Uuuhh. I need to do some DNS things today.
23
Replies
·
0
Boosts
DNS things: I have two certs I renew using the dns-01 challenge, because there is no http involved, and the server needing the cert is mot public facing.
I like the dns challenge, and will likely switch the rest of my infra to use it too.
But!
Up until a week or two ago, the domains the certs are for had their nameservers at Hetzner. My tooling hits the Hetzner API.
The domains are now served by my self-hosted nameserver, so I need to update things.
❯ systemctl status acme-renew-chat.csillger.hu.timer
● acme-renew-chat.csillger.hu.timer - Renew ACME Certificate for chat.csillger.hu
Loaded: loaded (/etc/systemd/system/acme-renew-chat.csillger.hu.timer; enabled; preset: ignored)
Active: active (waiting) since Wed 2026-06-17 22:56:36 CEST; 1 month 0 days ago
Invocation: 497e99b0ceef4fd99618b0382cf7b5fa
Trigger: Sat 2026-07-18 22:30:28 CEST; 12h left
Uhuhuhh! Just about in time I fix this. It'd try to renew via Hetzner, yet, my domain's on my PowerDNS now.
Lovely. switch-to-configuration appears to be stuck. Maybe I'll reboot.
Reboot helped, but... something weird is going on with PowerDNS. I have SOA-EDIT set to INCREMENT-EPOCH, but... oh. I may have to manually edit the record's SOA first, I suppose?
Nah, I need INCEPTION-INCREMENT. Tha.... seems to have done something.
Looks like PDNS is doing the right thing, I can query the challenge. For some reason it fails to propagate to the secondary.
Increasing the loglevel, I see:
Jul 18 11:22:06 eru pdns_server[6814]: Queued also-notification of domain 'csillger.hu' to 204.87.183.53:53
So it allegedly is notifying ns-global.zone, but I'm not sure that's happening?
I do see stuff like...
Jul 18 11:23:09 eru pdns_server[6814]: IXFR-out zone '174070135.xyz', client '204.87.183.53:39761', transfer initiated with serial 2026062906
But that's not the zone I want to notify about.
Hm, the zone got updated, but... way too late.
I suppose the trivial thing to do here is to set an NS record for the appropriate _acme-challenge hosts, so there's only one DNS server: me.
Lets try that.
Uhhh.... syncing the zone with OctoDNS to PowerDNS does not increase the SOA serial for some odd reason.
There we go, fixed. Now we wait.
Fucks sake. Another domain, same domain metadata, SOA does not increase.
@algernon rfc2136 baby - sad there's nothing more modern and support is not consistent across retail providers.
Also ICYMI there's a new ACME challenge thing that's coming that should help with having to ship and manage secrets for self - registration - DNS-PERSIST I think it is
@arichtman yup, looking forward to dns-persist (or w/e it is called, I too, forgot).
