Metadata-Version: 2.4
Name: certbot-dns-kas
Version: 1.0.0
Summary: All-Inkl KAS DNS Authenticator plugin for Certbot
Author: mobilandi
License: Apache-2.0
Project-URL: Homepage, https://github.com/mobilandi/certbot-dns-kas
Project-URL: Repository, https://github.com/mobilandi/certbot-dns-kas
Project-URL: Issues, https://github.com/mobilandi/certbot-dns-kas/issues
Keywords: certbot,dns,all-inkl,kas,letsencrypt,acme
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Plugins
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Classifier: Topic :: System :: Systems Administration
Classifier: Topic :: Utilities
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: certbot>=2.0
Requires-Dist: requests
Dynamic: license-file

# certbot-dns-kas

A [Certbot](https://certbot.eff.org/) DNS authenticator plugin for **All-Inkl
(KAS)**. It solves `dns-01` ACME challenges by creating and removing the
required `_acme-challenge` TXT records through the All-Inkl KAS API — so you can
issue and auto-renew certificates (including **wildcards**) for domains hosted
at All-Inkl without any manual DNS edits.

It talks to the KAS SOAP API directly using only `requests`; there is **no
dependency on `kasserver`, `zeep` or `lxml`**.

## Highlights

- **Wildcard + apex in one certificate** — `example.com` and `*.example.com`
  together work correctly (two TXT records with the same name coexist).
- **Correct zone detection for every TLD depth** — resolves the hosted zone
  from your account's domain list, so multi-label public suffixes like
  `.or.at`, `.co.uk` or `.com.au` work out of the box.
- **Safe cleanup** — removes exactly the challenge record it created, matched by
  name, type and content; no leftover `_acme-challenge` records.
- **Lightweight & self-contained** — pure `requests` + the Python standard
  library. No SOAP framework, no runtime schema downloads.

## Requirements

- Python ≥ 3.9
- Certbot ≥ 2.0
- An All-Inkl account with **KAS API access enabled**, and a KAS login whose API
  permissions include reading and writing DNS records.

## Installation

```bash
pip install certbot-dns-kas
```

Make sure you install it into the same Python environment as Certbot.

## Credentials

Create an INI file, e.g. `kas-credentials.ini`:

```ini
dns_kas_user     = your_kas_login
dns_kas_password = your_kas_password
```

Protect it, since it contains your KAS password:

```bash
chmod 600 kas-credentials.ini
```

## Usage

```bash
certbot certonly \
  --authenticator dns-kas \
  --dns-kas-credentials /path/to/kas-credentials.ini \
  --dns-kas-propagation-seconds 120 \
  -d example.com -d "*.example.com"
```

| Argument | Description | Default |
| --- | --- | --- |
| `--dns-kas-credentials` | Path to the KAS credentials INI file | — |
| `--dns-kas-propagation-seconds` | Seconds to wait for DNS propagation before validation | `120` |

If validation fails with *"Incorrect TXT record found"*, the record usually just
needs more time to propagate — raise `--dns-kas-propagation-seconds` (e.g. to
`240`).

## Nginx Proxy Manager

All-Inkl (KAS) is available as a DNS provider in Nginx Proxy Manager. NPM ships
its own pinned list of DNS plugins, so to use this version make sure the `kas`
entry in NPM's `dns-plugins.json` points at a current release:

```json
"kas": {
    "name": "All-Inkl",
    "package_name": "certbot-dns-kas",
    "version": "~=1.0",
    "dependencies": "",
    "full_plugin_name": "dns-kas",
    "credentials": "dns_kas_user = your_kas_user\ndns_kas_password = your_kas_password"
}
```

Then add an SSL certificate in NPM, choose **All-Inkl** as the DNS provider,
enter your KAS credentials, and enable *wildcard* if you need `*.example.com`.

## How it works

For each challenge the plugin:

1. resolves the hosted DNS zone for the validation name by matching it against
   your account's domains (`get_domains`), choosing the longest matching zone;
2. creates the `_acme-challenge` TXT record via `add_dns_settings` (always an
   add, never an overwrite, so multiple challenges for the same name coexist);
3. after validation, deletes that exact record by its KAS record id.

KAS flood protection is handled automatically with bounded retries.

## Development

```bash
pip install -e .
pip install pytest
python -m pytest
```

The test suite validates the SOAP response parser against real captured KAS
responses and covers zone resolution, flood-protection retries, idempotent
record creation and cleanup.

## License

Apache License 2.0 — see [LICENSE](LICENSE).
