From 2d3ac3d4d99ff3edc22e8fe5806869a48d226149 Mon Sep 17 00:00:00 2001 From: Adrien Poupa Date: Sun, 26 Mar 2023 17:26:15 -0400 Subject: [PATCH] feat: make DNS provider configurable --- .env.example | 1 + README.md | 43 ++++++++++++++++++++++++------------------- docker-compose.yml | 2 +- 3 files changed, 26 insertions(+), 20 deletions(-) diff --git a/.env.example b/.env.example index 3906467..4ece765 100644 --- a/.env.example +++ b/.env.example @@ -11,6 +11,7 @@ PIA_PASS= PIA_LOCAL_NETWORK="192.168.0.0/16" HOSTNAME= ADGUARD_HOSTNAME= +DNS_CHALLENGE_PROVIDER=cloudflare LETS_ENCRYPT_EMAIL= CLOUDFLARE_EMAIL= CLOUDFLARE_DNS_API_TOKEN= diff --git a/README.md b/README.md index 2d3bd70..a34c661 100644 --- a/README.md +++ b/README.md @@ -68,25 +68,26 @@ For the first time, run `./update-config.sh` to update the applications base URL ## Environment Variables -| Variable | Description | Default | -|-----------------------------|------------------------------------------------------------------------------|-------------------------| -| `COMPOSE_FILE` | Docker compose files to load | `docker-compose.yml` | -| `COMPOSE_PATH_SEPARATOR` | Path separator between compose files to load | `:` | -| `USER_ID` | ID of the user to use in Docker containers | `1000` | -| `GROUP_ID` | ID of the user group to use in Docker containers | `1000` | -| `TIMEZONE` | TimeZone used by the container. | `America/New_York` | -| `DATA_ROOT` | Host location of the data files | `/mnt/data` | -| `DOWNLOAD_ROOT` | Host download location for qBittorrent, should be a subfolder of `DATA_ROOT` | `/mnt/data/torrents` | -| `PIA_LOCATION` | Servers to use for PIA | `ca` (Montreal, Canada) | -| `PIA_USER` | PIA username | | -| `PIA_PASS` | PIA password | | -| `PIA_LOCAL_NETWORK` | PIA local network | `192.168.0.0/16` | -| `HOSTNAME` | Hostname of the NAS, could be a local IP or a domain name | | -| `ADGUARD_HOSTNAME` | AdGuard Home hostname used, if enabled | | -| `LETS_ENCRYPT_EMAIL` | E-mail address used to send expiration notifications | | -| `CLOUDFLARE_EMAIL` | CloudFlare Account email | | -| `CLOUDFLARE_DNS_API_TOKEN` | API token with `DNS:Edit` permission | | -| `CLOUDFLARE_ZONE_API_TOKEN` | API token with `Zone:Read` permission | | +| Variable | Description | Default | +|-----------------------------|------------------------------------------------------------------------------------------------------|-------------------------| +| `COMPOSE_FILE` | Docker compose files to load | `docker-compose.yml` | +| `COMPOSE_PATH_SEPARATOR` | Path separator between compose files to load | `:` | +| `USER_ID` | ID of the user to use in Docker containers | `1000` | +| `GROUP_ID` | ID of the user group to use in Docker containers | `1000` | +| `TIMEZONE` | TimeZone used by the container. | `America/New_York` | +| `DATA_ROOT` | Host location of the data files | `/mnt/data` | +| `DOWNLOAD_ROOT` | Host download location for qBittorrent, should be a subfolder of `DATA_ROOT` | `/mnt/data/torrents` | +| `PIA_LOCATION` | Servers to use for PIA | `ca` (Montreal, Canada) | +| `PIA_USER` | PIA username | | +| `PIA_PASS` | PIA password | | +| `PIA_LOCAL_NETWORK` | PIA local network | `192.168.0.0/16` | +| `HOSTNAME` | Hostname of the NAS, could be a local IP or a domain name | | +| `ADGUARD_HOSTNAME` | AdGuard Home hostname used, if enabled | | +| `DNS_CHALLENGE_PROVIDER` | Provider for DNS01 challenge, [see list here](https://doc.traefik.io/traefik/https/acme/#providers). | `cloudflare` | +| `LETS_ENCRYPT_EMAIL` | E-mail address used to send expiration notifications | | +| `CLOUDFLARE_EMAIL` | CloudFlare Account email | | +| `CLOUDFLARE_DNS_API_TOKEN` | API token with `DNS:Edit` permission | | +| `CLOUDFLARE_ZONE_API_TOKEN` | API token with `Zone:Read` permission | | ## PIA Wireguard VPN @@ -199,6 +200,10 @@ If you want to test your configuration first, use the Let's Encrypt staging serv If it worked, you will see the staging certificate at https://nas.domain.com. You may remove the `./letsencrypt/acme.json` file and restart the services to issue the real certificate. +You are free to use any DNS01 provider. Simply replace `DNS_CHALLENGE_PROVIDER` with your own provider, +[see complete list here](https://doc.traefik.io/traefik/https/acme/#providers). +You will also need to inject the environments variables specific to your provider. + ### Accessing from the outside with Tailscale If we want to make it reachable from outside the network without opening ports or exposing it to the internet, I found diff --git a/docker-compose.yml b/docker-compose.yml index 42c051e..ef27c96 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -18,7 +18,7 @@ services: - --entrypoints.web.http.redirections.entryPoint.scheme=https - --entrypoints.web.http.redirections.entrypoint.permanent=true - --certificatesresolvers.myresolver.acme.dnschallenge=true - - --certificatesresolvers.myresolver.acme.dnschallenge.provider=cloudflare + - --certificatesresolvers.myresolver.acme.dnschallenge.provider=${DNS_CHALLENGE_PROVIDER} # Uncomment to test your configuration by using Let's Encrypt staging certificates #- --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory - --certificatesresolvers.myresolver.acme.email=${LETS_ENCRYPT_EMAIL}