Setting up local Caddy with Porkbun

Submitted ⁨⁨22⁩ ⁨hours⁩ ago⁩ by ⁨kiol@discuss.online⁩ to ⁨selfhosted@lemmy.world⁩

https://wiki.livingcartoon.org/software/caddy

cross-posted from: discuss.online/post/41958206

Open to suggestions for managing Caddy for domains from Porkbun.

Porkbun itself is using Cloudflare.

Their Caddy module is confusing to setup due to API changes and older documentation.

I’d like to use a declarative json configuration, but first I just need Porkbun to play nice enough to work when adding subdomains via wildcard.

The Goal

Setup legit Let’s Encrypt as wildcard locally to test services at *example.domain.com, then put them into production on mainsite wildcard *.domain.com on VPS or similar.

Seeking Advice

Can anyone advise on setup recommendations. I’m currently using Nginx, which I had no difficulty setting up with ACME challenge. Perhaps I’m approaching Caddy in the wrong way. Thanks for any ideas!

original

Comments

Sort:hotnew top

moonpiedumplings@programming.dev ⁨22⁩ ⁨hours⁩ ago

Setup legit Let’s Encrypt as wildcard locally to test services at *example.domain.com, then put them into production on mainsite wildcard *.domain.com on VPS or similar.

Just to be clear, why wouldn’t simply provisioning a certificate for each subdomain under the wildcard work?

Like, if you have a test site test.example.domain.com, you could have nginx (using acme) create a certificate for that. And then when you move to test.domain.com, nginx would do the same thing.

Now, technically letsencrypt does have a rate limit, but it’s a fairly generous rate limit:

Up to 50 certificates can be issued per registered domain (or IPv4 address, or IPv6 /64 range) every 7 days. This is a global limit, and all new order requests, regardless of which account submits them, count towards this limit. The ability to issue new certificates for the same registered domain refills at a rate of 1 certificate every 202 minutes.

I would do my testing this way, and I didn’t hit any limits, although I was careful to keep certificates and reuse them, and to not spam.

If you need more domains with SSL than that rate limit would provide, then it would make sense to investigate Caddy with porkbun, since DNS-01 challenges are the only way to get wildcard certificates, which apply to a whole wildcard.

original
- Pika@sh.itjust.works ⁨18⁩ ⁨hours⁩ ago
  I wasn’t aware of that the managed registered domains the way they do. I may need to reconcider my certificate setup currently, as I currently run a certificate per service because its more secure, but if they count x.website.com certificates as website.com certificates, its entirely possible that when they switch to short lived certificate defaults I may come close to that rate limit.
  
  original
  - i_am_not_a_robot@discuss.tchncs.de ⁨18⁩ ⁨hours⁩ ago
    If they cut the validity time for certificates, I’d expect them to also increase the rate limits by a corresponding amount. It’s not like they have anything to gain by making it so regular users can’t use the service anymore. They can’t upsell you to Lets Encrypt Premium with a higher rate limit.
    
    original
    -> View More Comments
- kiol@discuss.online ⁨22⁩ ⁨hours⁩ ago
  Thanks for the thoughts. I’ll reference this as I continue working on this.
  
  original
SlowGoose6523@thelemmy.club ⁨17⁩ ⁨hours⁩ ago
I have Porkbun domains and am getting ready to try setting up Caddy so randomly stumbling onto this thread is serendipitous.

original
moonpiedumplings@programming.dev ⁨22⁩ ⁨hours⁩ ago
Second comment, but if you need/want Caddy we can help that too. It looks like the documentation link in the github page you linked is dead, and the correct one is: caddyserver.com/docs/json/apps/tls/…/acme/

I found that from this page: caddy.community/t/…/8148

original
- kiol@discuss.online ⁨22⁩ ⁨hours⁩ ago
  Thanks again. Will reference this as well, and provide update with what happens.
  
  original
ransomwarelettuce@lemmy.world ⁨17⁩ ⁨hours⁩ ago
my homelab is using this setup, I configured porkbun API, compiled caddy with the DNS challenge plugin and configured it.

codeberg.org/Disco-Robot/homelab

codeberg.org/Disco-Robot/homelab/…/caddy.yaml

codeberg.org/Disco-Robot/homelab/…/caddyfile.j2

I am using ansible with jinja templates there, if you are not familiar with it or have any doubt feel free to ask.
original
i_am_not_a_robot@discuss.tchncs.de ⁨18⁩ ⁨hours⁩ ago
Porkbun is a registrar that also has DNS hosting, and ACME DNS challenges just need DNS hosting. I also use Porkbun and I am happy with them as a registrar, but their DNS service wasn’t working out for me and I host my DNS records on Desec. It’s working well for me after I increased some timeouts in my ACME client configuration but I can’t recommend it if you’re having problems with Porkbun because the Desec rate limits are strict and their TTLs are high and if you don’t already know what you’re doing you’re likely to spend a lot of time waiting for propagation or rate limits.

original