1. The problem I’m having:
I am using the acme_dns and cert_issuer global configuration options in my Caddyfile, but some of the domains I’m running Caddy for have different responses from my DHCP-provided DNS server (NextDNS) and don’t fall through to the correct nameserver. This is not an issue in general as the only network using this DNS is my local network, and there I don’t need TXT records or other things that internet services may need when using my domain. The domains exist on the regular internet-bound resolvers, the NextDNS configuration simply returns different values for these domains (local IP addresses instead of Cloudflare IP addresses which is what the internet-bound resolvers return).
The problem, concisely defined, is that when Caddy is trying to find the records it’s creating, it’s using my local DNS server, which isn’t returning these records (because it doesn’t know about them). If I were using the tls { dns { ... } } option for configuring this per-site, then I could supply the tls { resolvers ... } option, and this would work fine, but since I am using global config, I have no way to define this except switch the DNS resolver for the system running caddy entirely, but some of my reverse_proxy configurations rely on responses from my DHCP provided DNS resolver as well, so this won’t work without hardcoding IP addresses instead, which is undesirable.
Am I missing something and there is actually a way to configure the ACME-subsystems DNS resolver globally without changing the DNS resolver used for other things?
2. Error messages and/or full log output:
ERROR tls.renew could not get certificate from issuer {"identifier": "mydomain.tld", "issuer": "acme.zerossl.com-v2-DV90", "error": "[mydomain.tld solving challenges: presenting for challenge: adding temporary record for zone \"_acme-challenge.mydomain.tld.\": expected 1 zone, got 0 for _acme-challenge.mydomain.tld. (order=https://acme.zerossl.com/v2/DV90/order/snipped) (ca=https://acme.zerossl.com/v2/DV90)"}
3. Caddy version:
v2.7.6 h1:w0NymbG2m9PcvKWsrXO6EEkY9Ru4FJK8uQbYcev1p3A=
4. How I installed and ran Caddy:
https://aur.archlinux.org/packages/caddy-cloudflare
a. System environment:
Arch Linux, systemd
b. Command:
/usr/bin/caddy run --config /etc/caddy/Caddyfile
c. Service/unit/compose file:
d. My complete Caddy config:
/etc/caddy/Caddyfile:
import /etc/caddy/conf.d/*
/etc/caddy/conf.d/01-global:
{
admin off
email my@email
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
cert_issuer zerossl {env.ZEROSSL_API_KEY}
log {
format console
}
}
/etc/caddy/conf.d/10-snippets:
(cloudflare_dns) {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
resolvers 1.1.1.1 1.0.0.1
}
}
(common) {
header Server "<My Name Here> in real-time"
}
(cors) {
@options {
method OPTIONS
}
header Access-Control-Allow-Origin "*"
header Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD, DELETE"
header Access-Control-Allow-Headers "Authorization, Origin, X-Requested-With, Content-Type, Accept"
respond @options 200
}
/etc/caddy/conf.d/99-sites:
import /etc/caddy/sites-enabled/*
And then in sites-enabled I have 23 sites, but here’s one example that uses one of the relevant domains.
/etc/caddy/sites-enabled/personal:
mydomain.tld {
import common
header strict-transport-security "max-age=31556926; includeSubDomains; preload"
redir https://mypunycodedomain.tld{uri}
}
mypunycodedomain.tld {
import common
reverse_proxy http://internal-server-1.mydomain.lan:14000 {
header_down -server
transport http
}
tls {
protocols tls1.2 tls1.3
}
}
