grepular/pdns-api-cage repository overview

⁠pdns-api-cage

A policy-enforcing adapter for the PowerDNS Authoritative HTTP API. PowerDNS has a single static API key and no authorisation, so a key that can add a TXT record can also delete a zone or read DNSSEC private keys. pdns-api-cage holds the real key and never discloses it; each application (Traefik doing ACME DNS-01, a dynamic-DNS updater, a backup client) gets a scoped credential limited to the records its policy allows. The built-in acme preset grants only ACME challenge TXT records in the zones you list.

A single static Go binary on an otherwise empty scratch image (amd64 and arm64), running unprivileged with no capabilities and sandboxed with Landlock and seccomp. Releases are built from signed tags, signed with cosign and byte-reproducible. Pre-v1: expect breaking changes between minor releases. Pin to X.Y.Z, or follow X.Y, X or latest.

• Source: https://gitlab.com/grepular/pdns-api-cage⁠
• License: GNU AGPL V3, or a commercial licence on request
• Author: Mike Cardwell - https://www.grepular.com⁠

Hire me⁠ · Blog⁠ · RSS feed⁠

⁠Support/Appreciate my work

• Bitcoin⁠: 1PQLtWnjUi1itHLG6QCQeHM3Nxua8pRsq1
• Paypal⁠
• Buy me a Coffee⁠