From 7d2e8028b87bdafdce9412c66c19228f40d46887 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stephan=20D=C3=BCsterhaupt?= Date: Sun, 1 Nov 2026 13:36:47 +0100 Subject: [PATCH] docs(config): clarify ACME backend and DNS-01 configuration --- vars.example | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/vars.example b/vars.example index 1b898d6..f42b73f 100644 --- a/vars.example +++ b/vars.example @@ -9,10 +9,10 @@ # Base directory of dynTLS configuration (defaults to script directory) #set_var DYNTLS "${0%/*}" -# Main ACME client program used for certificate operations -# You can set this to any compatible wrapper script or binary -# https://github.com/bruncsak/ght-acme.sh -#set_var DYNTLS_LE_PROGRAM "contrib/acme/letsencrypt.sh" +# Main ACME client program, relative to DYNTLS +# The client must support the command-line interface used by dyntls. +# Use the local backend for the customized BIND/nsupdate DNS-01 workflow. +#set_var DYNTLS_LE_PROGRAM "contrib/acme/letsencrypt_master_local.sh" # OpenSSL binary (path if not in $PATH) #set_var DYNTLS_OPENSSL "openssl" @@ -84,10 +84,24 @@ # Force regenerating keys on renewal (0=no, 1=yes) #set_var DYNTLS_PKI_KEY_FORCE_RENEW 0 -# DNS validation (dns-01 challenge): server address and TSIG key file name -#set_var DYNTLS_DNS_SERVER "root-dns.example365.tld" -#set_var DYNTLS_DNS_TSIG "tsig.key" -#set_var DYNTLS_DNS_ZONE "" +# DNS-01 validation settings for the local ACME backend +# Wildcard certificates require DNS-01 validation. + +# DNS server receiving authenticated dynamic updates +#set_var DYNTLS_DNS_SERVER "dns-primary.example.net" + +# Explicit path to the TSIG/RNDC key file +# The file must exist and be readable by the user running dyntls. +#set_var DYNTLS_DNS_TSIG "$DYNTLS/private/dns-primary_example_net.key" + +# DNS zone setting +# The current wildcard workflow derives the zone from the certificate CN. +#set_var DYNTLS_DNS_ZONE "" + +# The local ACME backend discovers authoritative nameservers from the zone. +# Before requesting validation, it checks all pending challenge TXT values +# in up to 10 rounds, waiting 5 seconds between unsuccessful rounds. +# No additional dyntls configuration variables are required for this check. # ------------------------------------------------------------------ # LOGGING @@ -145,13 +159,13 @@ # Commands to run before issuing/renewing a cert #set_list DYNTLS_CMD_PRE_LIST "" -# Commands to run after successfully issuing/renewing a cert +# Commands to run after the ACME client invocation #set_list DYNTLS_CMD_POST_LIST "" # ------------------------------------------------------------------ # BACKUP AND EXPIRATION # ------------------------------------------------------------------ -# Days to keep backuped certificates before removal +# Days to retain certificate backups before removal # Set to 0 to disable automatic deletion of backups #set_var DYNTLS_BACKUP_EXPIRATION 360