coredns: production Let's Encrypt cert via Caddy sidecar (DNS-01 + Vultr)
Replaces the self-signed dev cert flow with a real LE prod cert for dns.l.supported.systems, issued and auto-renewed by a Caddy sidecar using DNS-01 challenge against the Vultr API. Components: - caddy/Dockerfile builds Caddy 2.10.0 with caddy-dns/vultr plugin via xcaddy. GOTOOLCHAIN=auto so xcaddy can fetch newer Go on demand when plugin versions advance their minimum Go. - caddy/Caddyfile uses DNS-01 with explicit public resolvers (1.1.1.1, 9.9.9.9) for the propagation check. Without that, Docker's embedded DNS leaks the container into the host's split-horizon LAN DNS, which returns LAN IPs for ns1.vultr.com and the propagation check fails. - docker-compose: caddy service shares ./caddy-data with coredns via a read-only subpath mount that excludes /acme (account private key). - Healthcheck doubles as a symlinker: maintains stable cert.pem / key.pem names at /data/caddy/ and chmods cert files + their dirs to be readable by CoreDNS's nonroot user. Flips to "healthy" only once the symlinks dereference (i.e. cert exists), gating CoreDNS start via depends_on: service_healthy. - Corefile unchanged — same /etc/coredns/certs/cert.pem path; only the bind-mount source switches from ./certs to ./caddy-data/caddy. - New Makefile target: tls-up orchestrates the bring-up sequence. Cert is valid until Aug 12 2026. Verified end-to-end: dig @127.0.0.1 -p 8853 +tls +tls-hostname=dns.l.supported.systems ... dig @127.0.0.1 -p 8443 +https +tls-hostname=dns.l.supported.systems ...
This commit is contained in:
parent
066ba1892a
commit
c1afe77b27
6 changed files with 195 additions and 32 deletions
109
Makefile
109
Makefile
|
|
@ -2,28 +2,68 @@
|
|||
SHELL := /usr/bin/env bash
|
||||
COMPOSE := docker compose
|
||||
|
||||
.PHONY: help prep certs up down restart logs ps test test-tls reload clean
|
||||
# Source .env so $(CADDY_HOSTNAME) etc. are available in recipes.
|
||||
include .env
|
||||
export
|
||||
|
||||
.PHONY: help prep certs up down restart logs logs-caddy ps test test-tls \
|
||||
test-public reload clean tls-up cert-watch caddy-rebuild
|
||||
|
||||
help: ## Show this help
|
||||
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf " \033[36m%-12s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
|
||||
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf " \033[36m%-14s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
|
||||
|
||||
prep: ## Re-inject SOA records into all zones (writes zones-prepared/)
|
||||
@./scripts/prepare-zones.sh
|
||||
|
||||
certs: ## Generate self-signed cert for DoT/DoH (re-run with FORCE=1 to rotate)
|
||||
certs: ## Generate self-signed dev cert (only useful if not using Caddy ACME)
|
||||
@./scripts/generate-certs.sh
|
||||
|
||||
up: prep certs ## Start CoreDNS (prepares zones + ensures certs exist first)
|
||||
$(COMPOSE) up -d
|
||||
@sleep 2 && $(COMPOSE) logs --tail=20 coredns
|
||||
caddy-rebuild: ## Rebuild the Caddy image (after editing caddy/Dockerfile)
|
||||
$(COMPOSE) build --no-cache caddy
|
||||
|
||||
down: ## Stop & remove the container
|
||||
# ---------------------------------------------------------------------------
|
||||
# Production / Let's Encrypt flow
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
tls-up: prep ## Bring up Caddy → wait for cert → start CoreDNS (one command)
|
||||
@if [ -z "$$VULTR_API_KEY" ]; then \
|
||||
echo "ERROR: VULTR_API_KEY is not exported. Set it in your shell:"; \
|
||||
echo " export VULTR_API_KEY=..."; \
|
||||
exit 1; \
|
||||
fi
|
||||
@mkdir -p caddy-data caddy-config
|
||||
$(COMPOSE) up -d caddy
|
||||
@echo ""
|
||||
@echo "Waiting for Caddy to provision cert for $(CADDY_HOSTNAME)..."
|
||||
@echo "(DNS-01 via Vultr typically takes 30-90s; press Ctrl-C to abort)"
|
||||
@for i in $$(seq 1 90); do \
|
||||
if [ -e caddy-data/caddy/cert.pem ]; then \
|
||||
echo ""; echo " ✓ cert ready after $${i}0s"; break; \
|
||||
fi; \
|
||||
printf '.'; sleep 10; \
|
||||
done
|
||||
@test -e caddy-data/caddy/cert.pem || \
|
||||
(echo ""; echo "FAILED — see logs: make logs-caddy"; exit 1)
|
||||
$(COMPOSE) up -d coredns
|
||||
@sleep 3 && $(COMPOSE) logs --tail=15 coredns
|
||||
|
||||
cert-watch: ## Tail Caddy logs while it provisions the cert
|
||||
$(COMPOSE) logs -f caddy
|
||||
|
||||
logs-caddy: ## Tail Caddy logs
|
||||
$(COMPOSE) logs -f caddy
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Day-to-day operations
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
down: ## Stop & remove all containers
|
||||
$(COMPOSE) down
|
||||
|
||||
restart: ## Restart CoreDNS (does not re-prep zones)
|
||||
restart: ## Restart CoreDNS (does not re-prep zones / re-issue cert)
|
||||
$(COMPOSE) restart coredns
|
||||
|
||||
reload: prep ## Re-prep zones; CoreDNS auto-plugin will pick changes up
|
||||
reload: prep ## Re-prep zones; CoreDNS auto-plugin picks changes up
|
||||
@echo "Zones re-prepared. CoreDNS reloads files every 30s (auto plugin)."
