Anyone use Caddy w Porkbun here? Looking for help after updating Caddy…

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨ocean@mander.xyz⁩ to ⁨selfhosted@lemmy.world⁩

I’m slightly freaking out. I recently ran some updates on my Linux Mint server computer. Afterwards, my modules, like Porkbun, had been removed and kept giving a 400 error when trying to add-package. Without the porkbun dns module, caddy can’t pass the keys and nothing with reverse proxy from me. The porkbun git page mentions some upgrade to the DNS system a few days ago that they said was connected to this. Any ideas of what to do? Do I downgrade Caddy until they resolve? I’m not the most computer savvy so I appreciate the help.

source

Comments

Sort:hotnew top

Auli@lemmy.ca ⁨1⁩ ⁨year⁩ ago
Downgrade to 2.9 till the porkbun plugin gets updated to work withb2.10.

source
sxan@midwest.social ⁨1⁩ ⁨year⁩ ago
I’ve never heard of Porkbun, but it doesn’t sound like a caddy issue. Let’s Encrypt requires being able to resolve the DNS name you’re requesting a cert for, and to be able to connect to your web service and fetch a secret to prove you own the domain. If porkbun does something like punch a hole in your LAN firewall and let in http traffic, then porkbun is the problem. Not Caddy.

source
- sugar_in_your_tea@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
  
  and to be able to connect to your web service and fetch a secret to prove you own the domain
  
  This part isn’t true, you can use DNS challenge and they don’t need to connect to your service. I have several services on my LAN that have never been accessible from the internet that have Let’s Encrypt certs.
  
  That sounds like the method OP is trying to use.
  
  source
  - sxan@midwest.social ⁨1⁩ ⁨year⁩ ago
    Hmmm. You’re right; it’s a mechanism I’ve never used because it’s more work and it is slower, and I forget about it. All you need to do is be able to prove you own the domain, and control over the DNS record is certainly viable.
    
    Is that what Porkbun does? Because Caddy can automate the http method, but not the DNS challenge method, because both require a handshake and that’s updating the DNS record.
    
    source
    -> View More Comments
- just_another_person@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Then why did you comment? 😂
  
  source
  - sxan@midwest.social ⁨1⁩ ⁨year⁩ ago
    Because they were wondering if it was a Caddy issue, and I’ll bet real money it isn’t.
    
    Being able to exclude components from being a possible source of the issue is critical to problem solving.
    
    source
Xanza@lemm.ee ⁨1⁩ ⁨year⁩ ago
I guess it depends on how you got caddy to begin with. If you used xcaddy, you have to update caddy the same way (recompile via xcaddy) otherwise you’ll get the default binary which has no misc modules by default, which kinda sounds like what’s happened but who knows for sure.

If you’re feeling daring, you can try to compile caddy yourself with xcaddy, it’s super easy.

Save your Caddyfile’s, and uninstall caddy (ultra important). Install xcaddy (apt install xcaddy [or go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest]). Then use xcaddy to compile caddy with the modules you need;

$ cd /tmp $ xcaddy build --with github.com/caddy-dns/porkbun --with github.com/caddy-dns/cloudflare --with github.com/some-user/whatever-module Caddy will build and be spit out in `/tmp/caddy`. Move it to `/home/username/.local/bin` or something, and make sure that directory is in your path. Don't forget to `chmod +x caddy`. Run caddy like normal and see if this fixes your issue. If not, you'll likely have to try and older version of caddy (uninstall and specifically install the previous version), or wait until they push a fix for whatever they broke.
source
- sugar_in_your_tea@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
  That’s what I did for Cloudflare and it works well.
  
  source
someacnt@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
[deleted]
source
- sugar_in_your_tea@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
  I’m guessing they are doing DNS challenge for getting Let’s Encrypt certs.
  
  source
fishynoob@infosec.pub ⁨1⁩ ⁨year⁩ ago
Sorry, I don’t use either of those services. Would you be willing to explain your setup? I use my own CA with HAProxy for TLS termination (with servers side TLS) so I might be able to give some general tips. Maybe.

source