src/PVE/ACME/DNSChallenge.pm

   1 package PVE::ACME::DNSChallenge;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Digest::SHA qw(sha256);
   7 use PVE::Tools;
   8
   9 use PVE::ACME;
  10
  11 use base qw(PVE::ACME::Challenge);
  12
  13 my $ACME_PATH = '/usr/share/proxmox-acme/proxmox-acme';
  14
  15 sub supported_challenge_types {
  16     return ["dns-01"];
  17 }
  18
  19 sub type {
  20     return 'dns';
  21 }
  22
  23 # describe the data schema of the supported plugins, e.g.:
  24 #    'dnsprovider' => {
  25 #       name => 'Full name of Plugin',
  26 #       fields => {
  27 #           'FOO_API_KEY' => {
  28 #               description => "The API key",
  29 #               default => "none",
  30 #               optional => 1,
  31 #               type => 'string',
  32 #           },
  33 #           # ...
  34 #       },
  35 #    },
  36 my $plugins = {
  37     '1984hosting' => {},
  38     'acmedns' => {
  39         name => 'acme-dns',
  40         fields => {
  41             'ACMEDNS_UPDATE_URL' => {
  42                 description => 'The API update endpoint',
  43                 type => 'string',
  44             },
  45             'ACMEDNS_USERNAME' => {
  46                 description => 'The acme-dns user',
  47                 type => 'string',
  48             },
  49             'ACMEDNS_PASSWORD' => {
  50                 description => 'The acme-dns password',
  51                 type => 'string',
  52             },
  53             'ACMEDNS_SUBDOMAIN' => {
  54                 description => 'The subdomain you got from acme-dns registration',
  55                 type => 'string',
  56             },
  57         },
  58     },
  59     'acmeproxy' => {},
  60     'active24' => {
  61         name => 'Active24',
  62         fields => {
  63             'ACTIVE24_Token' => {
  64                 description => "The API key",
  65                 type => 'string',
  66             },
  67         },
  68     },
  69     'ad' => {
  70         name => 'Alwaysdata',
  71         fields => {
  72             'AD_API_KEY' => {
  73                 description => "The API key",
  74                 type => 'string',
  75             },
  76         },
  77     },
  78     'ali' => {
  79         name => 'Alibaba Cloud DNS',
  80         fields => {
  81             'Ali_API' => {
  82                 description => 'The API endpoint',
  83                 default => "https://alidns.aliyuncs.com/",
  84                 type => 'string',
  85                 optional => 1,
  86             },
  87             'Ali_Key' => {
  88                 description => 'The API Key',
  89                 type => 'string',
  90             },
  91             'Ali_Secret' => {
  92                 description => 'The API Secret',
  93                 type => 'string',
  94             },
  95         },
  96     },
  97     'anx' => {},
  98     'arvan' => {},
  99     'aurora' => {
 100         name => 'AuroraDNS',
 101         fields => {
 102             'AURORA_Key' => {
 103                 description => 'The API Key',
 104                 type => 'string',
 105             },
 106             'AURORA_Secret' => {
 107                 description => 'The API Secret',
 108                 type => 'string',
 109             },
 110         },
 111     },
 112     'autodns' => {},
 113     'aws' => {
 114         name => 'Amazon Route53 (AWS)',
 115         fields => {
 116             'AWS_ACCESS_KEY_ID' => {
 117                 name => 'ACCESS_KEY_ID',
 118                 description => 'The AWS access-key ID',
 119                 type => 'string',
 120             },
 121             'AWS_SECRET_ACCESS_KEY' => {
 122                 name => 'SECRET_ACCESS_KEY',
 123                 description => 'The AWS access-key secret',
 124                 type => 'string',
 125             },
 126         },
 127     },
 128     'azure' => {},
 129     'cf' => {
 130         name => 'Cloudflare Managed DNS',
 131         description => 'Either provide global account key and email, or CF API token and Account ID.',
 132         fields => {
 133             'CF_Key' => {
 134                 description => 'The Cloudflare Global API Key',
 135                 type => 'string',
 136             },
 137             'CF_Email' => {
 138                 description => 'The Cloudflare Account EMail-Address',
 139                 type => 'string',
 140             },
 141             'CF_Token' => {
 142                 description => 'The new Cloudflare API Token',
 143                 type => 'string',
 144             },
 145             'CF_Account_ID' => {
 146                 description => 'The new Cloudflare API Account ID',
 147                 type => 'string',
