{"id":39920140,"url":"https://github.com/hellqvio86/cloudflare-request-cert","last_synced_at":"2026-04-02T17:51:12.242Z","repository":{"id":333317316,"uuid":"1128845965","full_name":"hellqvio86/cloudflare-request-cert","owner":"hellqvio86","description":"Simple Cloudflare script for requesting letsencrypt cert","archived":false,"fork":false,"pushed_at":"2026-03-23T19:02:02.000Z","size":745,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-24T17:16:01.527Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hellqvio86.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-06T08:30:42.000Z","updated_at":"2026-03-23T19:01:59.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/hellqvio86/cloudflare-request-cert","commit_stats":null,"previous_names":["hellqvio86/cloudflare-request-cert"],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/hellqvio86/cloudflare-request-cert","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hellqvio86%2Fcloudflare-request-cert","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hellqvio86%2Fcloudflare-request-cert/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hellqvio86%2Fcloudflare-request-cert/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hellqvio86%2Fcloudflare-request-cert/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hellqvio86","download_url":"https://codeload.github.com/hellqvio86/cloudflare-request-cert/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hellqvio86%2Fcloudflare-request-cert/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31312744,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-02T12:59:32.332Z","status":"ssl_error","status_checked_at":"2026-04-02T12:54:48.875Z","response_time":89,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-18T17:09:20.906Z","updated_at":"2026-04-02T17:51:12.232Z","avatar_url":"https://github.com/hellqvio86.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cloudflare Request Cert\n![Python Version](https://img.shields.io/badge/python-3.10%2B-blue)\n![PyPI](https://img.shields.io/pypi/v/cloudflare-request-cert)\n![Build](https://github.com/hellqvio86/cloudflare-request-cert/actions/workflows/ci.yml/badge.svg)\n![Coverage](https://img.shields.io/badge/coverage-80%25%2B-green)\n![License](https://img.shields.io/github/license/hellqvio86/cloudflare-request-cert)\n\nA Python tool for requesting and renewing SSL/TLS certificates using Cloudflare DNS API with Let's Encrypt. Built with modern Python tooling using [uv](https://github.com/astral-sh/uv) for fast dependency management.\n\n**Disclaimer:**\nThis project is not affiliated with, endorsed by, or supported by Cloudflare.\n\n## Features\n\n- 🔒 Automated SSL/TLS certificate requests using DNS-01 challenge\n- ☁️ Cloudflare DNS API integration\n- ⚡ Fast dependency management with uv\n- 🛠️ Simple Makefile interface\n- 🔄 Support for certificate renewal\n- 🧪 Staging environment support for testing\n- 📝 Configuration via .env file or command-line arguments\n- 🔧 Flexible: use .env, CLI args, or both\n\n## Prerequisites\n\n- Python 3.10 or higher\n- A Cloudflare account with API token\n- Domain managed by Cloudflare DNS\n\n## Installation\n\n### Quick Setup\n\n```bash\n# Install dependencies (will install uv if not present)\nmake install\n```\n\n### Manual uv Installation\n\nIf you prefer to install uv manually:\n\n```bash\ncurl -LsSf https://astral.sh/uv/install.sh | sh\n```\n\n## Configuration\n\n### 1. Get Cloudflare API Token\n\n1. Log in to your [Cloudflare dashboard](https://dash.cloudflare.com/)\n2. Go to **My Profile** → **API Tokens**\n3. Create a token with these permissions:\n   - **Zone:DNS:Edit** for the zones you want to manage\n   - **Zone:Zone:Read** for all zones\n\n### 2. Set Up Credentials\n\nCreate a `.env` file in the project root:\n\n```bash\n# Copy the example file\ncp .env.example .env\n\n# Edit with your credentials\nnano .env\n```\n\nYour `.env` file can contain:\n\n```bash\n# Required\nCLOUDFLARE_API_TOKEN=your_cloudflare_api_token_here\n\n# Optional (can also be passed as CLI arguments)\nDOMAIN=example.com\nEMAIL=admin@example.com\n\n# Optional settings\nSTAGING=0                    # Set to 1 for staging/test certificates\nPROPAGATION_SECONDS=10       # DNS propagation wait time\n```\n\n**Security Note**: The `.env` file is already in `.gitignore`. Never commit API tokens to version control.