Intermediate commit fo DNS Challenge

src/tls/acme/account.rs

@@ -30,8 +30,8 @@ async fn create_account(file: &str) -> Result<(), Box<dyn std::error::Error>> {
         only_return_existing: false,
     };
     let acc_builder = Account::builder()?;
-    let (account, credentials) = acc_builder.create(&new_account, LetsEncrypt::Production.url().to_string(), None).await?;
-    // let (account, credentials) = acc_builder.create(&new_account, LetsEncrypt::Staging.url().to_string(), None).await?;
+    // let (account, credentials) = acc_builder.create(&new_account, LetsEncrypt::Production.url().to_string(), None).await?;
+    let (account, credentials) = acc_builder.create(&new_account, LetsEncrypt::Staging.url().to_string(), None).await?;
     info!("Account created: {:?}", account.id());
     save_credentials(&credentials, file)?;
     let _ = ACCOUNT.set(account);

src/tls/acme/dns/cloudflare.rs

@@ -0,0 +1,65 @@
+use crate::tls::acme::types::DnsProvider;
+use reqwest::Client;
+use serde_json::json;
+
+pub struct CloudflareProvider {
+    pub client: Client,
+    pub api_token: String,
+    pub zone_id: String,
+}
+
+impl CloudflareProvider {
+    pub fn new() -> Self {
+        let api_token = std::env::var("CLOUDFLARE_API_TOKEN").expect("Environment variable CLOUDFLARE_API_TOKEN is required");
+        let zone_id = std::env::var("CLOUDFLARE_ZONE_ID").expect("Environment variable CLOUDFLARE_ZONE_ID is required");
+
+        Self {
+            client: Client::new(),
+            api_token,
+            zone_id,
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl DnsProvider for CloudflareProvider {
+    async fn create_txt_record(&self, _domain: &str, name: &str, value: &str) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+        let url = format!("https://api.cloudflare.com/client/v4/zones/{}/dns_records", self.zone_id);
+
+        let response = self
+            .client
+            .post(&url)
+            .bearer_auth(&self.api_token)
+            .json(&json!({
+                "type": "TXT",
+                "name": name,
+                "content": value,
+                "ttl": 120,
+            }))
+            .send()
+            .await?;
+
+        let res_json: serde_json::Value = response.json().await?;
+        if !res_json["success"].as_bool().unwrap_or(false) {
+            return Err(format!("Cloudflare API error: {:?}", res_json["errors"]).into());
+        }
+
+        let record_id = res_json["result"]["id"].as_str().ok_or("missing id")?.to_string();
+        println!(" ====> Created DNS Record ID: {}", record_id);
+        Ok(record_id)
+    }
+
+    async fn delete_txt_record(&self, record_id: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let url = format!("https://api.cloudflare.com/client/v4/zones/{}/dns_records/{}", self.zone_id, record_id);
+
+        let response = self.client.delete(&url).bearer_auth(&self.api_token).send().await?;
+
+        let res_json: serde_json::Value = response.json().await?;
+        if !res_json["success"].as_bool().unwrap_or(false) {
+            return Err(format!("Cloudflare API error deleting record: {:?}", res_json["errors"]).into());
+        }
+
+        println!(" ====> Successfully deleted DNS record: {}", record_id);
+        Ok(())
+    }
+}

src/tls/acme/dns/mod.rs

@@ -0,0 +1,2 @@
+pub mod cloudflare;
+pub mod route53;

src/tls/acme/dns/route53.rs

@@ -0,0 +1,25 @@
+use crate::tls::acme::types::DnsProvider;
+
+pub struct Route53Provider {
+    pub hosted_zone_id: String,
+}
+
+impl Route53Provider {
+    pub fn new() -> Self {
+        Self {
+            hosted_zone_id: std::env::var("AWS_HOSTED_ZONE_ID").unwrap_or_default(),
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl DnsProvider for Route53Provider {
+    async fn create_txt_record(&self, domain: &str, name: &str, value: &str) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+        println!(" ====> Route53 Created TXT Record for {}: {}: {}", name, domain, value);
+        Ok("route53_change_id".to_string())
+    }
+    async fn delete_txt_record(&self, record_id: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        println!(" ====> Route53 Deleted TXT Record {}", record_id);
+        Ok(())
+    }
+}

