Repository navigation
fix: clean up through the provider that published the record - #2
Merged
Merged
Conversation
Every dns01.present and dns01.cleanup call built a new lego provider. The providers that keep the vendor's record ID in memory during Present, such as cloudflare and ispconfig, then failed the cleanup with "unknown record ID" and left the _acme-challenge record behind. The handler now keeps the provider of each published record, keyed by the provider code, a fingerprint of the credentials and options, the domain, the token and the key authorization, and CleanUp takes it back. A cleanup that finds none, for example after the plugin restarted, builds a fresh provider as before. Entries expire after six hours so a missed cleanup cannot leak them. Refs 0xJacky/nginx-ui#2113, 0xJacky/nginx-ui#2115 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every
dns01.presentanddns01.cleanupcall built a new lego provider. Providers that keep the vendor's record ID in memory during Present (cloudflare, ispconfig and 55 others in lego v5.5.2) then failed the cleanup withunknown record ID, and the_acme-challengeTXT record stayed behind. Issuance itself still succeeded. Reported in 0xJacky/nginx-ui#2115 (Cloudflare) and 0xJacky/nginx-ui#2113 (ISPConfig).Fix
The handler keeps the provider of each published record and CleanUp takes it back. The key is the provider code, a SHA-256 fingerprint of the credentials and options, the domain, the token and the key authorization, so a cleanup with other credentials never reuses it. A cleanup that finds nothing (for example after the plugin restarted) builds a fresh provider as before. Entries expire after six hours. The cleanup still runs inside the env scope, so
LEGO_DISABLE_CNAME_SUPPORTis honoured when lego derives the record name.Tests
TestCleanUpRemovesTheRecordPresentPublisheddrives Present then CleanUp against a fake ISPConfig API. Onmainit fails withispconfig: unknown record ID for '_acme-challenge.example.com.' 'token'; with this change it passes and the published record ID is deleted.go test -race -count=1 ./...: all packages ok onmainand on this branch;gofmt,go vet, webapp typecheck/build and theplugin.jsoncheck all clean.🤖 Generated with Claude Code