvPollingInterval = envNamespace + \"POLLING_INTERVAL\"\n\tEnvHTTPTimeout = envNamespace + \"HTTP_TIMEOUT\"\n\tEnvSequenceInterval = envNamespace + \"SEQUENCE_INTERVAL\"\n)\n\n// Config is used to configure the creation of the DNSProvider.\ntype Config struct {\n\tCredentials map[string]string\n\tPropagationTimeout time.Duration\n\tPollingInterval time.Duration\n\tSequenceInterval time.Duration\n\tHTTPClient *http.Client\n}\n\n// NewDefaultConfig returns a default configuration for the DNSProvider.\nfunc NewDefaultConfig() *Config {\n\treturn &Config{\n\t\tPropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 20*time.Minute),\n\t\tPollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, dns01.DefaultPollingInterval),\n\t\tSequenceInterval: env.GetOrDefaultSecond(EnvSequenceInterval, 2*time.Minute),\n\t\tHTTPClient: &http.Client{\n\t\t\tTimeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),\n\t\t},\n\t}\n}\n\n// DNSProvider implements the challenge.Provider interface.\ntype DNSProvider struct {\n\tconfig *Config\n\tclient *internal.Client\n}\n\n// NewDNSProvider returns a DNSProvider instance configured for dnsHome.de.\n// Credentials must be passed in the environment variable: DNSHOMEDE_CREDENTIALS.\nfunc NewDNSProvider() (*DNSProvider, error) {\n\tconfig := NewDefaultConfig()\n\n\tvalues, err := env.Get(EnvCredentials)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"dnshomede: %w\", err)\n\t}\n\n\tcredentials, err := env.ParsePairs(values[EnvCredentials])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"dnshomede: credentials: %w\", err)\n\t}\n\n\tconfig.Credentials = credentials\n\n\treturn NewDNSProviderConfig(config)\n}\n\nfunc NewDNSProviderConfig(config *Config) (*DNSProvider, error) {\n\tif config == nil {\n\t\treturn nil, errors.New(\"dnshomede: the configuration of the DNS provider is nil\")\n\t}\n\n\tif len(config.Credentials) == 0 {\n\t\treturn nil, errors.New(\"dnshomede: missing credentials\")\n\t}\n\n\tfor domain, password := range config.Credentials {\n\t\tif domain == \"\" {\n\t\t\treturn nil, fmt.Errorf(`dnshomede: missing domain: \"%s:%s\"`, domain, password)\n\t\t}\n\n\t\tif password == \"\" {\n\t\t\treturn nil, fmt.Errorf(`dnshomede: missing password: \"%s:%s\"`, domain, password)\n\t\t}\n\t}\n\n\tclient := internal.NewClient(config.Credentials)\n\n\tif config.HTTPClient != nil {\n\t\tclient.HTTPClient = config.HTTPClient\n\t}\n\n\tclient.HTTPClient = clientdebug.Wrap(client.HTTPClient)\n\n\treturn &DNSProvider{config: config, client: client}, nil\n}\n\n// Present updates a TXT record to fulfill the dns-01 challenge.\nfunc (d *DNSProvider) Present(domain, _, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\terr := d.client.Add(context.Background(), dns01.UnFqdn(info.EffectiveFQDN), info.Value)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnshomede: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// CleanUp updates the TXT record matching the specified parameters.\nfunc (d *DNSProvider) CleanUp(domain, _, keyAuth string) error {\n\tinfo := dns01.GetChallengeInfo(domain, keyAuth)\n\n\terr := d.client.Remove(context.Background(), dns01.UnFqdn(info.EffectiveFQDN), info.Value)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dnshomede: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// Timeout returns the timeout and interval to use when checking for DNS propagation.\n// Adjusting here to cope with spikes in propagation times.\nfunc (d *DNSProvider) Timeout() (timeout, interval time.Duration) {\n\treturn d.config.PropagationTimeout, d.config.PollingInterval\n}\n\n// Sequential All DNS challenges for this provider will be resolved sequentially.\n// Returns the interval between each iteration.