\n\n## Usage\n\n### Three Ways to Use This Tool\n\n#### 1. Using .env File Only\n\nSet everything in `.env` and run without arguments:\n\n```bash\n# .env file contains: CLOUDFLARE_API_TOKEN, DOMAIN, EMAIL\ncloudflare-request-cert\n```\n\n#### 2. Using Command-Line Arguments Only\n\n```bash\n# Provide all parameters via CLI (API token still from .env or environment)\ncloudflare-request-cert -d example.com -e admin@example.com\n```\n\n#### 3. Mix of Both (Recommended)\n\n```bash\n# Store sensitive data in .env, pass domain/email via CLI\n# This is useful when managing multiple domains\ncloudflare-request-cert -d example.com -e admin@example.com\n```\n\n### Using Make Commands\n\nRequest a certificate with Make:\n\n```bash\n# Basic usage\nmake run DOMAIN=example.com EMAIL=admin@example.com\n\n# Test with staging first (recommended)\nmake run DOMAIN=example.com EMAIL=admin@example.com STAGING=1\n```\n\n### Advanced Options\n\n```bash\n# Custom DNS propagation time\ncloudflare-request-cert \\\n  -d example.com \\\n  -e admin@example.com \\\n  --propagation-seconds 30\n\n# Use staging environment for testing\ncloudflare-request-cert \\\n  -d example.com \\\n  -e admin@example.com \\\n  --staging\n\n# Use custom .env file\ncloudflare-request-cert \\\n  -d example.com \\\n  -e admin@example.com \\\n  --env-file /path/to/custom.env\n```\n\n### Priority Order\n\nWhen the same setting is provided in multiple places, this is the priority order (highest to lowest):\n\n1. **Command-line arguments** (highest priority)\n2. **.env file**\n3. **Environment variables** (lowest priority)\n\nExample:\n```bash\n# .env has DOMAIN=old.com\n# This will use new.com (CLI argument takes precedence)\ncloudflare-request-cert -d new.com -e admin@example.com\n```\n\n## Makefile Commands\n\n| Command        | Description                                       |\n| -------------- | ------------------------------------------------- |\n| `make help`    | Show all available commands                       |\n| `make venv`    | Create virtual environment                        |\n| `make install` | Install uv and sync dependencies (alias for venv) |\n| `make sync`    | Sync dependencies with uv                         |\n| `make dev`     | Install development dependencies                  |\n| `make run`     | Run the certificate request tool                  |\n| `make lint`    | Lint code with ruff                               |\n| `make format`  | Format code with ruff                             |\n| `make check`   | Run all checks (lint + format)                    |\n| `make test`    | Run tests                                         |\n| `make sbom`    | Generate SBOM (Software Bill of Materials)        |\n| `make clean`   | Remove virtual environment and cache              |\n\n## Certificate Locations\n\nAfter successful certificate generation, your certificates will be stored at:\n\n```\n/etc/letsencrypt/live/your-domain.com/\n├── cert.pem       # Your certificate\n├── chain.pem      # The certificate chain\n├── fullchain.pem  # cert.pem + chain.pem\n└── privkey.pem    # Your private key\n```\n\n## DNS Propagation Time\n\nThe tool waits for DNS changes to propagate before Let's Encrypt validates your domain. Default is 10 seconds, but you can adjust this:\n\n```bash\n# Via CLI\ncloudflare-request-cert -d example.com -e admin@example.com --propagation-seconds 30\n\n# Via .env\nPROPAGATION_SECONDS=30\n```\n\n## Automatic Renewal\n\nCertbot automatically handles renewal. Set up a cron job or systemd timer:\n\n```bash\n# Cron example (runs daily at 2 AM)\n0 2 * * * certbot renew --quiet\n\n# Or use systemd timer (recommended)\nsudo systemctl enable --now certbot-renew.timer\n```\n\n## Development\n\n### Install Development Dependencies\n\n```bash\nmake dev\n```\n\n### Run Tests\n\n```bash\nmake test\n```\n\n### Run Linting\n\n```bash\nmake lint\n```\n\n### Format Code\n\n```bash\nmake format\n```\n\n### Run All Checks\n\n```bash\nmake check\n```\n\n### Generate SBOM\nGenerate a Software Bill of Materials (SBOM) in CycloneDX JSON format:\n```bash\nmake sbom\n```\nThe SBOM will be saved to `bom.json`.