 148             },
 149             'CF_Zone_ID' => {
 150                 description => 'For Zone restricted API Token',
 151                 type => 'string',
 152             },
 153         },
 154     },
 155     'clouddns' => {},
 156     'cloudns' => {},
 157     'cn' => {},
 158     'conoha' => {},
 159     'constellix' => {},
 160     'cx' => {},
 161     'cyon' => {},
 162     'da' => {},
 163     'ddnss' => {},
 164     'desec' => {},
 165     'df' => {},
 166     'dgon' => {
 167         name => 'DigitalOcean DNS',
 168         fields => {
 169             'DO_API_KEY' => {
 170                 description => 'The DigitalOcean API Key',
 171                 type => 'string',
 172             },
 173         },
 174     },
 175     'dnsimple' => {},
 176     'do' => {},
 177     'doapi' => {},
 178     'domeneshop' => {},
 179     'dp' => {},
 180     'dpi' => {},
 181     'dreamhost' => {},
 182     'duckdns' => {},
 183     'durabledns' => {},
 184     'dyn' => {},
 185     'dynu' => {},
 186     'dynv6' => {},
 187     'easydns' => {},
 188     'edgedns' => {},
 189     'euserv' => {},
 190     'exoscale' => {},
 191     'freedns' => {},
 192     'gandi_livedns' => {},
 193     'gcloud' => {},
 194     'gd' => {
 195         name => 'GoDaddy',
 196         fields => {
 197             'GD_Key' => {
 198                 description => 'The GoDaddy API Key',
 199                 type => 'string',
 200             },
 201             'GD_Secret' => {
 202                 description => 'The GoDaddy API Secret',
 203                 type => 'string',
 204             },
 205         },
 206     },
 207     'gdnsdk' => {},
 208     'he' => {},
 209     'hetzner' => {},
 210     'hexonet' => {},
 211     'hostingde' => {},
 212     'huaweicloud' => {},
 213     'infoblox' => {},
 214     'infomaniak' => {},
 215     'internetbs' => {},
 216     'inwx' => {
 217         name => 'INWX',
 218         fields => {
 219             'INWX_User' => {
 220                 description => 'The INWX username',
 221                 type => 'string',
 222             },
 223             'INWX_Password' => {
 224                 description => 'The INWX password',
 225                 type => 'string',
 226             },
 227         },
 228     },
 229     'ionos' => {},
 230     'ispconfig' => {},
 231     'jd' => {},
 232     'joker' => {},
 233     'kappernet' => {
 234         name => 'kapper.net',
 235         fields => {
 236             'KAPPERNETDNS_Key' => {
 237                 description => 'Your kapper.net API key',
 238                 type => 'string',
 239             },
 240             'KAPPERNETDNS_Secret' => {
 241                 description => 'Your kapper.net API secret',
 242                 type => 'string',
 243             },
 244         },
 245     },
 246     'kas' => {},
 247     'kinghost' => {},
 248     'knot' => {},
 249     'leaseweb' => {},
 250     'lexicon' => {},
 251     'linode' => {},
 252     'linode_v4' => {},
 253     'loopia' => {},
 254     'lua' => {},
 255     'maradns' => {},
 256     'me' => {},
 257     'miab' => {},
 258     'misaka' => {},
 259     'myapi' => {},
 260     'mydevil' => {},
 261     'mydnsjp' => {},
 262     'namecheap' => {},
 263     'namecom' => {},
 264     'namesilo' => {},
 265     'nederhost' => {},
 266     'neodigit' => {},
 267     'netcup' => {},
 268     'netlify' => {},
 269     'nic' => {},
 270     'njalla' => {},
 271     'nm' => {},
 272     'nsd' => {},
 273     'nsone' => {},
 274     'nsupdate' => {},
 275     'nw' => {},
 276     'one' => {},
 277     'online' => {},
 278     'openprovider' => {},
 279     'openstack' => {},
 280     'opnsense' => {},
 281     'ovh' => {
 282         name => 'OVH',
 283         fields => {
 284             'OVH_END_POINT' => {
 285                 description => "The OVH endpoint",
 286                 default => "ovh-eu",
 287                 optional => 1,
 288                 type => 'string',
 289             },
 290             'OVH_AK' => {
 291                 description => "The application key.",
 292                 type => 'string',
 293             },
 294             'OVH_AS' => {
 295                 description => "The application secret.",
 296                 type => 'string',
 297             },
 298             'OVH_CK' => {
 299                 description => "The consumer key.",
 300                 optional => 1,
 301                 type => 'string',
 302             },
 303         },
 304     },
 305     'pdns' => {
 306         name => 'PowerDNS server',
 307         fields => {
 308             'PDNS_Url' => {
 309                 description => "The PowerDNS API endpoint.",
 310                 type => 'string',
 311             },
 312             'PDNS_ServerId'=> {