\nfunc (d *DNSProvider) Sequential() time.Duration {\n\treturn d.config.SequenceInterval\n}\n" }, { "path": "providers/dns/dnshomede/dnshomede.toml", "content": "Name = \"dnsHome.de\"\nDescription = ''''''\nURL = \"https://www.dnshome.de\"\nCode = \"dnshomede\"\nSince = \"v4.10.0\"\n\nExample = '''\nDNSHOMEDE_CREDENTIALS=example.org:password \\\nlego --dns dnshomede -d '*.example.com' -d example.com run\n\nDNSHOMEDE_CREDENTIALS=my.example.org:password1,demo.example.org:password2 \\\nlego --dns dnshomede -d my.example.org -d demo.example.org\n'''\n\n[Configuration]\n [Configuration.Credentials]\n DNSHOMEDE_CREDENTIALS = \"Comma-separated list of domain:password credential pairs\"\n [Configuration.Additional]\n DNSHOMEDE_POLLING_INTERVAL = \"Time between DNS propagation check in seconds (Default: 1200)\"\n DNSHOMEDE_PROPAGATION_TIMEOUT = \"Maximum waiting time for DNS propagation in seconds (Default: 2)\"\n DNSHOMEDE_SEQUENCE_INTERVAL = \"Time between sequential requests in seconds (Default: 120)\"\n DNSHOMEDE_HTTP_TIMEOUT = \"API request timeout in seconds (Default: 30)\"\n" }, { "path": "providers/dns/dnshomede/dnshomede_test.go", "content": "package dnshomede\n\nimport (\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nconst envDomain = envNamespace + \"DOMAIN\"\n\nvar envTest = tester.NewEnvTest(EnvCredentials).WithDomain(envDomain)\n\nfunc TestNewDNSProvider(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tenvVars map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \"example.org:123\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"success multiple domains\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \"example.org:123,example.com:456,example.net:789\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"invalid credentials\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \",\",\n\t\t\t},\n\t\t\texpected: `dnshomede: credentials: incorrect pair: `,\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing password\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \"example.org:\",\n\t\t\t},\n\t\t\texpected: `dnshomede: missing password: \"example.org:\"`,\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing domain\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \":123\",\n\t\t\t},\n\t\t\texpected: `dnshomede: missing domain: \":123\"`,\n\t\t},\n\t\t{\n\t\t\tdesc: \"invalid credentials, partial\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \"example.org:123,example.net\",\n\t\t\t},\n\t\t\texpected: \"dnshomede: credentials: incorrect pair: example.net\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\tenvVars: map[string]string{\n\t\t\t\tEnvCredentials: \"\",\n\t\t\t},\n\t\t\texpected: \"dnshomede: some credentials information are missing: DNSHOMEDE_CREDENTIALS\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tdefer envTest.RestoreEnv()\n\n\t\t\tenvTest.ClearEnv()\n\n\t\t\tenvTest.Apply(test.envVars)\n\n\t\t\tp, err := NewDNSProvider()\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestNewDNSProviderConfig(t *testing.T) {\n\ttestCases := []struct {\n\t\tdesc string\n\t\tcreds map[string]string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"success\",\n\t\t\tcreds: map[string]string{\"example.org\": \"123\"},\n\t\t},\n\t\t{\n\t\t\tdesc: \"success multiple domains\",\n\t\t\tcreds: map[string]string{\n\t\t\t\t\"example.org\": \"123\",\n\t\t\t\t\"example.com\": \"456\",\n\t\t\t\t\"example.net\": \"789\",\n\t\t\t},\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing credentials\",\n\t\t\texpected: \"dnshomede: missing credentials\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing domain\",\n\t\t\tcreds: map[string]string{\"\": \"123\"},\n\t\t\texpected: `dnshomede: missing domain: \":123\"`,\n\t\t},\n\t\t{\n\t\t\tdesc: \"missing password\",\n\t\t\tcreds: map[string]string{\"example.org\": \"\"},\n\t\t\texpected: `dnshomede: missing