constellix.go raw
1 // Package constellix implements a DNS provider for solving the DNS-01 challenge using Constellix DNS.
2 package constellix
3
4 import (
5 "context"
6 "errors"
7 "fmt"
8 "net/http"
9 "slices"
10 "strconv"
11 "time"
12
13 "github.com/go-acme/lego/v4/challenge"
14 "github.com/go-acme/lego/v4/challenge/dns01"
15 "github.com/go-acme/lego/v4/platform/config/env"
16 "github.com/go-acme/lego/v4/providers/dns/constellix/internal"
17 "github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
18 "github.com/hashicorp/go-retryablehttp"
19 )
20
21 // Environment variables names.
22 const (
23 envNamespace = "CONSTELLIX_"
24
25 EnvAPIKey = envNamespace + "API_KEY"
26 EnvSecretKey = envNamespace + "SECRET_KEY"
27
28 EnvTTL = envNamespace + "TTL"
29 EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
30 EnvPollingInterval = envNamespace + "POLLING_INTERVAL"
31 EnvHTTPTimeout = envNamespace + "HTTP_TIMEOUT"
32 )
33
34 var _ challenge.ProviderTimeout = (*DNSProvider)(nil)
35
36 // Config is used to configure the creation of the DNSProvider.
37 type Config struct {
38 APIKey string
39 SecretKey string
40 PropagationTimeout time.Duration
41 PollingInterval time.Duration
42 TTL int
43 HTTPClient *http.Client
44 }
45
46 // NewDefaultConfig returns a default configuration for the DNSProvider.
47 func NewDefaultConfig() *Config {
48 return &Config{
49 TTL: env.GetOrDefaultInt(EnvTTL, 60),
50 PropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, dns01.DefaultPropagationTimeout),
51 PollingInterval: env.GetOrDefaultSecond(EnvPollingInterval, 10*time.Second),
52 HTTPClient: &http.Client{
53 Timeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),
54 },
55 }
56 }
57
58 // DNSProvider implements the challenge.Provider interface.
59 type DNSProvider struct {
60 config *Config
61 client *internal.Client
62 }
63
64 // NewDNSProvider returns a DNSProvider instance configured for Constellix.
65 // Credentials must be passed in the environment variables:
66 // CONSTELLIX_API_KEY and CONSTELLIX_SECRET_KEY.
67 func NewDNSProvider() (*DNSProvider, error) {
68 values, err := env.Get(EnvAPIKey, EnvSecretKey)
69 if err != nil {
70 return nil, fmt.Errorf("constellix: %w", err)
71 }
72
73 config := NewDefaultConfig()
74 config.APIKey = values[EnvAPIKey]
75 config.SecretKey = values[EnvSecretKey]
76
77 return NewDNSProviderConfig(config)
78 }
79
80 // NewDNSProviderConfig return a DNSProvider instance configured for Constellix.
81 func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
82 if config == nil {
83 return nil, errors.New("constellix: the configuration of the DNS provider is nil")
84 }
85
86 if config.SecretKey == "" || config.APIKey == "" {
87 return nil, errors.New("constellix: incomplete credentials, missing secret key and/or API key")
88 }
89
90 tr, err := internal.NewTokenTransport(config.APIKey, config.SecretKey)
91 if err != nil {
92 return nil, fmt.Errorf("constellix: %w", err)
93 }
94
95 retryClient := retryablehttp.NewClient()
96 retryClient.RetryMax = 5
97 retryClient.HTTPClient = tr.Wrap(config.HTTPClient)
98 retryClient.Backoff = backoff
99
100 client := internal.NewClient(clientdebug.Wrap(retryClient.StandardClient()))
101
102 return &DNSProvider{config: config, client: client}, nil
103 }
104
105 // Timeout returns the timeout and interval to use when checking for DNS propagation.
106 // Adjusting here to cope with spikes in propagation times.
107 func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
108 return d.config.PropagationTimeout, d.config.PollingInterval
109 }
110
111 // Present creates a TXT record using the specified parameters.
112 func (d *DNSProvider) Present(domain, token, keyAuth string) error {
113 info := dns01.GetChallengeInfo(domain, keyAuth)
114
115 authZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)
116 if err != nil {
117 return fmt.Errorf("constellix: could not find zone for domain %q: %w", domain, err)
118 }
119
120 ctx := context.Background()
121
122 dom, err := d.client.Domains.GetByName(ctx, dns01.UnFqdn(authZone))
123 if err != nil {
124 return fmt.Errorf("constellix: failed to get domain (%s): %w", authZone, err)
125 }
126
127 recordName, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)
128 if err != nil {
129 return fmt.Errorf("constellix: %w", err)
130 }
131
132 records, err := d.client.TxtRecords.Search(ctx, dom.ID, internal.Exact, recordName)
133 if err != nil {
134 return fmt.Errorf("constellix: failed to search TXT records: %w", err)
135 }
136
137 if len(records) > 1 {
138 return errors.New("constellix: failed to get TXT records")
139 }
140
141 // TXT record entry already existing
142 if len(records) == 1 {
143 return d.appendRecordValue(ctx, dom, records[0].ID, info.Value)
144 }
145
146 err = d.createRecord(ctx, dom, info.EffectiveFQDN, recordName, info.Value)
147 if err != nil {
148 return fmt.Errorf("constellix: %w", err)
149 }
150
151 return nil
152 }
153
154 // CleanUp removes the TXT record matching the specified parameters.
