Temporarily listen on port while doing ACME challenge

[https]

Is it possible to have Caddy listen on a port temporarily only while doing the ACME challenge?

Scenario: private HTTPS server on LAN that needs a valid TLS certificate. Nothing outside the private LAN needs to connect to it except for the ACME servers when the cert needs to be renewed. My idea is to forward router port 80 to internal server port 8888 that Caddy listens on only when it needs to do ACME, otherwise nothing listens on that port (Caddy would always listen on 443 so that internal clients can use it).

Any alternatives to keep this as secure as possible? I know there’s the DNS challenge but that doesn’t work as I use a custom bind9 server, there is no DNS API. It does not appear that Caddy supports nsupdate.

[matt (Matt Holt)]

Listening on a port only for a few seconds instead of longer will not really make you more secure.

But as it stands, if you disable auto HTTPS redirects, Caddy won’t listen on port 80 except when solving the HTTP ACME challenge.

[https]

Any plans for Caddy to support nsupdate to dynamically update Bind9 records? I could allow the named server to accept dynamic TXT updates for _acme-challenge using a TSIG key.

I also just discovered acme-dns which may do what I need in a somewhat secure way. But also unclear whether Caddy can work with it.

[francislavoie]

@https

Any plans for Caddy to support nsupdate to dynamically update Bind9 records?

It’s up to the community to write a libdns plugin for it.

Writing new DNS provider modules for Caddy

Caddy 2 uses a new set of interfaces for its DNS provider APIs. While there is a shim to use all the existing old ones for now, the new APIs offer better performance, leaner builds, and more capabilities. We want all providers to be ported over to the new APIs as soon as possible. Since I do not have accounts with all DNS providers in the world, it’s up to the community to migrate to the new APIs and to maintain their implementations. This post will show you how! For what it’s w…

[https]

What other choices do I have here? Are there any Caddy hooks available where I can script either nsupdate or interacting with acme-dns or am I just better off doing it all outside of Caddy?

[matt (Matt Holt)]

Why is the libdns package not an acceptable solution? That would be the right way to do it, as it integrates directly with Caddy, makes it possible for all other users to benefit, and gives you the best performance and reliability.

[https]

Are you saying it’s already supported in Caddy or that someone needs to write a provider to make it happen?

[matt (Matt Holt)]

It’s supported, but needs to be written. Either you’ll write a script and glue together a bunch of pieces or you’ll write a little bit of Go code that benefits everyone and works natively for your solution. I would recommend and request the latter