password: \"example.org:\"`,\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tconfig := NewDefaultConfig()\n\t\t\tconfig.Credentials = test.creds\n\n\t\t\tp, err := NewDNSProviderConfig(config)\n\n\t\t\tif test.expected == \"\" {\n\t\t\t\trequire.NoError(t, err)\n\t\t\t\trequire.NotNil(t, p)\n\t\t\t\trequire.NotNil(t, p.config)\n\t\t\t} else {\n\t\t\t\trequire.EqualError(t, err, test.expected)\n\t\t\t}\n\t\t})\n\t}\n}\n\nfunc TestLivePresent(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.Present(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n\nfunc TestLiveCleanUp(t *testing.T) {\n\tif !envTest.IsLiveTest() {\n\t\tt.Skip(\"skipping live test\")\n\t}\n\n\tenvTest.RestoreEnv()\n\n\tprovider, err := NewDNSProvider()\n\trequire.NoError(t, err)\n\n\terr = provider.CleanUp(envTest.GetDomain(), \"\", \"123d==\")\n\trequire.NoError(t, err)\n}\n" }, { "path": "providers/dns/dnshomede/internal/client.go", "content": "package internal\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/go-acme/lego/v4/providers/dns/internal/errutils\"\n)\n\nconst (\n\tremoveAction = \"rm\"\n\taddAction = \"add\"\n)\n\nconst successCode = \"successfully\"\n\nconst defaultBaseURL = \"https://www.dnshome.de/dyndns.php\"\n\n// Client the dnsHome.de client.\ntype Client struct {\n\tbaseURL string\n\tHTTPClient *http.Client\n\n\tcredentials map[string]string\n\tcredMu sync.Mutex\n}\n\n// NewClient Creates a new Client.\nfunc NewClient(credentials map[string]string) *Client {\n\treturn &Client{\n\t\tHTTPClient: &http.Client{Timeout: 10 * time.Second},\n\t\tbaseURL: defaultBaseURL,\n\t\tcredentials: credentials,\n\t}\n}\n\n// Add adds a TXT record.\n// only one TXT record for ACME is allowed, so it will update the \"current\" TXT record.\nfunc (c *Client) Add(ctx context.Context, hostname, value string) error {\n\tdomain := strings.TrimPrefix(hostname, \"_acme-challenge.\")\n\n\treturn c.doAction(ctx, domain, addAction, value)\n}\n\n// Remove removes a TXT record.\n// only one TXT record for ACME is allowed, so it will remove \"all\" the TXT records.\nfunc (c *Client) Remove(ctx context.Context, hostname, value string) error {\n\tdomain := strings.TrimPrefix(hostname, \"_acme-challenge.\")\n\n\treturn c.doAction(ctx, domain, removeAction, value)\n}\n\nfunc (c *Client) doAction(ctx context.Context, domain, action, value string) error {\n\tendpoint, err := c.createEndpoint(domain, action, value)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), http.NoBody)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create request: %w\", err)\n\t}\n\n\tresp, err := c.HTTPClient.Do(req)\n\tif err != nil {\n\t\treturn errutils.NewHTTPDoError(req, err)\n\t}\n\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn errutils.NewUnexpectedResponseStatusCodeError(req, resp)\n\t}\n\n\traw, err := io.ReadAll(resp.Body)\n\tif err != nil {\n\t\treturn errutils.NewReadResponseError(req, resp.StatusCode, err)\n\t}\n\n\toutput := string(raw)\n\n\tif !strings.HasPrefix(output, successCode) {\n\t\treturn errors.New(output)\n\t}\n\n\treturn nil\n}\n\nfunc (c *Client) createEndpoint(domain, action, value string) (*url.URL, error) {\n\tif len(value) < 12 {\n\t\treturn nil, fmt.Errorf(\"the TXT value must have more than 12 characters: %s\", value)\n\t}\n\n\tendpoint, err := url.Parse(c.baseURL)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tc.credMu.Lock()\n\tpassword, ok := c.credentials[domain]\n\tc.credMu.Unlock()\n\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"domain %s not found in credentials, check your credentials map\", domain)\n\t}\n\n\tendpoint.User = url.UserPassword(domain, password)\n\n\tquery := endpoint.Query()\n\tquery.Set(\"acme\", action)\n\tquery.Set(\"txt\", value)\n\tendpoint.RawQuery = query.Encode()\n\n\treturn