tls/acme: Add support for DNS-01 domain delegation

See #588.
foxcpp · May 29, 2023 · de756c8 · de756c8
1 parent 6d5cd3b
commit de756c8
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 11 deletions.
diff --git a/docs/reference/tls-acme.md b/docs/reference/tls-acme.md
@@ -20,7 +20,13 @@ smtp tcp://127.0.0.1:25 {
 You can also use a global `tls` directive to use automatically
 obtained certificates for all endpoints:
 ```
-tls &local_tls
+tls {
+    loader acme {
+        email maddy-acme@example.org
+        agreed
+        challenge dns-01
+    }
+}
 ```
 
 Currently the only supported challenge is dns-01 one therefore
@@ -87,6 +93,15 @@ back to the one configured via 'ca' option.
 
 This avoids rate limit issues with production CA.
 
+**Syntax:** override\_domain _domain_ <br>
+**Default:** not set
+
+Override the domain to set the TXT record on for DNS-01 challenge.
+This is to delegate the challenge to a different domain.
+
+See https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation
+for explanation why this might be useful.
+
 **Syntax:** email _str_ <br>
 **Default:** not set
 

diff --git a/internal/tls/acme/acme.go b/internal/tls/acme/acme.go
@@ -39,15 +39,16 @@ func New(_, instName string, _, inlineArgs []string) (module.Module, error) {
 
 func (l *Loader) Init(cfg *config.Map) error {
 	var (
-		hostname   string
-		extraNames []string
-		storePath  string
-		caPath     string
-		testCAPath string
-		email      string
-		agreed     bool
-		challenge  string
-		provider   certmagic.ACMEDNSProvider
+		hostname       string
+		extraNames     []string
+		storePath      string
+		caPath         string
+		testCAPath     string
+		email          string
+		agreed         bool
+		challenge      string
+		overrideDomain string
+		provider       certmagic.ACMEDNSProvider
 	)
 	cfg.Bool("debug", true, false, &l.log.Debug)
 	cfg.String("hostname", true, true, "", &hostname)
@@ -60,6 +61,8 @@ func (l *Loader) Init(cfg *config.Map) error {
 		certmagic.LetsEncryptStagingCA, &testCAPath)
 	cfg.String("email", false, false,
 		"", &email)
+	cfg.String("override_domain", false, false,
+		"", &overrideDomain)
 	cfg.Bool("agreed", false, false, &agreed)
 	cfg.Enum("challenge", false, true,
 		[]string{"dns-01"}, "dns-01", &challenge)
@@ -107,7 +110,8 @@ func (l *Loader) Init(cfg *config.Map) error {
 			return fmt.Errorf("tls.loader.acme: dns-01 challenge requires a configured DNS provider")
 		}
 		mngr.DNS01Solver = &certmagic.DNS01Solver{
-			DNSProvider: provider,
+			DNSProvider:    provider,
+			OverrideDomain: overrideDomain,
 		}
 	default:
 		return fmt.Errorf("tls.loader.acme: challenge not supported")