HomeDevCentral

Allow to update ACME DNS accounts

Description

Allow to update ACME DNS accounts

Summary:
To verify a domain through DNS, a specialized DNS server has
been provided in 9d9d4f52e938 to maintain TXT records.

Several servers can use wildcard certificates, but as we don't
use the same account key on each servers, the DNS record will
change. As such, and if we want each server generate its own
concurrent certificate for *.domain.tld, we need to allow each
of them to update the DNS record.

To do so, the DNS is configured like this:
_acme-challenge.domain.tld CNAME <some guid>.acme.nasqueron.org

And <some guid> matches an ACME DNS account allowed to change it.
As we don't want to change CNAME everytime, that means the ACME
DNS account must be shared among the servers.

We so need to provision the credentials and merge them to
local credentials maintained by the server (ie when we update
the password for *.nasqueron.org, we don't want to lost on Equatower
the password for devcentral.nasqueron.org). That's the job of the
edit-acme-dns-accounts import command.

A follow-up change will take care of the actual provisioning,
once the question of where to put it will be solved (Vault?).

Ref T1602.

Test Plan: Unit tests and integration tests provided

Reviewers: dereckson

Reviewed By: dereckson

Maniphest Tasks: T1602

Differential Revision: https://devcentral.nasqueron.org/D2249

Details

Provenance
derecksonAuthored on Feb 28 2020, 18:55
derecksonPushed on Feb 29 2020, 14:06
Reviewer
dereckson
Differential Revision
D2249: Allow to update ACME DNS accounts
Parents
rOPSd4f0ec8e6a4a: Drop empty value for php-fpm environment variable
Branches
Unknown
Tags
Unknown
Tasks
T1602: Provision ACME DNS credentials for core domains on each servers