|
||||
|
||||
logs: ## Tail CoreDNS logs
|
||||
|
|
@ -32,28 +72,35 @@ logs: ## Tail CoreDNS logs
|
|||
ps: ## Show container status
|
||||
$(COMPOSE) ps
|
||||
|
||||
test: ## Smoke-test plain DNS (uses DNS_PORT from .env)
|
||||
@. ./.env && echo "Querying acrazy.org @ 127.0.0.1:$$DNS_PORT (plain DNS)" && \
|
||||
dig @127.0.0.1 -p $$DNS_PORT acrazy.org SOA +short && \
|
||||
dig @127.0.0.1 -p $$DNS_PORT acrazy.org NS +short && \
|
||||
dig @127.0.0.1 -p $$DNS_PORT or.acrazy.org A +short
|
||||
# ---------------------------------------------------------------------------
|
||||
# Smoke tests
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
test-tls: ## Smoke-test DoT + DoH (pins self-signed cert via +tls-ca)
|
||||
@. ./.env && \
|
||||
echo "=== DoT @ 127.0.0.1:$$DOT_PORT ===" && \
|
||||
dig @127.0.0.1 -p $$DOT_PORT +tls +tls-ca=certs/cert.pem \
|
||||
+tls-hostname=localhost acrazy.org SOA +short && \
|
||||
echo "" && \
|
||||
echo "=== DoH @ https://localhost:$$DOH_PORT/dns-query ===" && \
|
||||
dig @localhost -p $$DOH_PORT +https +tls-ca=certs/cert.pem \
|
||||
acrazy.org A +short && \
|
||||
echo "" && \
|
||||
echo "=== DoH via curl (raw wire-format) ===" && \
|
||||
curl -sk --cacert certs/cert.pem \
|
||||
-H 'accept: application/dns-message' \
|
||||
--data-binary @<(printf '\x00\x00\x01\x20\x00\x01\x00\x00\x00\x00\x00\x00\x06acrazy\x03org\x00\x00\x01\x00\x01') \
|
||||
-H 'content-type: application/dns-message' \
|
||||
"https://localhost:$$DOH_PORT/dns-query" | xxd | head -5
|
||||
test: ## Smoke-test plain DNS
|
||||
@echo "Querying acrazy.org @ 127.0.0.1:$(DNS_PORT) (plain DNS)"
|
||||
@dig @127.0.0.1 -p $(DNS_PORT) acrazy.org SOA +short
|
||||
@dig @127.0.0.1 -p $(DNS_PORT) acrazy.org NS +short
|
||||
@dig @127.0.0.1 -p $(DNS_PORT) or.acrazy.org A +short
|
||||
|
||||
clean: down ## Remove containers + prepared zones + certs
|
||||
test-tls: ## Smoke-test DoT + DoH against LOCAL endpoints (trusts cert via system CAs)
|
||||
@echo "=== DoT @ 127.0.0.1:$(DOT_PORT), expecting cert for $(CADDY_HOSTNAME) ==="
|
||||
@dig @127.0.0.1 -p $(DOT_PORT) +tls +tls-hostname=$(CADDY_HOSTNAME) \
|
||||
acrazy.org SOA +short
|
||||
@echo ""
|
||||
@echo "=== DoH @ https://$(CADDY_HOSTNAME):$(DOH_PORT)/dns-query ==="
|
||||
@dig @$(CADDY_HOSTNAME) -p $(DOH_PORT) +https acrazy.org A +short
|
||||
|
||||
test-public: ## Smoke-test using the public hostname (DoT/DoH ports must be open + DNS A record set)
|
||||
@echo "=== DoT on public hostname @ port 853 ==="
|
||||
@dig @$(CADDY_HOSTNAME) +tls cloudflare.com A +short
|
||||
@echo "=== DoH on public hostname @ port 443 ==="
|
||||
@dig @$(CADDY_HOSTNAME) +https cloudflare.com A +short
|
||||
|
||||
clean: down ## Remove containers + prepared zones + dev self-signed certs
|
||||
rm -rf zones-prepared/*.zone certs/*.pem
|
||||
|
||||
clean-caddy: down ## Also wipe Caddy's data dir (forces re-issuance from scratch!)
|
||||
@echo "About to delete caddy-data/ — this will force re-issuance from LE."
|
||||
@echo "Hit Ctrl-C in 5s to abort..."
|
||||
@sleep 5
|
||||
rm -rf caddy-data caddy-config
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue