falcon4ik007/selectel-dns-certbot

•Updated 9 months ago

Certbot plugin to handle selectel DNS challenge

Image

634

falcon4ik007/selectel-dns-certbot repository overview

⁠Selectel DNS Certbot - SSL Certificate Automation

Automated SSL/TLS certificate issuance and renewal for domains hosted on Selectel DNS using Let's Encrypt via Certbot with DNS-01 challenge.

⁠Features

🔒 Automatic SSL Certificate Issuance using Let's Encrypt
🌐 DNS-01 Challenge - Works without web server access
✨ Wildcard Support - Issue certificates for *.yourdomain.com
🐳 Docker-based - Easy deployment and consistent environment
🔄 Automatic Renewal - Set up cron jobs for renewal automation
🇷🇺 Selectel API v2 - Uses latest Selectel DNS API

⁠Prerequisites

Docker installed on your system
Selectel account with:
- Account ID (numeric ID from control panel)
- Project name
- Service user credentials (username and password)
- Domain configured in Selectel DNS

⁠Quick Start

⁠1. Create Credentials File

Create a file named selectel.ini with your Selectel API credentials:

# Selectel API credentials
dns_selectel_api_v2_account_id = YOUR_ACCOUNT_ID
dns_selectel_api_v2_project_name = YOUR_PROJECT_NAME
dns_selectel_api_v2_username = YOUR_SERVICE_USER
dns_selectel_api_v2_password = "YOUR_PASSWORD"

Important Notes:

If your password contains special characters (especially #, ;, or spaces), wrap it in quotes
Keep this file secure and never commit it to version control
Set appropriate permissions: chmod 600 selectel.ini

⁠2. Issue Certificate

⁠Single Domain

docker run --rm \
  -v /etc/letsencrypt:/etc/letsencrypt \
  -v /var/log/letsencrypt:/var/log/letsencrypt \
  -v $(pwd)/selectel.ini:/etc/letsencrypt/selectel.ini:ro \
  falcon4ik007/selectel-dns-certbot:latest \
  certonly \
  -a dns-selectel-api-v2 \
  --dns-selectel-api-v2-credentials /etc/letsencrypt/selectel.ini \
  --dns-selectel-api-v2-propagation-seconds 120 \
  -d yourdomain.com \
  --email [email protected] \
  --agree-tos \
  --non-interactive

⁠Domain with Wildcard

docker run --rm \
  -v /etc/letsencrypt:/etc/letsencrypt \
  -v /var/log/letsencrypt:/var/log/letsencrypt \
  -v $(pwd)/selectel.ini:/etc/letsencrypt/selectel.ini:ro \
  falcon4ik007/selectel-dns-certbot:latest \
  certonly \
  -a dns-selectel-api-v2 \
  --dns-selectel-api-v2-credentials /etc/letsencrypt/selectel.ini \
  --dns-selectel-api-v2-propagation-seconds 120 \
  -d yourdomain.com \
  -d '*.yourdomain.com' \
  --email [email protected] \
  --agree-tos \
  --non-interactive

⁠3. Locate Your Certificates

After successful issuance, certificates will be located at:

/etc/letsencrypt/live/yourdomain.com/
├── cert.pem       # Your domain certificate
├── chain.pem      # Certificate chain
├── fullchain.pem  # cert.pem + chain.pem
└── privkey.pem    # Private key (keep secure!)

⁠Production Deployment

⁠Option 1: Direct Docker Run

Create a script /opt/certbot/renew-certs.sh:

#!/bin/bash
docker run --rm \
  -v /etc/letsencrypt:/etc/letsencrypt \
  -v /var/log/letsencrypt:/var/log/letsencrypt \
  -v /opt/certbot/selectel.ini:/etc/letsencrypt/selectel.ini:ro \
  falcon4ik007/selectel-dns-certbot:latest \
  renew \
  --dns-selectel-api-v2-credentials /etc/letsencrypt/selectel.ini

Make it executable:

chmod +x /opt/certbot/renew-certs.sh

⁠Option 2: Docker Compose

Create docker-compose.yml:

version: '3.8'

services:
  certbot:
    image: falcon4ik007/selectel-dns-certbot:latest
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt
      - /var/log/letsencrypt:/var/log/letsencrypt
      - ./selectel.ini:/etc/letsencrypt/selectel.ini:ro
    command: >
      certonly
      -a dns-selectel-api-v2
      --dns-selectel-api-v2-credentials /etc/letsencrypt/selectel.ini
      --dns-selectel-api-v2-propagation-seconds 120
      -d yourdomain.com
      -d '*.yourdomain.com'
      --email [email protected]
      --agree-tos
      --non-interactive

Run:

docker-compose run --rm certbot

⁠Automatic Renewal with Cron

Add to crontab (crontab -e):

# Renew certificates twice daily at 3am and 3pm
0 3,15 * * * /opt/certbot/renew-certs.sh >> /var/log/letsencrypt/renewal.log 2>&1

# Reload nginx after renewal (if needed)
5 3,15 * * * docker exec nginx nginx -s reload

⁠Configuration Options

⁠Propagation Time

DNS propagation time (default: 120 seconds). Increase if DNS updates are slow:

--dns-selectel-api-v2-propagation-seconds 180

⁠Dry Run (Testing)

