How to mutualize TLS configuration with a custom provider?

1. The problem I’m having:

I have a fully working configuration, however with a lot of duplicated configuration for every sub-domains. I would like to mutualize at global level some part of the TLS configuration, with a custom provider (“DNS OVH”) coming from an extra plugin (added at runtime with xcaddy).

It’s probably a beginner question, but i tried A LOT of different configuration, and none of them is working :frowning:

2. Error messages and/or full log output:

Here is an extract of a working configuration, at subdomain level (and i have many like that, so i would like to mutualize the dns ovh part in a global way).

Fully working example (with everything duplicated in each subdomain definition) :

homeassistant.domain.tld {
	reverse_proxy 192.168.8.139:8123
	tls {
		dns ovh {
			endpoint ovh-eu
			application_key <REDACTED>
			application_secret <REDACTED>
			consumer_key <REDACTED>
		}
	}
}

I tried this at the top (so below are several “non-working global configuration”) :

{
	tls {
		dns ovh {
			endpoint ovh-eu
			application_key <REDACTED>
			application_secret <REDACTED>
			consumer_key <REDACTED>
		}
	}
}

or

https:// {
	tls {
		dns ovh {
			endpoint ovh-eu
			application_key <REDACTED>
			application_secret <REDACTED>
			consumer_key <REDACTED>
		}
	}
}

or

*.domain.tld {
	tls {
		dns ovh {
			endpoint ovh-eu
			application_key <REDACTED>
			application_secret <REDACTED>
			consumer_key <REDACTED>
		}
	}
}

Plus many other tests, and each time, the behavior is the same : the dns ovh directive is not considered anymore, and caddy is just trying to use letsencrypt (or other challenges), and is then failing (per my network configuration, as nothing is exposed over internet). So i’ve not been able to found the proper way to put that configuration in a global way (only once in the Caddyfile, and applied to several subdomains).

Also tests are not so easy (so maybe i missed something), as caddy is always trying different challenges (in my case, i would have preferred to be able to disable everything except that DNS OVH flavor, of course, but i’m not sure it’s possible / quick tests have not worked).

3. Caddy version:

As i’m building with xcaddy, i’m using the latest version

caddy --version
v2.10.0 h1:fonubSaQKF1YANl8TXqGcn4IbIRUDdfAkpcsfI/vX5U=

4. How I installed and ran Caddy:

caddy is running in a docker container.

Dockerfile

ARG CADDY_VERSION=2
FROM caddy:${CADDY_VERSION}-builder AS builder

RUN xcaddy build \
    --with github.com/lucaslorentz/caddy-docker-proxy/v2 \
    --with github.com/caddyserver/cache-handler \
    --with github.com/caddy-dns/ovh

FROM caddy:${CADDY_VERSION}-alpine

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

CMD ["caddy", "docker-proxy"]

5. Links to relevant resources:

I’m using 2 plugins :

If you just want to configure the DNS provider for TLS, use acme_dns in the global options section

Otherwise, look into using snippets