README

traefik-dns-desec

deSEC DNS-01 provider for ACME (lego-compatible) intended for custom Traefik builds that need deSEC-issued certificates.

Why this exists

Traefik’s built-in ACME stack does not ship a deSEC DNS provider. To use DNS-01 with deSEC, you need to compile Traefik with a provider that can create/delete _acme-challenge TXT records via the deSEC API. This module implements that provider with the same interface lego expects (Present, CleanUp, Timeout).

Status

• Minimal provider implementation (create/delete TXT via deSEC API).
• Env-based configuration for token/domain/TTL/timeouts.
• No published module path yet; intended for vendor/replace in a custom Traefik or lego build.

Configuration

Environment variables:

• DESEC_TOKEN (required): API token with access to your zone.
• DESEC_DOMAIN (required): Zone name, e.g., mortent.org.
• DESEC_TTL (optional): TTL for TXT records (default 300).
• DESEC_PROPAGATION_TIMEOUT (optional): How long to wait for propagation (default 2m).
• DESEC_POLLING_INTERVAL (optional): How often to poll (default 10s).
• DESEC_BASE_URL (optional): Override API base (default https://desec.io/api/v1/domains).

Integration with Traefik (custom build required)

Traefik cannot load ACME DNS providers via the plugin system; you must build a custom Traefik binary that registers this provider.

High-level steps:

1. Fork Traefik and add this module to go.mod (either as a replace to a local path or a real module path).
2. Register the provider in Traefik’s ACME DNS provider map (pkg/provider/acme/provider.go), e.g.:
   goCopy

   import desec "github.com/your-org/traefik-dns-desec"
   dnsProviders["desec"] = func() challenge.Provider { p, _ := desec.NewDNSProvider() ; return p }

3. Rebuild Traefik (go build ./cmd/traefik), then configure:
   yamlCopy

   certificatesResolvers:
     letsencrypt:
       acme:
         email: you@example.com
         storage: /etc/traefik/acme.json
         dnsChallenge:
           provider: desec
           delayBeforeCheck: 60

4. Provide DESEC_TOKEN (and DESEC_DOMAIN, etc.) to the Traefik process via env/secret.

Usage with lego (for testing)

You can also wire this provider into a lego build to verify behavior before patching Traefik:

export DESEC_TOKEN=...
export DESEC_DOMAIN=example.com
lego --dns desec -d example.com -m you@example.com run

This requires adding the provider to lego’s DNS provider registry in a custom build (similar to the Traefik step).

Notes

• Records are written via deSEC’s REST API using PUT/DELETE on rrsets.
• TXT value is quoted to match deSEC expectations.
• Propagation timing is configurable; defaults are conservative (2m timeout, 10s poll).

Next steps

• Publish the module under a stable path.
• Add integration tests against deSEC’s API (requires token/zone).
• Upstream a patch into your Traefik fork to make provider selection seamless.