src/tls/acme/http01.rs

@@ -14,32 +14,32 @@ pub async fn acme_create(State(state): State<webserver::AppState>) -> impl IntoR
                 .status(StatusCode::OK)
                 .header("Content-Type", "text/plain")
                 .body(Body::from(txt))
-                .unwrap()
+                .unwrap();
         }
         Err(e) => {
             return Response::builder()
                 .status(StatusCode::INTERNAL_SERVER_ERROR)
                 .body(Body::from(format!("Failed to create account: {}", e)))
-                .unwrap()
+                .unwrap();
         }
     };
 }
 #[allow(clippy::needless_return)]
 pub async fn acme_order(State(state): State<webserver::AppState>, axum::extract::Path(domain): axum::extract::Path<String>) -> impl IntoResponse {
     let domain_clean = domain.trim_matches('/');
-    match order::order(domain_clean, state.cert_creds.as_str(), state.certs_dir).await {
+    match order::order(domain_clean, state.cert_creds.as_str(), state.certs_dir, state.acme_dns_provider).await {
         Ok(txt) => {
             return Response::builder()
                 .status(StatusCode::OK)
                 .header("Content-Type", "text/plain")
                 .body(Body::from(txt))
-                .unwrap()
+                .unwrap();
         }
         Err(e) => {
             return Response::builder()
                 .status(StatusCode::INTERNAL_SERVER_ERROR)
                 .body(Body::from(format!("Failed to order a certificate: {}", e)))
-                .unwrap()
+                .unwrap();
         }
     };
 }

src/tls/acme/mod.rs

@@ -1,6 +1,8 @@
 pub mod account;
+pub mod dns;
 pub mod http01;
 pub mod order;
+pub mod types;
 
 pub use account::*;
 pub use order::*;

src/tls/acme/order.rs

@@ -1,24 +1,30 @@
 use crate::tls::acme::account::get_account;
+use crate::tls::acme::types::get_provider;
 use crate::utils::lazylock::CHALLENGES;
-use crate::utils::parceyaml::DOMAINS;
+use crate::utils::lazylock::DOMAINS;
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use instant_acme::{ChallengeType, Identifier, NewOrder, RetryPolicy};
 use log::{error, info};
 use pingora::prelude::sleep;
 use rcgen::{CertificateParams, DistinguishedName, KeyPair};
+use sha2::{Digest, Sha256};
 use std::fs;
 use std::time::Duration;
 use x509_parser::prelude::*;
 
-pub async fn refresh_order(certs_dir: String, autoconf_dir: String) {
+static DNS: bool = true;
+
+pub async fn refresh_order(certs_dir: String, autoconf_dir: String, provider: Option<String>) {
     let credsfile = autoconf_dir + "/acme_credentials.json";
     loop {
         for item in DOMAINS.iter() {
-            let _what = order(item.key(), credsfile.as_str(), certs_dir.clone()).await;
+            let _what = order(item.key(), credsfile.as_str(), certs_dir.clone(), provider.clone()).await;
         }
         sleep(Duration::from_secs(12 * 3600)).await;
     }
 }
-pub async fn order(domain: &str, credsfile: &str, certs_dir: String) -> Result<String, Box<dyn std::error::Error>> {
+pub async fn order(domain: &str, credsfile: &str, certs_dir: String, provider: Option<String>) -> Result<String, Box<dyn std::error::Error>> {
     let crt = certs_dir.clone() + "/" + domain + ".crt";
     let key = certs_dir.clone() + "/" + domain + ".key";
 
