Webhook challenges

.github/workflows/build.yml

@@ -8,4 +8,4 @@ jobs:
  - uses: cachix/install-nix-action@v27
  with:
  nix_path: nixpkgs=channel:nixos-24.05
- - run: nix --experimental-features "nix-command flakes" build
+ - run: nix --experimental-features "nix-command flakes" flake check

Cargo.toml

@@ -25,6 +25,7 @@ vaultrs-login = "0"
 url = "2"
 chrono = "0"
 num-traits = "0"
+reqwest = { version = "0", features = ["json"] }
 
 [profile.release]
 panic = "abort"

config-samples/file-webhook.json

@@ -0,0 +1,27 @@
+{
+ "file_monitor_configs": [{
+ "directory": "test",
+ "prune": false,
+ "specs": [{
+ "name": "jth-test",
+ "cn": "jth.faythe-test.acme.example.com",
+ "sans": [
+ "san1.jth.faythe-test.acme.example.com",
+ "san2.jth.faythe-test.acme.example.com"
+ ]
+ }]
+ }],
+ "lets_encrypt_url": "https://acme-staging-v02.api.letsencrypt.org/directory",
+ "lets_encrypt_email": "[email protected]",
+ "zones": {
+ "acme.example.com": {
+ "auth_dns_server": "ns.example.com",
+ "challenge_driver": {
+ "webhook": {
+ "url": "localhost:8080"
+ }
+ }
+ }
+ },
+ "val_dns_servers": ["8.8.8.8", "8.8.4.4"]
+}

config.json → config-samples/vault-nsupdate.json

@@ -17,8 +17,13 @@
  "lets_encrypt_email": "[email protected]",
  "zones": {
  "acme.example.com": {
- "server": "ns.example.com",
- "key": "acme.example.com.key"
+ "auth_dns_server": "ns.example.com",
+ "challenge_driver": {
+ "nsupdate": {
+ "server": "ns.example.com",
+ "key": "acme.example.com.key"
+ }
+ }
  }
  },
  "val_dns_servers": ["8.8.8.8", "8.8.4.4"]

flake.nix

@@ -31,7 +31,6 @@
  in {
  packages.${system}.${pname} = pkgs.${pname};
  defaultPackage.${system} = pkgs.${pname};
- checks.${system}.vault = pkgs.callPackage ./nixos/vault-test.nix {};
 
  overlays.default = final: prev: {
  "${pname}" = final.craneLib.buildPackage {
@@ -54,6 +53,17 @@
  };
  };
 
+ checks.${system} = {
+ sample-configs = pkgs.runCommandNoCC "check-sample-configs" { nativeBuildInputs = [ pkgs.${pname} ]; } ''
+ DIR=${./config-samples}
+ for FILE in $(ls -1 $DIR); do
+ echo "Testing: $DIR/$FILE"
+ faythe $DIR/$FILE --config-check >>$out
+ done
+ '';
+ vault = pkgs.callPackage ./nixos/vault-test.nix {};
+ };
+
  devShell.${system} = with pkgs; mkShell {
  buildInputs = [
  rust-analyzer

nixos/vault-test.nix

@@ -108,8 +108,11 @@ nixos-lib.runTest (
  lets_encrypt_email = "test_mail@${domain}";
  zones = {
  "${domain}" = {
- server = ns_host;
- key = "test";
+ auth_dns_server = ns_host;
+ challenge_driver.nsupdate ={
+ server = ns_host;
+ key = "test";
+ };
  };
  };
  val_dns_servers = [ ns_host ];

src/common.rs

@@ -139,9 +139,9 @@ impl CertSpec {
  }
  pub fn get_auth_dns_servers(&self, config: &FaytheConfig) -> Result<HashSet<String>, SpecError> {
  let mut res = HashSet::new();
- res.insert(self.cn.find_zone(&config)?.server.clone());
+ res.insert(self.cn.find_zone(&config)?.auth_dns_server.clone());
  for s in &self.sans {
- res.insert(s.find_zone(&config)?.server.clone());
+ res.insert(s.find_zone(&config)?.auth_dns_server.clone());
  }
  Ok(res)
  }
@@ -396,7 +396,7 @@ pub mod tests {
  use std::collections::HashMap;
  use crate::set;
  use super::DNSName;
- use crate::config::{KubeMonitorConfig, FileMonitorConfig, MonitorConfig};
+ use crate::config::{ChallengeDriver, KubeMonitorConfig, FileMonitorConfig, MonitorConfig};
  use chrono::DateTime;
 
  const TIME_FORMAT: &str = "%Y-%m-%dT%H:%M:%S%z"; // 2019-10-09T11:50:22+0200
@@ -432,20 +432,20 @@ pub mod tests {
  fn create_zones(issue_wildcard_certs: bool) -> HashMap<String, Zone> {
  let mut zones = HashMap::new();
  zones.insert(String::from("unit.test"), Zone{
- server: String::from("ns.unit.test"),
- key: String::new(),
+ auth_dns_server: String::from("ns.unit.test"),
+ challenge_driver: ChallengeDriver::NoOp,
  challenge_suffix: None,
  issue_wildcard_certs
  });
  zones.insert(String::from("alternative.unit.test"), Zone{
- server: String::from("ns.alternative.unit.test"),
- key: String::new(),
+ auth_dns_server: String::from("ns.alternative.unit.test"),
+ challenge_driver: ChallengeDriver::NoOp,
  challenge_suffix: None,
  issue_wildcard_certs
  });
  zones.insert(String::from("suffixed.unit.test"), Zone{
- server: String::from("ns.suffixed.unit.test"),
- key: String::new(),
+ auth_dns_server: String::from("ns.suffixed.unit.test"),
+ challenge_driver: ChallengeDriver::NoOp,
  challenge_suffix: Some(String::from("acme.example.com")),
  issue_wildcard_certs
  });
@@ -639,44 +639,44 @@ pub mod tests {
  let config = create_test_kubernetes_config(false);
 
