Page MenuHomePhabricator

Write designate integration script for certcentral DNS challenges
Closed, ResolvedPublic

Description

To get wildcard certs in deployment-prep, either we do this, or we run our own gdnsd instance, get the beta.wmflabs.org domain removed from labs-ns*, and get an NS record created under wmflabs.org pointing beta.wmflabs.org at our gdnsd server.
Here's the integration script for gdnsd: https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/459809/11/modules/certcentral/files/dns-sync.py

Event Timeline

I finally got around to writing the basic script today (copy at deployment-acme-chief03:/usr/local/bin/acme-chief-designate-sync.py) and it pretty much works, there are some minor things to fix (config and maybe a domain name logic thing) and maybe one fundamental problem to resolve (mechanism to expire challenges - really want to solve that before having a go at getting the unified cert :))

Change 497670 had a related patch set uploaded (by Alex Monk; owner: Alex Monk):
[operations/puppet@production] [WIP] acme-chief: Add script for Designate integration

https://gerrit.wikimedia.org/r/497670

Change 497670 merged by Vgutierrez:
[operations/puppet@production] acme-chief: Add script for Designate integration

https://gerrit.wikimedia.org/r/497670