@@ -36,7 +42,6 @@ pub async fn order(domain: &str, credsfile: &str, certs_dir: String) -> Result<S
             }
         }
     }
-
     if let Ok(expiry) = cert_expiry(crt.as_str()) {
         let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_secs();
         if expiry > now + 30 * 24 * 3600 {
@@ -49,14 +54,42 @@ pub async fn order(domain: &str, credsfile: &str, certs_dir: String) -> Result<S
     let mut order = account.new_order(&NewOrder::new(&[Identifier::Dns(domain.to_string())])).await?;
 
     let mut authorizations = order.authorizations();
+    // let dns_provider = CloudflareProvider::new();
+
+    let dns_provider = get_provider();
+
     while let Some(auth) = authorizations.next().await {
         let mut auth = auth?;
-        let mut challenge_handle = auth.challenge(ChallengeType::Http01).ok_or("no http01 challenge found")?;
+        let domain = auth.identifier().to_string();
+        let challenge_type = if DNS { ChallengeType::Dns01 } else { ChallengeType::Http01 };
+
+        let mut challenge_handle = auth.challenge(challenge_type).ok_or("No challenge found")?;
         let key_auth = challenge_handle.key_authorization();
         let key_auth_str = key_auth.as_str().to_string();
-        let token = key_auth_str.split('.').next().ok_or("invalid key authorization")?.to_string();
-        CHALLENGES.write().unwrap().insert(token, key_auth_str);
-        challenge_handle.set_ready().await?;
+
+        if let Some(prov) = provider.clone() {
+            println!("============================== {:?}", prov);
+            let dns_value = calculate_dns_value(&key_auth_str);
+            let clean_domain = domain.trim_start_matches("*.").to_string();
+            let record_name = format!("_acme-challenge.{}", clean_domain);
+            // Works identically for Cloudflare, Route53, or any future provider!
+            match dns_provider.create_txt_record(&clean_domain, &record_name, &dns_value).await {
+                Ok(record_id) => {
+                    info!("Waiting 30 seconds for DNS propagation: {}", record_name);
+                    tokio::time::sleep(tokio::time::Duration::from_secs(30)).await;
+                    challenge_handle.set_ready().await?;
+                    let _ = dns_provider.delete_txt_record(&record_id).await;
+                }
+                Err(e) => {
+                    eprintln!("Failed to create DNS record: {}", e);
+                    return Err(e);
+                }
+            }
+        } else {
+            let token = key_auth_str.split('.').next().ok_or("invalid key authorization")?.to_string();
+            CHALLENGES.write().unwrap().insert(token, key_auth_str);
+            challenge_handle.set_ready().await?;
+        }
     }
 
     let status = order.poll_ready(&RetryPolicy::default()).await?;
@@ -86,3 +119,8 @@ fn cert_expiry(path: &str) -> Result<u64, Box<dyn std::error::Error>> {
     let expiry = cert.validity().not_after.timestamp() as u64;
     Ok(expiry)
 }
+
+fn calculate_dns_value(key_auth: &str) -> String {
+    let hash = Sha256::digest(key_auth.as_bytes());
+    URL_SAFE_NO_PAD.encode(hash)
+}

src/tls/acme/types.rs

@@ -0,0 +1,23 @@
+use crate::tls::acme::dns::cloudflare::CloudflareProvider;
+use crate::tls::acme::dns::route53::Route53Provider;
+
+#[async_trait::async_trait]
+pub trait DnsProvider: Send + Sync {
+    async fn create_txt_record(&self, domain: &str, name: &str, value: &str) -> Result<String, Box<dyn std::error::Error + Send + Sync>>;
+
+    async fn delete_txt_record(&self, record_id: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>>;
+}
+
+// pub enum ProviderType {
+//     Cloudflare,
+//     Route53,
+// }
+
+pub fn get_provider() -> Box<dyn DnsProvider> {
+    let provider_choice: Option<Box<dyn DnsProvider>> = match std::env::var("DNS_PROVIDER").as_deref() {
+        Ok("cloudflare") => Some(Box::new(CloudflareProvider::new())),
+        Ok("route53") => Some(Box::new(Route53Provider::new())),
+        _ => None,
+    };
+    provider_choice.expect("No provider choice provided!")
+}