\n\n## Example Workflows\n\n### First Time Setup\n\n```bash\n# 1. Install dependencies\nmake install\n\n# 2. Set up configuration\ncp .env.example .env\nnano .env  # Add your Cloudflare API token\n\n# 3. Test with staging (won't affect rate limits)\ncloudflare-request-cert -d example.com -e admin@example.com --staging\n\n# 4. Get production certificate\ncloudflare-request-cert -d example.com -e admin@example.com\n```\n\n### Managing Multiple Domains\n\n```bash\n# Store API token in .env\necho \"CLOUDFLARE_API_TOKEN=your_token\" \u003e .env\n\n# Request certificates for different domains\ncloudflare-request-cert -d site1.com -e admin@site1.com\ncloudflare-request-cert -d site2.com -e admin@site2.com\ncloudflare-request-cert -d site3.com -e admin@site3.com\n```\n\n### Automated Script\n\n```bash\n#!/bin/bash\n# renew-certs.sh\n\nDOMAINS=(\"site1.com\" \"site2.com\" \"site3.com\")\nEMAIL=\"admin@example.com\"\n\nfor domain in \"${DOMAINS[@]}\"; do\n    echo \"Requesting certificate for $domain...\"\n    cloudflare-request-cert -d \"$domain\" -e \"$EMAIL\"\ndone\n```\n\n## Troubleshooting\n\n### \"certbot not found\"\n\nInstall certbot and the Cloudflare plugin:\n\n```bash\nmake install\n# or\nuv sync\n```\n\n### \"CLOUDFLARE_API_TOKEN is required\"\n\nMake sure your `.env` file exists and contains:\n```bash\nCLOUDFLARE_API_TOKEN=your_actual_token_here\n```\n\n### \"DOMAIN is required\" or \"EMAIL is required\"\n\nEither set them in `.env`:\n```bash\nDOMAIN=example.com\nEMAIL=admin@example.com\n```\n\nOr pass them as arguments:\n```bash\ncloudflare-request-cert -d example.com -e admin@example.com\n```\n\n### API Token Permissions\n\nEnsure your Cloudflare API token has:\n- Zone:DNS:Edit permissions\n- Zone:Zone:Read permissions\n\n### DNS Propagation Issues\n\nIf validation fails, try increasing propagation time:\n\n```bash\ncloudflare-request-cert -d example.com -e admin@example.com --propagation-seconds 60\n```\n\nOr set in `.env`:\n```bash\nPROPAGATION_SECONDS=60\n```\n\n### Rate Limits\n\nLet's Encrypt has rate limits. Use staging for testing:\n\n```bash\n# Set in .env\nSTAGING=1\n\n# Or via CLI\ncloudflare-request-cert -d example.com -e admin@example.com --staging\n```\n\n## Comparison with Original\n\nThis is a Cloudflare remake of the [loopia-request-cert](https://github.com/hellqvio86/loopia-request-cert) tool with several improvements:\n\n- Uses **Cloudflare** instead of Loopia DNS\n- Uses **uv** for faster dependency management (10-100x faster than pip)\n- Modern **pyproject.toml** configuration\n- Improved **Makefile** with more commands\n- Better **error handling** and user feedback\n- **Flexible configuration**: .env file, CLI args, or both\n- **Type hints** for better code quality\n- **Ruff** for linting and formatting\n- **Comprehensive tests**\n\n## License\n\nMIT License\n\n## Contributing\n\nContributions are welcome! Please feel free to submit a Pull Request.\n\n## Resources\n\n- [Cloudflare API Documentation](https://developers.cloudflare.com/api/)\n- [Certbot Documentation](https://eff-certbot.readthedocs.io/)\n- [Let's Encrypt](https://letsencrypt.org/)\n- [uv Documentation](https://github.com/astral-sh/uv)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhellqvio86%2Fcloudflare-request-cert","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhellqvio86%2Fcloudflare-request-cert","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhellqvio86%2Fcloudflare-request-cert/lists"}