Test certificate issuance without actually requesting a certificate:

docker run --rm \
  -v $(pwd)/selectel.ini:/etc/letsencrypt/selectel.ini:ro \
  falcon4ik007/selectel-dns-certbot:latest \
  certonly --dry-run \
  -a dns-selectel-api-v2 \
  --dns-selectel-api-v2-credentials /etc/letsencrypt/selectel.ini \
  -d yourdomain.com \
  --email [email protected] \
  --agree-tos \
  --non-interactive

⁠Verbose Output

For debugging:

docker run --rm \
  -v /etc/letsencrypt:/etc/letsencrypt \
  -v $(pwd)/selectel.ini:/etc/letsencrypt/selectel.ini:ro \
  falcon4ik007/selectel-dns-certbot:latest \
  certonly -v \
  -a dns-selectel-api-v2 \
  --dns-selectel-api-v2-credentials /etc/letsencrypt/selectel.ini \
  -d yourdomain.com \
  --email [email protected] \
  --agree-tos \
  --non-interactive

⁠Kubernetes Deployment

Create a ConfigMap for credentials:

apiVersion: v1
kind: Secret
metadata:
  name: selectel-credentials
type: Opaque
stringData:
  selectel.ini: |
    dns_selectel_api_v2_account_id = YOUR_ACCOUNT_ID
    dns_selectel_api_v2_project_name = YOUR_PROJECT_NAME
    dns_selectel_api_v2_username = YOUR_SERVICE_USER
    dns_selectel_api_v2_password = "YOUR_PASSWORD"

Create a CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: certbot-renewal
spec:
  schedule: "0 3 * * *"  # Daily at 3am
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: certbot
            image: falcon4ik007/selectel-dns-certbot:latest
            command:
            - certbot
            - renew
            - --dns-selectel-api-v2-credentials
            - /etc/letsencrypt/selectel.ini
            volumeMounts:
            - name: letsencrypt
              mountPath: /etc/letsencrypt
            - name: credentials
              mountPath: /etc/letsencrypt/selectel.ini
              subPath: selectel.ini
              readOnly: true
          volumes:
          - name: letsencrypt
            persistentVolumeClaim:
              claimName: letsencrypt-pvc
          - name: credentials
            secret:
              secretName: selectel-credentials
          restartPolicy: OnFailure

⁠Troubleshooting

⁠Issue: "Unsafe permissions on credentials configuration file"

Solution: Set proper permissions on your credentials file:

chmod 600 selectel.ini

⁠Issue: "API request error: status code 401"

Possible causes:

Incorrect credentials - verify your account ID, username, and password
Password contains special characters not properly quoted in INI file
Service user doesn't have permissions for the project

Solution:

Wrap password in double quotes in selectel.ini
Verify credentials in Selectel control panel
Ensure service user has admin rights for the project

⁠Issue: "Zone not found for domain"

Possible causes:

Domain not configured in Selectel DNS
Incorrect project selected

Solution:

Add domain zone in Selectel control panel
Verify project name matches the one containing your domain

⁠Issue: Certificate renewal fails

Check logs:

docker run --rm \
  -v /etc/letsencrypt:/etc/letsencrypt \
  -v /var/log/letsencrypt:/var/log/letsencrypt \
  falcon4ik007/selectel-dns-certbot:latest \
  renew --dry-run

⁠Security Best Practices

Protect Credentials File

chmod 600 selectel.ini
chown root:root selectel.ini

Use Read-Only Mount

-v $(pwd)/selectel.ini:/etc/letsencrypt/selectel.ini:ro

Restrict Service User Permissions
- Create dedicated service user in Selectel
- Grant only DNS management permissions
- Use strong, unique password
Regular Certificate Monitoring
- Set up monitoring for certificate expiration
- Alert if renewal fails
- Test renewal process regularly

Backup Certificates

tar -czf letsencrypt-backup-$(date +%Y%m%d).tar.gz /etc/letsencrypt

⁠Web Server Integration

⁠Nginx

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Your server configuration...
}

⁠Apache

<VirtualHost *:443>
    ServerName yourdomain.com

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/yourdomain.com/chain.pem

    # Your server configuration...
</VirtualHost>

⁠Version Tags

latest - Latest stable version
v1.0.0 - Specific version

⁠Bug Fixes in This Version

This image includes fixes for the original certbot-dns-selectel-api-v2 plugin:

TypeError in error handling - Fixed issue where dict errors couldn't be joined as strings
Password truncation - Fixed INI parsing issue with passwords containing # character
Account ID type conversion - Ensured account_id is properly converted to string

⁠Links

Docker Hub: https://hub.docker.com/r/falcon4ik007/selectel-dns-certbot⁠
Original Plugin: https://gitlab.com/alxrem/certbot-dns-selectel-api-v2⁠
Certbot Documentation: https://certbot.eff.org/docs/⁠
Selectel API Documentation: https://docs.selectel.ru/en/api/dns-actual/⁠

⁠License

Based on certbot-dns-selectel-api-v2 by Alexey Remizov (Apache License 2.0)

⁠Support

For issues and questions:

Check the Troubleshooting⁠ section
Review Certbot logs at /var/log/letsencrypt/letsencrypt.log
Verify Selectel API credentials and permissions

Note: DNS-01 challenge does not require your domain to point to the server running certbot. The challenge is completed entirely through DNS records, making it perfect for internal networks and wildcard certificates.

Tag summary

Recent tags

Content type

Image

Digest

sha256:060ec0a2e…

Size

83.4 MB

Last updated

9 months ago

docker pull falcon4ik007/selectel-dns-certbot