From a507fe1090189273fd93e3e3a9d15ec007cae63d Mon Sep 17 00:00:00 2001
From: "Dustin C. Hatch" <dustin@hatch.name>
Date: Mon, 24 Apr 2023 22:22:52 -0500
Subject: [PATCH] cert-manager: Switch to acme-dns

Using the local name server as the authoritative server for ACME
challenge records turned out to be quite problematic.  For some reason,
both Google and Cloudflare kept returning SERVFAIL responses for the
*_acme-challenge* TXT queries.  I suspect this may have had something to
do with how BIND was configured to be the authoritative server for the
*o-ak4p9kqlmt5uuc.com* while also being a recusive resolver for clients
on the local network.

Using *acme-dns.io* resolves these issues, but it does bring a few of
its own.  Notably, each unique domain and subdomain must have its own
set of credentials (specified in the `acme-dns.json`) file.  This makes
adding new certificates rather cumbersome.
---
 cert-manager/.gitignore          |  1 +
 cert-manager/cluster-issuer.yaml | 12 +++++-------
 cert-manager/kustomization.yaml  |  7 +++++++
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/cert-manager/.gitignore b/cert-manager/.gitignore
index 8809eb4..fdf8270 100644
--- a/cert-manager/.gitignore
+++ b/cert-manager/.gitignore
@@ -1,3 +1,4 @@
+acme-dns.json
 cert-exporter.pem
 cert-manager.key
 zerossl.secret
diff --git a/cert-manager/cluster-issuer.yaml b/cert-manager/cluster-issuer.yaml
index e83c680..f294c65 100644
--- a/cert-manager/cluster-issuer.yaml
+++ b/cert-manager/cluster-issuer.yaml
@@ -17,10 +17,8 @@ spec:
     solvers:
     - dns01:
         cnameStrategy: Follow
-        rfc2136:
-          nameserver: 172.30.0.1
-          tsigKeyName: cert-manager
-          tsigAlgorithm: HMACSHA512
-          tsigSecretSecretRef:
-            name: cert-manager-tsig
-            key: cert-manager.key
+        acmeDNS:
+          host: https://auth.acme-dns.io/
+          accountSecretRef:
+            name: acme-dns
+            key: acme-dns.json
diff --git a/cert-manager/kustomization.yaml b/cert-manager/kustomization.yaml
index 3e3c72b..de2099f 100644
--- a/cert-manager/kustomization.yaml
+++ b/cert-manager/kustomization.yaml
@@ -28,3 +28,10 @@ secretGenerator:
   - cert-exporter.pem
   options:
     disableNameSuffixHash: true
+
+- name: acme-dns
+  namespace: cert-manager
+  files:
+  - acme-dns.json
+  options:
+    disableNameSuffixHash: true