security/acme-client: Add support for Google Domains DNS API

[nmiller0113]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.
(e.g. I would like an input field in the /ui/firewall/alias which would add .... to ....)

Please add the exisiting deployment option from acme.sh that supports the Google Domains using their API
https://github.com/acmesh-official/acme.sh/wiki/dnsapi2#157-use-google-domains-dns-api

To Reproduce
Steps to reproduce the behavior:

Go to 'Challenge Types'
Click on 'add'
Scroll down to 'search Google Domains in the list of dns services'
See error ---> it is missing

[fraenki]

Although the upstream PR acmesh-official/acme.sh#4542 was merged, there is no official release of acme.sh available that provides support for this new DNS API. We'll have to wait until a new release of acme.sh is available.

[nmiller0113]

@fraenki, thanks for the quick reply. Am I mistaken in what I’m seeing here?

https://github.com/acmesh-official/acme.sh/tree/master/dnsapi

I see dns_googledomains.sh in there, so that’s why I was curious.

I actually read of someone using it in another forum first, so I thought I’d ask here as well since I use both. Here’s that link:

https://forum.proxmox.com/threads/please-add-support-for-google-domains-dns-api.124434/#post-551143

Thanks again!

[fraenki]

I see dns_googledomains.sh in there, so that’s why I was curious.

It was merged to the code repository, yes. But there is no official release with support for Google Domains just yet. We only use official releases. Once there is a new release of acme.sh I will add support for Google Domains.

[nmiller0113]

Ahhh, I see what you mean @fraenki! My apologies for the misunderstanding!

[nmiller0113]

Although the upstream PR acmesh-official/acme.sh#4542 was merged, there is no official release of acme.sh available that provides support for this new DNS API. We'll have to wait until a new release of acme.sh is available.

@fraenki I believe that the new official release contains the support. Thank you!

https://github.com/acmesh-official/acme.sh/releases/tag/3.0.6

https://github.com/acmesh-official/acme.sh/commits/3.0.6

[fichtner]

Yep, required file was added... opnsense/ports@f5632185f54d3

[nmiller0113]

Yep, required file was added... opnsense/ports@f5632185f54d3

Thanks for sharing this @fichtner. Forgive my ignorance on this, but do you know the next steps on where this has to go before it is released as an opnsense update?

[fichtner]

While acme.sh itself will be 3.0.6 in 23.1.10 I’m unsure about the plugin state. If it’s not selectable now it still needs to be added to the plugin. I don’t see any pending changes in the development version, not sure about open PR here.

[nmiller0113]

While acme.sh itself will be 3.0.6 in 23.1.10 I’m unsure about the plugin state. If it’s not selectable now it still needs to be added to the plugin. I don’t see any pending changes in the development version, not sure about open PR here.

Thanks @fichtner. Perhaps @fraenki knows? I'm on 23.1.9 currently and do not see an option for 23.1.10. I'm assuming it's a development/beta version.

[fichtner]

There is no beta/development code in our repository. Mentioned it before.

[nmiller0113]

There is no beta/development code in our repository. Mentioned it before.

@fichtner, I was referring to updating my opnsense version to 23.1.10, not to the plugin beta/development. I did follow what you were mentioning. Thanks!

[fichtner]

Let me clarify: unless something is actively added to the plugin for 23.1.10 you won't be able use the new dns_googledomains addition from acme.sh package itself.

[fichtner]

It looks like #3429 might do the trick?

If you are on 23.1.9 with the acme.sh hotfix installed (check for version 3.0.6) you can try and test:

# opnsense-patch -c plugins e10a96037fa5

But there is a comment here that the PR is not complete: #3429 (comment)

Cheers,
Franco

[nmiller0113]

Let me clarify: unless something is actively added to the plugin for 23.1.10 you won't be able use the new dns_googledomains addition from acme.sh package itself.

I understood @fichtner, thank you very much!

[nmiller0113]

It looks like #3429 might do the trick?

If you are on 23.1.9 with the acme.sh hotfix installed (check for version 3.0.6) you can try and test:

# opnsense-patch -c plugins e10a96037fa5

But there is a comment here that the PR is not complete: #3429 (comment)

Cheers, Franco

@fichtner, is the opnsense-patch command you shared the way to install the hotfix mentioned? Sorry, have not done a hotfix in opnsense yet. Thanks again!

[fichtner]

@nmiller0113 yep, opnsense-patch is a builtin. Run it from a root console on the OPNsense. It fetches the patch from GitHub and tries to install it so you don't have to :)

[fraenki]

PR #3499 was merged, so this should be available in one of the next OPNsense releases.

[nmiller0113]

PR #3499 was merged, so this should be available in one of the next OPNsense releases.

Thank you @fraenki, I'm very much looking forward to the next OPNsense release!

[slackadelic]

Well glad to see this being added. Hopefully a full patch will go out at some point before the next release so we can fully utilize this!