inbuxa/inbuxa-server
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 54 Wiki Activity Sponsor

A domain can't use DNS-01 without publishing at least one record type #304

New Issue
Closed
opened 2026-11-06 19:54:18 +00:00 by jcoffey-dev · 1 comment
jcoffey-dev commented 2026-11-06 19:54:18 +00:00
Owner
Copy link
Copy source

DNS-01 orders get their DNS server from the domain's automatic DNS settings (build_dns_updater(props.dns_server_id) in crates/common/src/network/acme/renew.rs), and automatic DNS won't save with an empty publishRecords: the schema requires at least one. So a domain that only exists to get certificates has to publish a record type it doesn't need.

Allowing an empty list should be enough. The DNS task already ends cleanly when there's nothing to update (crates/services/src/task_manager/dns.rs).

Workaround for now: tick only TLS-RPT and leave the domain's report address empty. That record is only written when there's an address, so nothing gets published.

This is from reading the code, not reproduced yet. Came up on the forum: https://community.coffeylabs.org/t/210/11

DNS-01 orders get their DNS server from the domain's automatic DNS settings (`build_dns_updater(props.dns_server_id)` in `crates/common/src/network/acme/renew.rs`), and automatic DNS won't save with an empty `publishRecords`: the schema requires at least one. So a domain that only exists to get certificates has to publish a record type it doesn't need. Allowing an empty list should be enough. The DNS task already ends cleanly when there's nothing to update (`crates/services/src/task_manager/dns.rs`). Workaround for now: tick only TLS-RPT and leave the domain's report address empty. That record is only written when there's an address, so nothing gets published. This is from reading the code, not reproduced yet. Came up on the forum: https://community.coffeylabs.org/t/210/11
jcoffey-dev added the bug
priority
p2
 labels 2026-11-06 19:54:18 +00:00
jcoffey-dev self-assigned this 2026-11-06 20:23:46 +00:00
jcoffey-dev commented 2026-11-06 23:32:40 +00:00
Author
Owner
Copy link
Copy source

Fixed in #306, released in 27.1-rc.11 (console side in inbuxa-admin#168, released in 27.1-rc.7). Automatic DNS can now be saved with no record types, so a certificate-only domain can use DNS-01 without publishing anything, and saving one no longer queues a DNS task that can only fail. The forum thread has been told the TLS-RPT workaround isn't needed anymore.

Fixed in #306, released in 27.1-rc.11 (console side in inbuxa-admin#168, released in 27.1-rc.7). Automatic DNS can now be saved with no record types, so a certificate-only domain can use DNS-01 without publishing anything, and saving one no longer queues a DNS task that can only fail. The forum thread has been told the TLS-RPT workaround isn't needed anymore.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels bug
priority
p2
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees jcoffey-dev
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-server#304