endpoint, nil\n}\n" }, { "path": "providers/dns/dnshomede/internal/client_test.go", "content": "package internal\n\nimport (\n\t\"fmt\"\n\t\"net/http/httptest\"\n\t\"testing\"\n\n\t\"github.com/go-acme/lego/v4/platform/tester/servermock\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc setupClient(credentials map[string]string) func(server *httptest.Server) (*Client, error) {\n\treturn func(server *httptest.Server) (*Client, error) {\n\t\tclient := NewClient(credentials)\n\t\tclient.HTTPClient = server.Client()\n\t\tclient.baseURL = server.URL\n\n\t\treturn client, nil\n\t}\n}\n\nfunc TestClient_Add(t *testing.T) {\n\ttxtValue := \"123456789012\"\n\n\tclient := servermock.NewBuilder[*Client](setupClient(map[string]string{\"example.org\": \"secret\"})).\n\t\tRoute(\"POST /\",\n\t\t\tservermock.RawStringResponse(fmt.Sprintf(\"%s %s\", successCode, txtValue)),\n\t\t\tservermock.CheckQueryParameter().Strict().\n\t\t\t\tWith(\"acme\", addAction).With(\"txt\", txtValue)).\n\t\tBuild(t)\n\n\terr := client.Add(t.Context(), \"example.org\", txtValue)\n\trequire.NoError(t, err)\n}\n\nfunc TestClient_Add_error(t *testing.T) {\n\ttxtValue := \"123456789012\"\n\n\tclient := servermock.NewBuilder[*Client](setupClient(map[string]string{\"example.com\": \"secret\"})).\n\t\tRoute(\"POST /\",\n\t\t\tservermock.RawStringResponse(fmt.Sprintf(\"%s %s\", successCode, txtValue)),\n\t\t\tservermock.CheckQueryParameter().Strict().\n\t\t\t\tWith(\"acme\", addAction).With(\"txt\", txtValue)).\n\t\tBuild(t)\n\n\terr := client.Add(t.Context(), \"example.org\", txtValue)\n\n\trequire.EqualError(t, err, \"domain example.org not found in credentials, check your credentials map\")\n}\n\nfunc TestClient_Remove(t *testing.T) {\n\ttxtValue := \"ABCDEFGHIJKL\"\n\n\tclient := servermock.NewBuilder[*Client](setupClient(map[string]string{\"example.org\": \"secret\"})).\n\t\tRoute(\"POST /\",\n\t\t\tservermock.RawStringResponse(fmt.Sprintf(\"%s %s\", successCode, txtValue)),\n\t\t\tservermock.CheckQueryParameter().Strict().\n\t\t\t\tWith(\"acme\", removeAction).With(\"txt\", txtValue)).\n\t\tBuild(t)\n\n\terr := client.Remove(t.Context(), \"example.org\", txtValue)\n\trequire.NoError(t, err)\n}\n\nfunc TestClient_Remove_error(t *testing.T) {\n\ttxtValue := \"ABCDEFGHIJKL\"\n\n\ttestCases := []struct {\n\t\tdesc string\n\t\thostname string\n\t\tresponse string\n\t\texpected string\n\t}{\n\t\t{\n\t\t\tdesc: \"response error - txt\",\n\t\t\thostname: \"example.com\",\n\t\t\tresponse: \"error - no valid acme txt record\",\n\t\t\texpected: \"error - no valid acme txt record\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"response error - acme\",\n\t\t\thostname: \"example.com\",\n\t\t\tresponse: \"nochg 1234:1234:1234:1234:1234:1234:1234:1234\",\n\t\t\texpected: \"nochg 1234:1234:1234:1234:1234:1234:1234:1234\",\n\t\t},\n\t\t{\n\t\t\tdesc: \"credential error\",\n\t\t\thostname: \"example.org\",\n\t\t\tresponse: fmt.Sprintf(\"%s %s\", successCode, txtValue),\n\t\t\texpected: \"domain example.org not found in credentials, check your credentials map\",\n\t\t},\n\t}\n\n\tfor _, test := range testCases {\n\t\tt.Run(test.desc, func(t *testing.T) {\n\t\t\tt.Parallel()\n\n\t\t\tclient := servermock.NewBuilder[*Client](setupClient(map[string]string{\"example.com\": \"secret\"})).\n\t\t\t\tRoute(\"POST /\",\n\t\t\t\t\tservermock.RawStringResponse(test.response),\n\t\t\t\t\tservermock.CheckQueryParameter().Strict().\n\t\t\t\t\t\tWith(\"acme\", removeAction).With(\"txt\", txtValue)).\n\t\t\t\tBuild(t)\n\n\t\t\terr := client.Remove(t.Context(), test.hostname, txtValue)\n\t\t\trequire.EqualError(t, err, test.expected)\n\t\t})\n\t}\n}\n" }, { "path": "providers/dns/dnshomede/internal/readme.md", "content": "# dnshome.de API\n\n## Add TXT record\n\n```\nhttps://AuthFailed\n AuthFailed\n