  let host: DNSName = DNSName::try_from(&String::from("host1.subdivision.unit.wrongtest")).unwrap();
- let z = host.find_zone(&config.faythe_config);
- assert!(z.is_err());
+ let zone = host.find_zone(&config.faythe_config);
+ assert!(zone.is_err());
 
  let host: DNSName = DNSName::try_from(&String::from("host1.subdivision.foo.test")).unwrap();
- let z = host.find_zone(&config.faythe_config);
- assert!(z.is_err());
+ let zone = host.find_zone(&config.faythe_config);
+ assert!(zone.is_err());
 
  let host: DNSName = DNSName::try_from(&String::from("test")).unwrap();
- let z = host.find_zone(&config.faythe_config);
- assert!(z.is_err());
+ let zone = host.find_zone(&config.faythe_config);
+ assert!(zone.is_err());
 
  let host: DNSName = DNSName::try_from(&String::from("google.com")).unwrap();
- let z = host.find_zone(&config.faythe_config);
- assert!(z.is_err());
+ let zone = host.find_zone(&config.faythe_config);
+ assert!(zone.is_err());
 
  let host: DNSName = DNSName::try_from(&String::from("host1.subdivision.unit.test")).unwrap();
- let z = host.find_zone(&config.faythe_config);
- assert!(z.is_ok());
+ let zone = host.find_zone(&config.faythe_config);
+ assert!(zone.is_ok());
  }
 
  {
  let config = create_test_kubernetes_config(false);
 
  let host: DNSName = DNSName::try_from(&String::from("host1.subdivision.unit.test")).unwrap();
- let z = host.find_zone(&config.faythe_config).unwrap();
- assert_eq!(z.server, "ns.unit.test");
+ let zone = host.find_zone(&config.faythe_config).unwrap();
+ assert_eq!(zone.auth_dns_server, "ns.unit.test");
 
  let host: DNSName = DNSName::try_from(&String::from("host1.subdivision.alternative.unit.test")).unwrap();
- let z = host.find_zone(&config.faythe_config).unwrap();
- assert_eq!(z.server, "ns.alternative.unit.test");
+ let zone = host.find_zone(&config.faythe_config).unwrap();
+ assert_eq!(zone.auth_dns_server, "ns.alternative.unit.test");
 
  let host: DNSName = DNSName::try_from(&String::from("host1.subdivision.other-alternative.unit.test")).unwrap();
- let z = host.find_zone(&config.faythe_config).unwrap();
- assert_eq!(z.server, "ns.unit.test");
+ let zone = host.find_zone(&config.faythe_config).unwrap();
+ assert_eq!(zone.auth_dns_server, "ns.unit.test");
 
  let host: DNSName = DNSName::try_from(&String::from("unit.test")).unwrap();
- let z = host.find_zone(&config.faythe_config).unwrap();
- assert_eq!(z.server, "ns.unit.test");
+ let zone = host.find_zone(&config.faythe_config).unwrap();
+ assert_eq!(zone.auth_dns_server, "ns.unit.test");
  }
  }
 

src/config.rs

@@ -91,13 +91,42 @@ pub struct ConfigContainer {
 #[derive(Clone, Deserialize, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct Zone {
- pub server: String,
- pub key: String,
+ pub auth_dns_server: String,
+ pub challenge_driver: ChallengeDriver,
  pub challenge_suffix: Option<String>,
  #[serde(default = "default_issue_wildcard_certs")]
  pub issue_wildcard_certs: bool,
 }
 
+#[derive(Clone, Deserialize, Debug)]
+#[serde(deny_unknown_fields)]
+#[serde(rename_all = "lowercase")]
+pub enum ChallengeDriver {
+ NSUpdate(NSUpdateDriver),
+ NoOp,
+ Webhook(WebhookDriver),
+}
+
+#[derive(Clone, Deserialize, Debug)]
+#[serde(deny_unknown_fields)]
+pub struct NSUpdateDriver {
+ pub server: String,
+ pub key: String,
+}
+
+#[derive(Clone, Deserialize, Debug)]
+#[serde(deny_unknown_fields)]
+pub struct WebhookDriver {
+ #[serde(deserialize_with = "deserialize_url")]
+ pub url: Url,
+ #[serde(default = "default_timeout_secs")]
+ pub timeout_secs: u8,
+}
+
+fn default_timeout_secs() -> u8 {
+ 10
+}
+
 impl ConfigContainer {
  pub fn get_kube_monitor_config(&self) -> Result<&KubeMonitorConfig, SpecError> {
  Ok(match &self.monitor_config {