Best Way to Automatically Update IP in DNS Module?

1. The problem I’m having:

I’m trying to find the best way to automatically update my Caddyfile with the correct IP in the Namecheap DNS module.

2. Error messages and/or full log output:

Not relevant.

3. Caddy version:

v2.9.1 h1:OEYiZ7DbCzAWVb6TNEkjRcSCRGHVoZsJinoDR/n9oaY=

4. How I installed and ran Caddy:

Downloaded with the necessary plugins. DynamicDNS and Namecheap.

a. System environment:

Arch Linux using linux-hardened kernel, x86_64
Rootless Podman

b. Command:

systemctl --user start caddy.socket

c. Service/unit/compose file:

# container-caddy.service
# autogenerated by Podman 5.3.2
# Mon Feb 10 14:29:57 MST 2025

[Unit]
Description=Podman container-caddy.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
        --cidfile=%t/%n.ctr-id \
        --cgroups=no-conmon \
        --rm \
        --name caddy \
        --replace \
        --add-host pihole:172.17.0.5 \
        --add-host unbound:172.17.0.10 \
        --add-host vaultwarden:172.19.0.5 \
        --network dns \
        --network vaultwarden \
        --sdnotify=container \
        -d \
        -v /home/riley/.config/containers/storage/caddy/caddy:/usr/bin/caddy \
        -v /home/riley/.config/containers/storage/caddy/Caddyfile:/etc/caddy/Caddyfile:Z \
        -v /home/riley/.config/containers/storage/caddy/caddy-config:/config \
        -v /home/riley/.config/containers/storage/caddy/caddy-data:/data \
        --env EMAIL=rileymotter@protonmail.com \
        --env LOG_FILE=/data/access.log docker.io/library/caddy /usr/bin/caddy run \
        --config /etc/caddy/Caddyfile
ExecStop=/usr/bin/podman stop \
        --ignore -t 10 \
        --cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm \
        -f \
        --ignore -t 10 \
        --cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target

d. My complete Caddy config:

{
        debug
        admin fd/6
        dynamic_dns {
                provider namecheap {
                        api_key redacted
                        user redacted
                }
                domains {
                        famdam.top @
                }
                versions ipv4
        }
}

*.famdam.top {
        tls {
                dns namecheap {
                        api_key redacted
                        user redacted
                        api_endpoint https://api.namecheap.com/xml.response
                        client_ip 139.60.65.236
                }
        }
        bind fd/3 {
                protocols h1
        }
        bind fd/4 {
                protocols h1 h2
        }
        bind fdgram/5 {
                protocols h3
        }
        @vaultwarden host vaultwarden.famdam.top
        handle @vaultwarden {
                reverse_proxy vaultwarden:80 {
                        header_up X-Forwarded-For {http.request.header.X-Real-IP}
                }
        }
        @wireguard host wireguard.famdam.top
        handle @wireguard {
                reverse_proxy wireguard:80 {
                        header_up X-Forwarded-For {http.request.header.X-Real-IP}
                }
        }
        @pihole host pihole.famdam.top
        handle @pihole {
                reverse_proxy pihole:80 {
                        header_up X-Forwarded-For {http.request.header.X-Real-IP}
                }
        }
        @srv-teamspeak-1 host teamspeak.famdam.top
        handle @srv-teamspeak-1 {
                reverse_proxy 192.168.1.60:9987 {
                        header_up X-Forwarded-For {http.request.header.X-Real-IP}
                }
        }
        handle {
                abort
        }
        encode zstd gzip
}

5. Links to relevant resources:

Did you try omitting it and allowing the discovery process to figure it out? Modules - Caddy Documentation

It seems pretty weird that their API allows you to specify your IP address in the request, rather than them just taking it from your connection. That seems pretty easy to spoof.

2 Likes

I did see that and tried it, but maybe I didn’t have the formatting correct. I don’t remember the specific log, but it cried that there was nothing after the client_ip field. I’ll try to play around with it tomorrow.

You would need to comment out client_ip entirely, not just leave the parameter out.

Yeah. That did it. I appreciate your help, Hamish.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.