Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Webhook challenges #74

Merged
merged 7 commits into from
Sep 10, 2024
Merged

Webhook challenges #74

merged 7 commits into from
Sep 10, 2024

Conversation

johanot
Copy link
Collaborator

@johanot johanot commented Jun 7, 2024

Motivation

This is how I mostly use Faythe today, but I'm tired of maintaining my own fork :)

The change

Extracted the nsupdate exec code and allowed for implementation of other "ChallengeDriver"'s. Then, implemented a webhook challenge driver that sends either a PUT or DELETE-request with payload like:

{
  "records": {
    "_acme-challenge.example.org": {
      "type": "TXT",
      "content": "wGd5vRc5-V6XMgQhjiQ5W5nRk8TldjvK3oJmcx8YZ3Q"
    }
  }
}

Breaking current config

Using the existing nsupdate-driver, configuration has to be changed from:

"zones": {
  "example.com": {
    "server": "ns.example.com",
    "key": "acme.example.com.key"
  }
}

to:

"zones": {
  "example.com": {
    "auth_dns_server": "ns.example.com",
    "challenge_driver": {
      "nsupdate": {
        "server": "ns.example.com",
        "key": "acme.example.com.key"
      }
    }
  }
}

Note that the authoritative dns server is no longer assumed to be the same endpoint to hit with nsupdate.

Future improvements

  • Write integration tests for this repo, including a dummy webhook receiver
  • Implement authentication, e.g. Bearer token or Client cert auth. In my setup, I run Faythe and my receiver on loopback, but if you use this over the internet, you should definitely not let Faythe modify your DNS-zones anonymously.

@cafkafk
Copy link
Member

cafkafk commented Jul 8, 2024

btw, we have seen this PR and made a story for it internally, we're just hit by a lot of vacation... :p

flake.nix Outdated Show resolved Hide resolved
src/common.rs Outdated Show resolved Hide resolved
src/dns/mod.rs Outdated Show resolved Hide resolved
src/dns/mod.rs Outdated Show resolved Hide resolved
src/dns/mod.rs Outdated Show resolved Hide resolved
src/dns/nsupdate.rs Outdated Show resolved Hide resolved
src/dns/nsupdate.rs Outdated Show resolved Hide resolved
src/dns/webhook.rs Show resolved Hide resolved
src/dns/webhook.rs Outdated Show resolved Hide resolved
src/dns/webhook.rs Outdated Show resolved Hide resolved
@johanot
Copy link
Collaborator Author

johanot commented Aug 22, 2024

Forgot/missed this review during my vacation. :P Thanks for it!

I basically agree with everything mentioned. See 46acd6d .. I can prettify the git history if/when you want.

Copy link
Member

@cafkafk cafkafk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems tests broke, this should fix it

.github/workflows/build.yml Outdated Show resolved Hide resolved
@johanot
Copy link
Collaborator Author

johanot commented Sep 6, 2024

Rebased with main and refactored to get the vault-test spinning :) The CI should run green now, once it is green-lighted to start running 🤞

@cafkafk cafkafk merged commit 32ad666 into DBCDK:main Sep 10, 2024
1 check passed
@johanot johanot deleted the webhook-challenges branch September 10, 2024 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants