NginxProxyManager / NginxProxyManager/nginx-proxy-manager

DNS Challenge fails with stalled credentials

Open
#3,968 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug

In my setup I use a hidden bind9 name server in a docker container for dns_rfc2136_server challenges. Somehow the credentials get stored in files under /etc/letsencrypt/credentials/ and didn't get renewed. These files need to get updated/renewed, when the bind9 name server in it's docker environment and gets a new IP address.

Nginx Proxy Manager Version

2.11.3 (35d7a3a) 2024-07-01 11:42:06 UTC

To Reproduce
Steps to reproduce the behavior:
do i really need to describe this?

Expected behavior

I expect, that the credential files get regenerated at each renewal run. In the user interface I inserted the internal docker host name, which is constant. If npm generates the credential file it stores the IP address, therefore the rfc2136 process might fail, when the bind9 docker container got a new IP address.

Screenshots

Operating System

debian bookworm

Additional context

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing a renewal run with the jc21/nginx-proxy-manager:latest Docker image and inspect the credential files under /etc/letsencrypt/credentials/. Verify how the configured Docker hostname and resolved IP are written during renewal; done means regenerated credentials use the current bind9 container address and the DNS challenge succeeds after an address change.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.