CroneKorkN
3bffd7b8f5
The acme_zone reactor's first ACL branch iterates nodes that have letsencrypt/domains and reads their network/internal/ipv4. Until now that crashed for any node with letsencrypt but no internal LAN — the node had to either fake a network/internal/ipv4 or skip TLS. Add a `metadata.get(..., None)` guard to filter such nodes out of this branch. The wireguard branch below already covers them (any node with the wireguard bundle gets its wireguard/my_ip into the ACL), so ACME DNS-01 reachability still works for cross-Internet nodes that join the fleet via wireguard. Surfaced by ovh.left4me: dedicated server with no Hetzner/internal network, reachable from the bind-acme node only via wireguard.
70 lines
1.9 KiB
Python
70 lines
1.9 KiB
Python
from ipaddress import ip_interface
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'dns',
|
|
)
|
|
def acme_records(metadata):
|
|
domains = set()
|
|
|
|
for other_node in repo.nodes:
|
|
for domain, conf in other_node.metadata.get('letsencrypt/domains', {}).items():
|
|
domains.add(domain)
|
|
domains.update(conf.get('aliases', []))
|
|
|
|
return {
|
|
'dns': {
|
|
f'_acme-challenge.{domain}': {
|
|
'CNAME': {f"{domain}.{metadata.get('bind/acme_zone')}."},
|
|
}
|
|
for domain in domains
|
|
}
|
|
}
|
|
|
|
|
|
@metadata_reactor.provides(
|
|
'bind/acls/acme',
|
|
'bind/views/external/keys/acme',
|
|
'bind/views/external/zones',
|
|
)
|
|
def acme_zone(metadata):
|
|
allowed_ips = {
|
|
*{
|
|
str(ip_interface(other_node.metadata.get('network/internal/ipv4')).ip)
|
|
for other_node in repo.nodes
|
|
if other_node.metadata.get('letsencrypt/domains', {})
|
|
and other_node.metadata.get('network/internal/ipv4', None)
|
|
},
|
|
*{
|
|
str(ip_interface(other_node.metadata.get('wireguard/my_ip')).ip)
|
|
for other_node in repo.nodes
|
|
if other_node.has_bundle('wireguard')
|
|
},
|
|
}
|
|
|
|
return {
|
|
'bind': {
|
|
'acls': {
|
|
'acme': {
|
|
'key acme',
|
|
'!{ !{' + ' '.join(f'{ip};' for ip in sorted(allowed_ips)) + '}; any;}',
|
|
},
|
|
},
|
|
'views': {
|
|
'external': {
|
|
'keys': {
|
|
'acme': {},
|
|
},
|
|
'zones': {
|
|
metadata.get('bind/acme_zone'): {
|
|
'allow_update': {
|
|
'acme',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
#https://lists.isc.org/pipermail/bind-users/2006-January/061051.html
|