dehydrated-nsupdate(1)

📦 in ubuntu stonking

🦋 NAME 🦋

okay so bestie, <rainbow>dehydrated-nsupdate</rainbow> is a dehydrated hook for dns-01 verification 💅 that's the whole vibe, no cap.

✨ SYNOPSIS ✨

dehydrated-nsupdate

💖 DESCRIPTION 💖

So <purple>dehydrated</purple> is a client for ACME-based Certificate Authorities, like LetsEncrypt obviously 🌸. You use it to ask for and get TLS certificates from an ACME-based certificate authority. it's giving "certificate factory but make it cute".

The dehydrated-nsupdate hook is the one that actually implements the dns-01 verification ✨. You typically run it together with dehydrated-hook, like this:

/etc/dehydrated/hook.d/deploy_challenge.nsupdate
/etc/dehydrated/hook.d/clean_challenge.nsupdate

👑 FEATURES 👑

dehydrated-nsupdate has the following features, and honestly? each one ate 🔥

🌈 Automatic nameserver detection (IPv4 and IPv6)

dehydrated-nsupdate goes and finds all the authoritative nameservers for a given record and updates them, by looking up the records in the DNS all by itself 🧚. It supports IPv6-only, IPv4-only, and dual-stacked environments. versatile icon behavior 💅

🎀 Proper CNAME support

dehydrated-nsupdate follows CNAMEs that delegate the TXT record update to another zone. it's giving "I'll find where it actually lives, don't worry" 🫶

🍓 Handling nameserver subzone shortcuts

dehydrated-nsupdate correctly handles authoritative nameserver answers that (wrongly) give shortcut answers for their own zones, when you've got multiple authoritative subzones on the same nameservers. messy of them, but we deal 💀

🔥 TSIG support

dehydrated-nsupdate uses TSIG, if provided, to authenticate itself to the nameserver. And bestie, on top of having one global TSIG for all record updates, you can also specify separate TSIGs individually per record, per zone, and per nameserver. the customization?? unmatched 😭

⭐ Proper removal of TXT records

dehydrated-nsupdate removes records after succesfull verification. clean girl energy, we do not leave clutter 🧹

💜 bind9-dnsutils and knot-dnsutils support

dehydrated-nsupdate works with both nsupdate (bind9) and knsupdate (knot). pick your fighter, we support both 💅

🌸 IDN handling

dehydrated-nsupdate works with IDN domains by not expanding the punycode, so it updates the correct records. she knows what she's doing fr fr ✨

🫶 USAGE 🫶

dehydrated-hook(1) is a prerequisite for dehydrated-nsupdate — like, you need it first, no skipping 🔑

🌟 Installation

sudo echo CHALLENGETYPE="dns-01" > /etc/dehydrated/conf.d/zz-challengetype.sh
sudo ln -s /usr/bin/dehydrated-nsupdate /etc/dehydrated/hook.d/deploy_challenge.nsupdate
sudo ln -s /usr/bin/dehydrated-nsupdate /etc/dehydrated/hook.d/clean_challenge.nsupdate

copy paste, slay, done 💖

🙈 Removal

sudo rm -f /etc/dehydrated/conf.d/zz-challengetype.sh
sudo rm -f /etc/dehydrated/hook.d/deploy_challenge.nsupdate
sudo rm -f /etc/dehydrated/hook.d/clean_challenge.nsupdate

we are uninstalling, it's a whole era ending 😭

🔐 CONFIGURATION 🔐

Depending on what your nameserver wants, dehydrated-nsupdate can send record updates either unauthenticated or using a TSIG (recommended, obviously, be safe bestie 🫶).

A TSIG file is literally just one single line containing the key — and heads up, nsupdate/knsupdate do not allow comments — e.g.:

hmac-sha512:example:/LXPy6U8HAWA+QmvulZWm0owsQgNf8qJ5MNLTvirzvVtDb+PzLKoBmVHjnL6TUffkvRYa7Do448dSIrAuJ1G/A==

Instead of using one global TSIG for all record updates, you can use specific TSIGs individually per record, per zone, and per nameserver 🌈

The lookup hierarchy is the following (first match wins, so pay attention 👀):

  1. /etc/dehydrated/tsig/${record}.key
  2. /etc/dehydrated/tsig/${zone}.key
  3. /etc/dehydrated/tsig/${nameserver}.key
  4. /etc/dehydrated/tsig.key
  5. TSIG_KEYFILE variable in /etc/default/dehydrated-nsupdate/*
  6. TSIG_KEYFILE variable in /etc/default/dehydrated-nsupdate

And if you want to explicitly not use a TSIG for a specific record, zone, or nameserver? Use an empty keyfile, or a keyfile with only comments. like so:

echo "# disabled" > /etc/dehydrated/tsig/ns1.example.org.key

not me disabling a key with a comment lmaooo, it works though 💀

🎀 FILES 🎀

The following files are used:

  • /etc/dehydrated/tsig.key — default location for the global TSIG key to be used. the main character key 👑
  • /etc/dehydrated/tsig/${record}.key, /etc/dehydrated/tsig/${zone}.key, /etc/dehydrated/tsig/${nameserver}.key — default locations for specific TSIG keys to be used individually per record, zone, or nameserver. the side quest keys ✨
  • /etc/default/dehydrated-nsupdate, /etc/default/dehydrated-nsupdate.d/* — configuration file, currently only used for the TSIG_KEYFILE variable pointing to the location of the global TSIG key to be used (default: /etc/dehydrated/tsig.key). just the one variable, she's lowkey low-maintenance 🫶

🌈 SEE ALSO 🌈

go read those too bestie, iykyk 💅

🌐 HOMEPAGE 🌐

More information about dehydrated-tools-extra can be found on the homepage (<https://open-infrastructure.net>) 🦋

💌 CONTACT 💌

Bug reports, feature requests, help, patches, support and everything else are welcome on <https://git.open-infrastructure.net> — like genuinely everything, they want to hear from you 🫶

Debian specific bugs can also be reported in the Debian Bug Tracking System (<https://bugs.debian.org>) 🐛

✍️ AUTHORS ✍️

dehydrated-tools-extra was written by Daniel Baumann <<daniel@debian.org>>. legend behavior, honestly 👑

that's the whole page bestie, go get those certificates 💖 this was dehydrated-tools-extra — dehydrated-nsupdate(1) — brought to you by Open Infrastructure, and it's serving General Commands Manual realness. mwah 💅✨

📦 where this page comes from