155 func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
156 info := dns01.GetChallengeInfo(domain, keyAuth)
157
158 authZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)
159 if err != nil {
160 return fmt.Errorf("constellix: could not find zone for domain %q: %w", domain, err)
161 }
162
163 ctx := context.Background()
164
165 dom, err := d.client.Domains.GetByName(ctx, dns01.UnFqdn(authZone))
166 if err != nil {
167 return fmt.Errorf("constellix: failed to get domain (%s): %w", authZone, err)
168 }
169
170 recordName, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)
171 if err != nil {
172 return fmt.Errorf("constellix: %w", err)
173 }
174
175 records, err := d.client.TxtRecords.Search(ctx, dom.ID, internal.Exact, recordName)
176 if err != nil {
177 return fmt.Errorf("constellix: failed to search TXT records: %w", err)
178 }
179
180 if len(records) > 1 {
181 return errors.New("constellix: failed to get TXT records")
182 }
183
184 if len(records) == 0 {
185 return nil
186 }
187
188 record, err := d.client.TxtRecords.Get(ctx, dom.ID, records[0].ID)
189 if err != nil {
190 return fmt.Errorf("constellix: failed to get TXT records: %w", err)
191 }
192
193 if !containsValue(record, info.Value) {
194 return nil
195 }
196
197 // only 1 record value, the whole record must be deleted.
198 if len(record.Value) == 1 {
199 _, err = d.client.TxtRecords.Delete(ctx, dom.ID, record.ID)
200 if err != nil {
201 return fmt.Errorf("constellix: failed to delete TXT records: %w", err)
202 }
203
204 return nil
205 }
206
207 err = d.removeRecordValue(ctx, dom, record, info.Value)
208 if err != nil {
209 return fmt.Errorf("constellix: %w", err)
210 }
211
212 return nil
213 }
214
215 func (d *DNSProvider) createRecord(ctx context.Context, dom internal.Domain, fqdn, recordName, value string) error {
216 request := internal.RecordRequest{
217 Name: recordName,
218 TTL: d.config.TTL,
219 RoundRobin: []internal.RecordValue{
220 {Value: fmt.Sprintf(`%q`, value)},
221 },
222 }
223
224 _, err := d.client.TxtRecords.Create(ctx, dom.ID, request)
225 if err != nil {
226 return fmt.Errorf("failed to create TXT record %s: %w", fqdn, err)
227 }
228
229 return nil
230 }
231
232 func (d *DNSProvider) appendRecordValue(ctx context.Context, dom internal.Domain, recordID int64, value string) error {
233 record, err := d.client.TxtRecords.Get(ctx, dom.ID, recordID)
234 if err != nil {
235 return fmt.Errorf("failed to get TXT records: %w", err)
236 }
237
238 if containsValue(record, value) {
239 return nil
240 }
241
242 request := internal.RecordRequest{
243 Name: record.Name,
244 TTL: record.TTL,
245 RoundRobin: append(record.RoundRobin, internal.RecordValue{Value: fmt.Sprintf(`%q`, value)}),
246 }
247
248 _, err = d.client.TxtRecords.Update(ctx, dom.ID, record.ID, request)
249 if err != nil {
250 return fmt.Errorf("failed to update TXT records: %w", err)
251 }
252
253 return nil
254 }
255
256 func (d *DNSProvider) removeRecordValue(ctx context.Context, dom internal.Domain, record *internal.Record, value string) error {
257 request := internal.RecordRequest{
258 Name: record.Name,
259 TTL: record.TTL,
260 }
261
262 for _, val := range record.Value {
263 if val.Value != fmt.Sprintf(`%q`, value) {
264 request.RoundRobin = append(request.RoundRobin, val)
265 }
266 }
267
268 _, err := d.client.TxtRecords.Update(ctx, dom.ID, record.ID, request)
269 if err != nil {
270 return fmt.Errorf("failed to update TXT records: %w", err)
271 }
272
273 return nil
274 }
275
276 func containsValue(record *internal.Record, value string) bool {
277 if record == nil {
278 return false
279 }
280
281 qValue := fmt.Sprintf(`%q`, value)
282
283 return slices.ContainsFunc(record.Value, func(val internal.RecordValue) bool {
284 return val.Value == qValue
285 })
286 }
287
288 func backoff(minimum, maximum time.Duration, attemptNum int, resp *http.Response) time.Duration {
289 if resp != nil {
290 // https://api.dns.constellix.com/v4/docs#section/Using-the-API/Rate-Limiting
291 if resp.StatusCode == http.StatusTooManyRequests {
292 if s, ok := resp.Header["X-Ratelimit-Reset"]; ok {
293 if sleep, err := strconv.ParseInt(s[0], 10, 64); err == nil {
294 return time.Second * time.Duration(sleep)
295 }
296 }
297 }
298 }
299
300 return retryablehttp.DefaultBackoff(minimum, maximum, attemptNum, resp)
301 }
302