 313                 type => 'string',
 314             },
 315             'PDNS_Token'=> {
 316                 type => 'string',
 317             },
 318             'PDNS_Ttl'=> {
 319                 type => 'integer',
 320             },
 321         },
 322     },
 323     'pleskxml' => {},
 324     'pointhq' => {},
 325     'porkbun' => {
 326         name => 'Porkbun',
 327         fields => {
 328             'PORKBUN_API_KEY' => {
 329                 description => 'The API Key',
 330                 type => 'string',
 331             },
 332             'PORKBUN_SECRET_API_KEY' => {
 333                 description => 'The API Secret',
 334                 type => 'string',
 335             },
 336         },
 337     },
 338     'rackcorp' => {},
 339     'rackspace' => {},
 340     'rcode0' => {},
 341     'regru' => {},
 342     'scaleway' => {},
 343     'schlundtech' => {},
 344     'selectel' => {},
 345     'servercow' => {},
 346     'simply' => {},
 347     'tele3' => {},
 348     'transip' => {},
 349     'ultra' => {},
 350     'unoeuro' => {},
 351     'variomedia' => {},
 352     'vscale' => {},
 353     'vultr' => {},
 354     'world4you' => {},
 355     'websupport' => {},
 356     'yandex' => {},
 357     'zilore' => {},
 358     'zone' => {},
 359     'zonomi' => {},
 360 };
 361
 362 sub get_supported_plugins {
 363     return $plugins;
 364 }
 365
 366 sub properties {
 367     return {
 368         api => {
 369             description => "API plugin name",
 370             type => 'string',
 371             enum => [sort keys %$plugins],
 372         },
 373         data => {
 374             type => 'string',
 375             description => 'DNS plugin data. (base64 encoded)',
 376         },
 377         'validation-delay' => {
 378             type => 'integer',
 379             description => 'Extra delay in seconds to wait before requesting validation.'
 380                 .' Allows to cope with a long TTL of DNS records.',
 381             # low default, but our bet is that the acme-challenge domain isn't
 382             # cached at all, so it hopefully shouldn't run into TTL issues
 383             default => 30,
 384             optional => 1,
 385             minimum => 0,
 386             maximum => 2 * 24 * 60 * 60,
 387         }
 388     };
 389 }
 390
 391 sub options {
 392     return {
 393         api => {},
 394         data => { optional => 1 },
 395         nodes => { optional => 1 },
 396         disable => { optional => 1 },
 397         'validation-delay' => { optional => 1 },
 398     };
 399 }
 400
 401 my $proxmox_acme_command = sub {
 402     my ($self, $acme, $auth, $data, $action) = @_;
 403
 404     die "No plugin data for DNSChallenge\n" if !defined($data->{plugin});
 405
 406     my $alias = $data->{alias};
 407     my $domain = $auth->{identifier}->{value};
 408
 409     my $challenge = $self->extract_challenge($auth->{challenges});
 410     my $key_auth = $acme->key_authorization($challenge->{token});
 411
 412     my $txtvalue = PVE::ACME::encode(sha256($key_auth));
 413     my $dnsplugin = $data->{plugin}->{api};
 414     my $plugin_conf_string = $data->{plugin}->{data};
 415
 416     # for security reasons, we execute the command as nobody
 417     # we can't verify that the code of the DNSPlugins are harmless.
 418     my $cmd = ["setpriv", "--reuid", "nobody", "--regid", "nogroup", "--clear-groups", "--reset-env", "--"];
 419
 420     # The order of the parameters passed to proxmox-acme is important
 421     # proxmox-acme <setup|teardown> $plugin <$domain|$alias> $txtvalue [$plugin_conf_string]
 422     push @$cmd, "/bin/bash", $ACME_PATH, $action, $dnsplugin;
 423     if ($alias) {
 424         push @$cmd, $alias;
 425     } else {
 426         push @$cmd, $domain;
 427     }
 428     my $input = "$txtvalue\n";
 429     $input .= "$plugin_conf_string\n" if $plugin_conf_string;
 430
 431     PVE::Tools::run_command($cmd, input => $input);
 432
 433     $data->{url} = $challenge->{url};
 434
 435     return $domain;
 436 };
 437
 438 sub setup {
 439     my ($self, $acme, $auth, $data) = @_;
 440
 441     my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'setup');
 442     print "Add TXT record: _acme-challenge.$domain\n";
 443
 444     my $delay = $data->{plugin}->{'validation-delay'} // 30;
 445     if ($delay > 0) {
 446         print "Sleeping $delay seconds to wait for TXT record propagation\n";
 447         sleep($delay); # don't care for EINTR
 448     }
 449 }
 450
 451 sub teardown {
 452     my ($self, $acme, $auth, $data) = @_;
 453
 454     my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'teardown');
 455     print "Remove TXT record: _acme-challenge.$domain\n";
 456 }
 457
 458 1;