{"id":36840906,"url":"https://github.com/matthiasng/acme-dns-proxy","last_synced_at":"2026-01-12T14:28:45.778Z","repository":{"id":43637226,"uuid":"273770969","full_name":"matthiasng/acme-dns-proxy","owner":"matthiasng","description":"Proxy for secure ACME DNS challenges.","archived":false,"fork":false,"pushed_at":"2020-11-16T20:45:02.000Z","size":58,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-06-21T01:43:49.645Z","etag":null,"topics":["acme","dns-challenge","letsencrypt","libdns","proxy"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/matthiasng.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-06-20T19:23:23.000Z","updated_at":"2021-02-03T22:24:07.000Z","dependencies_parsed_at":"2022-09-05T09:51:17.064Z","dependency_job_id":null,"html_url":"https://github.com/matthiasng/acme-dns-proxy","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/matthiasng/acme-dns-proxy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthiasng%2Facme-dns-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthiasng%2Facme-dns-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthiasng%2Facme-dns-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthiasng%2Facme-dns-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/matthiasng","download_url":"https://codeload.github.com/matthiasng/acme-dns-proxy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/matthiasng%2Facme-dns-proxy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28340398,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-12T12:22:26.515Z","status":"ssl_error","status_checked_at":"2026-01-12T12:22:10.856Z","response_time":98,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acme","dns-challenge","letsencrypt","libdns","proxy"],"created_at":"2026-01-12T14:28:45.696Z","updated_at":"2026-01-12T14:28:45.769Z","avatar_url":"https://github.com/matthiasng.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ACME DNS Proxy\r\n\r\nProxy to secure ACME DNS challenges.\r\n\r\nMost DNS providers do not offer a way to restrict access only to TXT records or to a specific domain. DigitalOcean for example only offers API tokens with full cloud access.\r\n\r\nThis creates a security issue if you use multipe host with `acme.sh` or `lego`, for example, because you have to distribute your API key among the host.\r\n\r\nWith `ACME DNS Proxy` you can control which client has access to which domains without storing your DNS Provider API keys on the client.\r\n\r\n## Features\r\n- Restrict ACME client access to specified (sub)domains\r\n- CertMagic or self signed certificate for the proxy itself (TODO)\r\n- Monitoring endpoint (prometheus) (TODO)\r\n- \"auto cleanup\" DNS records (TODO)\r\n\r\n## Supported clients:\r\n- [acmesh-official/acme.sh](https://github.com/acmesh-official/acme.sh) with [dns_acmeproxy](https://github.com/acmesh-official/acme.sh/wiki/dnsapi#78-use-acmeproxy-dns-api)\r\n- [go-acme/lego](https://github.com/go-acme/lego) with [httpreq](https://go-acme.github.io/lego/dns/httpreq/)\r\n- [traefik/traefik](https://doc.traefik.io/traefik/https/acme/#providers) which uses [go-acme/lego](https://github.com/go-acme/lego)\r\n- Everything else that can send a HTTP request\r\n\r\n## Configuration \u0026 Usage\r\n\r\nThe configuration consists of three main parts. `server`, `provider` and `access`\r\n\r\n---\r\n\r\nUnder `server` you can configure common stuff like TLS and the address, the server listens to.\r\n```yaml\r\nserver:\r\n  addr: \":8080\"\r\n```\r\n\r\n---\r\n\r\nThe `provider` section configures the access to your DNS provider.\r\n```yaml\r\nprovider:\r\n  type: gcloud\r\n  variables:\r\n    GCE_PROJECT: some-project\r\n    GCE_SERVICE_ACCOUNT: some-service-account\r\n    GCE_SERVICE_ACCOUNT_FILE: /some-service-account-file.json\r\n```\r\n\r\n`type:` \\\r\n`type` specifies the DNS provider. \r\n`acme-dns-proxy` uses [libdns/libdns](https://github.com/libdns/libdns) to add and remove DNS records. Please see the list of [Supported Providers](https://github.com/matthiasng/libdnsfactory/blob/master/docs.md) section for further information.\r\nAll providers support \r\n\r\n`variables:` \\\r\nWhich `variables` are available depends on the `type`.\r\nPlease see the list [Supported Providers](https://github.com/matthiasng/libdnsfactory/blob/master/docs.md) section for further information.\r\n\r\n---\r\nThe `access_rules` section specifies the domains for which a client can request a certificate.\r\n\r\n```yaml\r\naccess_rules:\r\n  - pattern: \"*.a.b.c.matthiasng.com\"\r\n    token: f9e5f6a00056b7913fea130aa31921ccae1b4cb152a12999d7751e667c016344\r\n  - pattern: matthiasng.com\r\n    token: f97b0d33302f348adf6ed887961156cc11b2436fd4699e7aa759becd8d96c7e3\r\n  - pattern: \"x.y.matthiasng.com\"\r\n    token: f71876a55b38a12a5da6ec1900a5cf09c7a06574726d42b3295614cc7f20b344\r\n```\r\n\r\n`pattern:` \\\r\nA glob pattern that must match the domain a client is allowed to verify.\r\n- `matthiasng.com`: only allow `matthiasng.com`\r\n- `*.sub.matthiasng.com`: allow all subdomains but not `sub.matthiasng.com`\r\n- `*foo.matthiasng.com`: all subdomains, the current domain, and each subdomain of `matthiasng.com` starting with `*foo`\r\n\r\n`token:` \\\r\nA token to verify the request.\r\n\r\nFor acme.sh and lego this must be the SHA 256 value of `\u003cusername\u003e:\u003cpassword\u003e`.\r\nThis way we dont need an extra client plugin and you can integrate the proxy inside existing infrastructure easily.\r\n\r\n```sh\r\necho -n \u003cuser\u003e:\u003cpassword\u003e | sha256sum\r\n```\r\n\r\n---\r\n\r\nThe configration file supports [golang's template](https://golang.org/pkg/text/template/).\r\nThe following variables are available:\r\n- `Env` \\\r\n    Contains all environment variables. \\\r\n    ```yaml\r\n    provider:\r\n      type: hetzner\r\n      variables:\r\n        AuthAPIToken: {{ .Env.HETZNER_AUTH_API_TOKEN }}\r\n    ```\r\n\r\n# TODOs\r\n- https://github.com/rmbolger/Posh-ACME/wiki/List-of-Supported-DNS-Providers\r\n- multiple providers\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatthiasng%2Facme-dns-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatthiasng%2Facme-dns-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatthiasng%2Facme-dns-proxy/lists"}