From mboxrd@z Thu Jan 1 00:00:00 1970 From: Julien Lepiller Subject: Re: guix.gnu.org sub-domain Date: Tue, 09 Apr 2019 10:32:13 +0200 Message-ID: References: <87bm323cim.fsf@elephly.net> <878swk27pj.fsf@gnu.org> <0E8676FF-2F46-48FA-8B36-33DFF6812032@lepiller.eu> <8736ms3q5p.fsf@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([209.51.188.92]:44578) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hDmBQ-0006uO-S8 for guix-devel@gnu.org; Tue, 09 Apr 2019 04:32:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hDmBM-0000da-Dr for guix-devel@gnu.org; Tue, 09 Apr 2019 04:32:43 -0400 In-Reply-To: <8736ms3q5p.fsf@gmail.com> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Chris Marusich Cc: guix-devel@gnu.org Le 9 avril 2019 03:48:02 GMT+02:00, Chris Marusich = a =C3=A9crit : >Hi Julien, > >Thank you for working on this! > >Julien Lepiller writes: > >> I'm still unsure about how to update the certificates with the dns >> challenge=2E I found a script that could help us with updating the zone >> served by knot when it's configured as a master=2E >> >> We could use that to update the required txt record, but we also need >> to make sure the change is propagated to the other server, because we >> don't know which server will be asked to answer the challenge=2E >> >> With a further delegation of the record for the dns challenge we can >> have two masters, but I'm still stuck at finding a way to communicate >> the challenge between the two servers=2E >> >> Ideas? > >Can we update the DNS dynamically [1]? Can you share the script? > >I still don't know as much about Knot as I should, but I'm surprised >that a change to the primary server's database would not be propagated >to the secondary server's database automatically=2E Can you elaborate on >what goes wrong, or maybe explain (even at a high level) how I can try >reproducing the problem with cert renewal locally? > >Footnotes:=20 >[1] https://tools=2Eietf=2Eorg/html/rfc2136 What I found consists in using knotc to update the zone served by knot wit= h knotc, but it only update it locally (and to slaves)=2E So we have no iss= ue with that method when we want to automate certs from the primary, but I = don't know how to propagate the change back to the master when we ask for c= erts on the secondary=2E I'll have a look at the rfc=2E