ACME DNS-01 providers

Bongo reads provider credentials from /etc/bongo/acme.d/providers. The file is suffixless JSON and must be a root-owned regular file with mode 0640 or stricter; the group may be bongo. The setup wizard writes this file safely.

type: "nsupdate" is the standard native RFC 2136 provider. rfc2136 is an accepted compatibility alias. Bongo uses ldns directly, so the external nsupdate command is neither invoked nor required. Omit server to discover the zone's SOA primary. TSIG is optional, but unauthenticated updates should only be used for a deliberately restricted local update service.

Cloudflare is the first HTTPS provider plugin. Use an API token scoped to DNS:Edit for only the required zone and provide its explicit zone id. Bongo stores the record id returned by the create request and deletes exactly that record after validation.

Each certificate name is matched using the longest match_zone (or zone when match_zone is absent). A delegated challenge can therefore use:

{
  "name": "delegated-nsupdate",
  "type": "nsupdate",
  "match_zone": "example.org",
  "challenge_alias": "_acme-challenge.validation.example.net",
  "zone": "validation.example.net",
  "server": "ns1.example.net",
  "port": 53
}

Additional HTTPS providers are installed as trusted modules named bongo.acme.providers.<type>. A module implements present() and cleanup(); credentials remain in the provider document and are never passed in command arguments. Do not install provider modules from untrusted sources.