[general]
# DNS interface. Note that systemd-resolved may reserve port 53 on 127.0.0.53
# In this case acme-dns will error out and you will need to define the listening interface
# for example: listen = "127.0.0.1:53"
listen = "0.0.0.0:53"
# protocol, "both", "both4", "both6", "udp", "udp4", "udp6" or "tcp", "tcp4", "tcp6"
protocol = "both"
# domain name to serve the requests off of
domain = "dns.svc.dev"
# zone name server
nsname = "dns.svc.dev"
# admin email address, where @ is substituted with .
nsadmin = "admin.svc.dev"
# predefined records served in addition to the TXT
records = [
    # Traefik container IP
    "*.svc.dev. A 10.8.10.252",

    # Step-CA container IP
    "ca.svc.dev. A 10.8.10.254",

    # domain pointing to the public IP of your acme-dns server
    "dns.svc.dev. A 10.8.10.253",

    # specify that auth.example.org will resolve any *.auth.example.org records
    "dns.svc.dev. NS dns.svc.dev."
]
# debug messages from CORS etc
debug = true

[database]
# Database engine to use, sqlite3 or postgres
engine = "sqlite3"
# Connection string, filename for sqlite3 and postgres://$username:$password@$host/$db_name for postgres
# Please note that the default Docker image uses path /var/lib/acme-dns/acme-dns.db for sqlite3
connection = "/database/acme-dns.db"
# connection = "postgres://acme-dns:dJ814VB6vCw0VJE0BA8IXcklNvRdObPA@postgresql.database.local:5432/acme-dns?sslmode=disable"

[api]
# listen ip eg. 127.0.0.1
ip = "0.0.0.0"
# possible values: "letsencrypt", "letsencryptstaging", "cert", "none"
tls = "letsencrypt"
# listen port, eg. 443 for default HTTPS
port = "443"
# disable registration endpoint
disable_registration = false
# only used if tls = "cert"
tls_cert_privkey = "/etc/tls/example.org/privkey.pem"
tls_cert_fullchain = "/etc/tls/example.org/fullchain.pem"
# only used if tls = "letsencrypt"
acme_cache_dir = "certs"
# optional e-mail address to which Let's Encrypt will send expiration notices for the API's cert
notification_email = "george@betterde.com"
# CORS AllowOrigins, wildcards can be used
corsorigins = [
    "*"
]
# use HTTP header to get the client ip
use_header = false
# header name to pull the ip address / list of ip addresses from
header_name = "X-Forwarded-For"

[logconfig]
# logging level: "error", "warning", "info" or "debug"
loglevel = "debug"
# possible values: stdout, TODO file & integrations
logtype = "stdout"
# file path for logfile TODO
# logfile = "./acme-dns.log"
# format, either "json" or "text"
logformat = "text"

services:
  acme-dns:
    image: joohoi/acme-dns:latest
    labels:
      - traefik.enable=false
    restart: always
    volumes:
      - ./certs:/certs
      - ./database:/database
      - ./config:/etc/acme-dns:ro
    hostname: acme-dns
    networks:
      traefik:
        ipv4_address: 10.8.10.253
    extra_hosts:
      - ca.svc.dev:10.8.10.254
      - acme-v02.api.letsencrypt.org:10.8.10.254
      - acme-staging-v02.api.letsencrypt.org:10.8.10.254
    environment:
      - TZ=Asia/Shanghai
    container_name: acme-dns

networks:
  traefik:
    external: true

curl -X POST https://dns.svc.dev/register | jq .
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   235  100   235    0     0    768      0 --:--:-- --:--:-- --:--:--   767
{
  "username": "e1181993-6e69-4f4b-90f5-e33f383d5444",
  "password": "FUfLiaavn0e4ssrtJZbVt7FimNBgDvsEerRkkVPx",
  "fulldomain": "008a8c8a-d5a8-4ea6-964e-651f09220763.dns.svc.dev",
  "subdomain": "008a8c8a-d5a8-4ea6-964e-651f09220763",
  "allowfrom": []
}

services:
  traefik:
    ......
    networks:
      traefik:
        ipv4_address: 10.8.10.252
    command:
      ......
      - --entrypoints.https.address=:443
      - --entryPoints.https.http3.advertisedport=443
      - --entryPoints.https.http.tls.certResolver=step-ca
      - --entryPoints.https.http.tls.domains[0].main=svc.dev
      - --entryPoints.https.http.tls.domains[0].sans=*.svc.dev

      - --certificatesresolvers.step-ca.acme.email=george@betterde.com
      - --certificatesresolvers.step-ca.acme.storage=/certs/acme.json
      - --certificatesresolvers.step-ca.acme.caserver=https://ca.svc.dev/acme/acme/directory
      - --certificatesresolvers.step-ca.acme.tlschallenge=false
      - --certificatesresolvers.step-ca.acme.dnschallenge=true
      - --certificatesresolvers.step-ca.acme.dnschallenge.provider=acme-dns
      - --certificatesresolvers.step-ca.acme.httpChallenge=false
    volumes:
      - step-ca:/step-ca:ro
      - ./certs/:/certs/:rw
      - ./config/:/etc/traefik/config/:ro
      - /var/run/docker.sock:/var/run/docker.sock
    extra_hosts:
      - ca.svc.dev:10.8.10.254
      - dns.svc.dev:10.8.10.253
    environment:
      - TZ=Asia/Shanghai

      - ACME_DNS_API_BASE=https://dns.svc.dev
      - ACME_DNS_STORAGE_PATH=/certs/lego-acme-dns-accounts.json

      - LEGO_CA_CERTIFICATES=/step-ca/certs/root_ca.crt
      - LEGO_DISABLE_CNAME_SUPPORT=false
    container_name: traefik

volumes:
  step-ca:
    name: step-ca
    external: true

networks:
  traefik:
    external: true