Repository navigation
feat(traefik): add Selectel v2 DNS-01 challenge support - #221
Merged
Merged
Conversation
lego's selectelv2 provider authenticates via Keystone/OpenStack and needs four credentials at once, so it can't fit the single-token x-dns-challenge-tokens fan-out pattern. Add SELECTELV2_USERNAME, SELECTELV2_PASSWORD, SELECTELV2_ACCOUNT_ID, and SELECTELV2_PROJECT_ID as explicit, optional x-vault-env entries instead. Fixes #220 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…plicitly Drop the shared DNS_CHALLENGE_TOKEN fan-out for single-token providers (CF_DNS_API_TOKEN, DO_AUTH_TOKEN, HETZNER_API_TOKEN, LINODE_TOKEN) so every provider follows the same explicit, non-fanned-out pattern as Selectel v2 - one vault variable per lego credential, regardless of how many a provider needs. Update vaults/traefik.yml's live mapping to match. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…r names
CF_DNS_API_TOKEN and DO_AUTH_TOKEN are lego's own forced container-side
env var names (CF_/DO_ prefixes are hardcoded in lego, not our choice),
but the app-facing ${VAR:-} name a target's vault maps into doesn't have
to mirror that abbreviation. Point both at fully-spelled-out names
instead: ${CLOUDFLARE_DNS_API_TOKEN:-} and ${DIGITALOCEAN_AUTH_TOKEN:-}.
Hetzner/Linode/Selectel v2's forced names were already unabbreviated,
so they're unchanged. Update vaults/traefik.yml's live mapping to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2 tasks done
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
selectelv2provider authenticates via Keystone/OpenStack and needs four credentials at once (SELECTELV2_USERNAME,SELECTELV2_PASSWORD,SELECTELV2_ACCOUNT_ID,SELECTELV2_PROJECT_ID), so it can't fit the previous single-tokenx-dns-challenge-tokensfan-out patternapps/traefik/docker-compose.yml'sx-vault-env, with the container-side key matching lego's own forced env var name one-for-one: Cloudflare'sCF_DNS_API_TOKEN, DigitalOcean'sDO_AUTH_TOKEN, Hetzner'sHETZNER_API_TOKEN, Linode'sLINODE_TOKEN, and Selectel v2's four. The sharedDNS_CHALLENGE_TOKENfan-out variable is dropped entirely.CF_/DO_- hardcoded in lego, not negotiable), the app-facing${VAR:-}side is decoupled and spelled out in full instead:${CLOUDFLARE_DNS_API_TOKEN:-}and${DIGITALOCEAN_AUTH_TOKEN:-}. Hetzner/Linode/Selectel v2's forced names were already unabbreviated, so those are unchanged.vaults/traefik.yml(the live hawkeye/rubykatzen.com target) updated to map its Cloudflare secret through the new fullCLOUDFLARE_DNS_API_TOKENapp-facing nameAGENTS.md's "Traefik Integration" section rewritten to document the explicit-naming pattern, the container-key-vs-app-facing-name split, and how to add a new providerCloses #220
Test plan
docker compose -f apps/traefik/docker-compose.yml configwith required vars set renders all provider credential vars correctly, including the Cloudflare full-name substitution, defaulting to empty string when unset🤖 Generated with Claude Code