libdns/cloudflare

Cloudflare provider implementation for libdns

Cloudflare for libdns

This package implements the libdns interfaces for Cloudflare.

Authenticating

Important

This package supports API token authentication (as opposed to legacy API keys).

There are two approaches for token permissions supported by this package:

1. Single token for everything
   • APIToken permissions required: Zone:Read, Zone.DNS:Write - All zones
2. Dual token method
   • ZoneToken permissions required: Zone:Read - All zones
   • APIToken permissions required: Zone.DNS:Write - for the zone(s) you wish to manage

The dual token method allows users who have multiple DNS zones in their Cloudflare account to restrict which zones the token can access, whereas the first method will allow access to all DNS Zones. If you only have one domain/zone then this approach does not provide any benefit, and you might as well just have the single API token

To use the dual token approach simply ensure that the ZoneToken property is provided - otherwise the package will use APIToken for all API requests.

To clarify, do NOT use API keys, which are globally-scoped:

DO use scoped API tokens:

cloudflare's Issues

Invalid Request Headers

Does anyone know if this package has fallen out of date with cloudflare, trying to run with the recommended (scoped, Zone:Read, DNS:Edit) I get the following error:

unable to get TLS for "mx.catcher.mx.ax": mx.catcher.mx.ax: obtaining certificate: [mx.catcher.mx.ax] Obtain: [mx.catcher.mx.ax] solving challenges: presenting for challenge: adding temporary record for zone mx.ax.: got error status: HTTP 400: [{Code:6003 Message:Invalid request headers}] (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/x/x) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)

Seperate tokens for list/edit

The way this module is written I have to create one token that covers list and edit for all zones

go-acme lets me create a list for all zones and an edit just for the zone I'm interested in, this is a somewhat more secure method.

Using wrong zone name for sub sub domain

I'm having problems trying to get a wildcard cert for a sub sub domain e.g. *.sub.domain.com.
This is the error i get:
[*.sub.domain.com] solving challenges: presenting for challenge: adding temporary record for zone \"sub.domain.com.\": expected 1 zone, got 0 for sub.domain.com.
I think the problem is that my zone is called domain.com but it tries to find sub.domain.com which doesnt exist.
Maybe I'm wrong but if not, could you please add an option for setting a custom zone that will be used?

PS: I'm using the caddy cloudflare plugin: https://github.com/caddy-dns/cloudflare but from what I can tell from reading their code this is a problem with this lib.

Unit Test cases missing?

I have read this wiki, I can't find test cases though it works. I'm trying to write another provider, but I don't know how to write test cases, how to write unit cases for third-part API. Is there any tips?

Code:6003 Message:Invalid request headers

I get the following error when trying to

func cloudFlare() {
	ctx := context.TODO()
	zone := "theprimestyle.com."

	// configure the DNS provider (choose any from github.com/libdns)
	provider := cloudflare.Provider{APIToken: CLOUDFLARE_API_TOKEN}

	// list records
	listr, err := provider.GetRecords(ctx, zone)
	fmt.Println(err)
	if err == nil {
		for i, rec := range listr {
			fmt.Println(i, rec.ID, rec.Name, rec.Type, rec.Value, rec.TTL, rec.Priority)
		}
	}
}

got error status: HTTP 400: [{Code:6003 Message:Invalid request headers}]

Cannot create SRV records

I am trying to create an SRV Record, e.g. _imap._tcp.example.org. 60 IN SRV 10 10 143 example.org..

As there is no real support for it in the libdns package, I tried to set the value to 10 10 143 example.org (both with dot suffix and without) but always get got error status: HTTP 400: [{Code:1004 Message:DNS Validation Error}].

