govirtuo / cfcr Goto Github PK

Is your feature request related to a problem?

cfcr should try to connect to providers at start time instead of waiting for a day/a week/a month to crash.

Describe the solution you'd like

Ping the providers with given credentials at start time.

Additional context

n/a

Version

v1.1.0

What happened?

Here is what happens:

1. The cert needs to be renewed, as new TXT records are available in Cloudflare.
2. cfcr gets them, and then check if some TXT records are already present in OVH.
3. As cfcr is supposed to be the only one that handles those TXT records, it thinks that it is the one that put them there, so there is no renewal to perform. It knows that because when the cert is renewed, it cleans the TXT records. So if there are TXT records remaining, it means that they are still useful.

Relevant log output

No response

Anything else?

To fix it, cfcr should compare the TXT records it got from Cloudflare to the one it got from OVH. Cloudflare is the source of truth, so:

1. if they are the same, all good, just wait & pray.
2. if they are different, replace the ones from OVH by the ones from Cloudflare.

Version

v3.0.0 (built: 2023-05-25_12:14:02TUTC)

What happened?

Cfcr logs report a 401 error while trying to access OVH API and then panic

Relevant log output

Anything else?

No response

Describe the solution you'd like

Statically compile cfcr and use a scratch base image in the last build stage. This will reduce the attack surface and attacker's capabilities in case of compromise.

Additional context

Having FROM scratch images may make the debugging process more complex (no shell nor privileges...).

Let's discuss about it if you're interested in the the idea @xakraz :0)