Re: [pbs-devel] [PATCH v2 backup 02/27] add dns alias schema

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

On Wed, Apr 28, 2021 at 05:55:27PM +0200, Dietmar Maurer wrote:
> Is this the same syntax used for DNS SRV records?
> 
> https://en.wikipedia.org/wiki/SRV_record

Disclaimer: My main motivation was, I just followed along with what
we're doing in PVE (and did the same in PMG as well).

TBH I don't know if any ACME implementation worries about that at all.
The main idea is this:

  * you want to get a certificate for foo.bar.com
  * giving pbs direct access to managing the `foo.bar.com` or `bar.com`
    zones is inconvenient or impossible
  * you setup a `CNAME` for `_acme-challenge.foo.bar.com` to point to
    X.Y.Z
  * you configure the domain foo.bar.com and set the alias to X.Y.Z, so
    that our DNS plugins will set the TXT entry for X.Y.Z instead of
    `_acme-challenge.foo.bar.comm`
  * the ACME provider's DNS resolver will decide which values for X, Y
    and Z they're willing to accept while resolving the TXT entry.
      Most likely they can be completely arbitrary. We know that due to
    common practice, they'll most likely allow at least hostnames with
    the addition of leading underscores, but as far as formal
    definitions go, the DNS RFC is the only "real source of
    what-should-be-the-truth", while in practice you'll just have to try
    and see if it works...

And sure, *technically* we could just relax the DNS schema in general,
but then user's may run into issues when they configure something that
should be legal as per the DNS RFC but is not accepted by their browsers
or some other tool. Of course we could still relax it and just keep the
"normal" restrictions purely in the GUI... I don't know.