NginxProxyManager / NginxProxyManager/nginx-proxy-manager
DNS Challenge fails with stalled credentials
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34.2k
- Forks
- 3.9k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 20
Description
Checklist
- Have you pulled and found the error with
jc21/nginx-proxy-manager:latestdocker image?- Yes
- Are you sure you're not using someone else's docker image?
- Yes
- Have you searched for similar issues (both open and closed)?
- Yes
Describe the bug
In my setup I use a hidden bind9 name server in a docker container for dns_rfc2136_server challenges. Somehow the credentials get stored in files under /etc/letsencrypt/credentials/ and didn't get renewed. These files need to get updated/renewed, when the bind9 name server in it's docker environment and gets a new IP address.
Nginx Proxy Manager Version
2.11.3 (35d7a3a) 2024-07-01 11:42:06 UTC
To Reproduce
Steps to reproduce the behavior:
do i really need to describe this?
Expected behavior
I expect, that the credential files get regenerated at each renewal run. In the user interface I inserted the internal docker host name, which is constant. If npm generates the credential file it stores the IP address, therefore the rfc2136 process might fail, when the bind9 docker container got a new IP address.
Screenshots
Operating System
debian bookworm
Additional context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing a renewal run with the jc21/nginx-proxy-manager:latest Docker image and inspect the credential files under /etc/letsencrypt/credentials/. Verify how the configured Docker hostname and resolved IP are written during renewal; done means regenerated credentials use the current bind9 container address and the DNS challenge succeeds after an address change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100