Dynu domain confusion for ACME DNS-01 challenge setup

[bam80]

mtg/contrib/sni-router/Caddyfile

Line 3 in e5ce720

# ACME HTTP-01 challenges arrive on :80 via HAProxy's acl passthrough.

Could somebody clarify Caddy-DNS Dynu settings for me, please?
Sorry it's a bit offtop here, still, comments are welcome:
caddy-dns/dynu#7

@dolonet

[dolonet]

Not really an mtg question — the sni-router Caddyfile uses HTTP-01 (http_port 80), there's no DNS-01 / Dynu plumbing here. Your config in caddy-dns/dynu#7 is correct, the README is just unclear.

The rule: own_domain = the zone root Dynu's API recognizes (what /dns/getroot/{hostname} returns), not the cert subject. Whether they coincide depends on which free TLD you picked:

• my.dynu.com — your owned root is my.dynu.com. Cert subject and own_domain happen to match. The README's example reflects this case.
• <sub>.loseyourip.com — Dynu delegates the zone at <sub>.loseyourip.com. <host>.<sub>.loseyourip.com is a record inside that zone, not its own root, so the API can't resolve a domain by that full name.

So your config:

<host>.<sub>.loseyourip.com {
    tls { dns dynu <key> { own_domain <sub>.loseyourip.com } }
}

is right. caddy-dns/dynu#7 makes the README cover both cases instead of only the one where they collapse.

[bam80]

@dolonet Thanks for clarifying and follow up.

I actually had to switch to ACME DNS-01 challenge as I don't have 80 port available.
The case might be quite common, so maybe worth mentioning in the Caddyfile comment something like:

If you don't have 80 port available, use DNS-01 challenge instead by adding one of https://github.com/caddy-dns module to the image and change configs accordingly.