Message:Invalid request headers

I don't know what is wrong, please can you advise

Keys, Domains edited for privacy/

All Zone, Api Key set with:
Zone, Zone, READ
Zone, DNS, EDIT

Jul 11 12:46:20 u2010a-15 caddy[35154]: {"level":"error","ts":1720698380.737351,"logger":"tls.obtain","msg":"will retry","error":"[abc.rdu.XXXconsulting.uk] Obtain: [abc.rdu.XXXconsulting.uk] solving challenges: presenting for challenge: adding temporary record for zone "XXXXconsulting.uk.": got error status: HTTP 400: [{Code:6003 Message:Invalid request headers ErrorChain:[{Code:6111 Message:Invalid format for Authorization header}]}] (order=https://acme-v02.api.letsencrypt.org/acme/order/1828340627/286314110787) (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":2.122602944,"max_duration":2592000}

curl -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
     -H "Authorization: Bearer CHANGEDRBesdbmGzESlJ_PPl5IVEX4gI9L9bi" \
     -H "Content-Type:application/json"

{"result":{"id":"CHANGEDe7d53b8849006387614d103","status":"active"},"success":true,"errors":[],"messages":[{"code":10000,"message":"This API Token is valid and active","type":null}]}

    tls {
      dns cloudflare {"CHANGEDRBesdbmGzESlJ_PPl5IVEX4gI9L9bi"}
    }
}

xcaddy build v2.8.4 --with github.com/caddy-dns/dynu@master --with github.com/caddy-dns/ovh --with github.com/caddy-dns/cloudflare

$ ./caddy build-info | grep dns
dep	github.com/caddy-dns/cloudflare	v0.0.0-20240703190432-89f16b99c18e	h1:POEJXMmSOMJP/73oM/riQTDMg0yjQYlA7nVjyt1+5p8=
dep	github.com/caddy-dns/dynu	v0.1.1	h1:V4z6oQ/Y2hOISNc42IdFV+OANRLKpC5gF3H7mO9cu4k=
dep	github.com/caddy-dns/ovh	v0.0.2	h1:8EQaUw0wWlFnQVigBKTL+o5fCkHqPBh69WCu9peqvIg=
dep	github.com/libdns/cloudflare	v0.1.2-0.20240604123710-0549667a10ab	h1:tX5H3Liz1eTJBbQK2/zs3tmWf79jCKplqQ38AIi/qW4=
dep	github.com/libdns/dynu	v0.1.1	h1:/+1xQpIXDyJu4HAlwjcgYxOgnWt2qKd96hFzXymliVc=
dep	github.com/libdns/libdns	v0.2.2	h1:O6ws7bAfRPaBsgAYt8MDe2HcNBGC29hkZ9MX2eUSX3s=
dep	github.com/libdns/ovh	v0.0.2	h1:9ZBoPi9/BHweKMY609CdvmLVxy3v8WStJJcf+VG5lNI=
dep	github.com/miekg/dns	v1.1.59	h1:C9EXc/UToRwKLhK5wKU/I4QVsBUc8kE6MkHBkeypWZs=

cloudflare.SetRecords: confusing behavior regarding record ID

Currently, the record’s ID must be empty for it to be updated:

cloudflare/provider.go

Lines 134 to 158 in 16482ae

	if rec.ID == "" {
	// the record might already exist, even if we don't know the ID yet
	matches, err := p.getDNSRecords(ctx, zoneInfo, rec, false)
	if err != nil {
	return nil, err
	}
	if len(matches) > 0 {
	for _, match := range matches {
	// record exists; update it
	result, err := p.updateRecord(ctx, match, cloudflareRecord(rec))
	if err != nil {
	return nil, err
	}
	results = append(results, result.libdnsRecord())
	}
	continue
	}
	}
	// record doesn't exist; create it
	result, err := p.createRecord(ctx, zoneInfo, rec)
	if err != nil {
	return nil, err
	}
	results = append(results, result.libdnsRecord())

This seems like the opposite of what one would want in that scenario: when passing in an ID, I would expect the record referenced by that ID to be updated.

Can you clarify if this is a logic bug, or intentional?