BSD Portswip/acme-dns 1.0 NetBSD
Simplified DNS server to automate ACME DNS challenges
- System
- NetBSD
- Repository
- pkgsrc-wip
- Maintainer
- [email protected]
- License
- mit
- Categories
- wip, security
Description
A simplified DNS server with a RESTful HTTP API to provide a simple way to automate ACME DNS challenges.
Many DNS servers do not provide an API to enable automation for the ACME DNS challenges. Those which do, give the keys way too much power. Leaving the keys laying around your random boxes is too often a requirement to have a meaningful process automation.
Acme-dns provides a simple API exclusively for TXT record updates and should be used with ACME magic "\_acme-challenge" - subdomain CNAME records. This way, in the unfortunate exposure of API keys, the effects are limited to the subdomain TXT record in question.
So basically it boils down to **accessibility** and **security**.
For longer explanation of the underlying issue and other proposed solutions, see a blog post on the topic from EFF deeplinks blog: https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation
In the other systems
The newest version among them is 1.0, as upstream numbers it.
| System | Port | Version | Vulnerabilities | Status | Maintainer | Last update |
|---|---|---|---|---|---|---|
| NetBSD | wip/acme-dns | 1.0 newest | none known | - | [email protected] | - |
| FreeBSD | dns/acme-dns by name | 1.0_43,1 newest | none known | - | [email protected] | 2026-10-20 |
| DragonFly | dns/acme-dns by name | 1.0_20,1 newest | none known | - | [email protected] | - |
| MidnightBSD | dns/acme-dns by name | 1.0,1 newest | no data | - | [email protected] | - |
| HardenedBSD | dns/acme-dns by name | 1.0_41,1 newest | no data | - | [email protected] | - |
| GhostBSD | dns/acme-dns by name | 1.0_41,1 newest | no data | - | [email protected] | - |
Install
From pkgsrc-wip (no binary package):
cd /usr/pkgsrc/wip/acme-dns && make install cleanDependencies
No port depends on this one.