DNS API env variables are not per domain so you cant use different accounts for different domains

[gitwer]

DNS API env variables are not able to be set per domain, meaning you can only use a single account for all domains. IE: you can't have 2 Cloudflare accounts one for example.com and a different account for other.com

Steps to reproduce

1. set variables for Cloudflare:
   export CF_Key="sdfdxxxxxxxosdfgje"
   export CF_Email="[email protected]"

2. issue a cert for example.com
   acme.sh --issue -d example.com --dns dns_cf

3. install cert
   acme.sh --install-cert -d example.com (etc etc etc)

4. set variables for DIFFERENT Cloudflare account:
   export CF_Key="wgdsyyyyyyyyyykghtysd"
   export CF_Email="[email protected]"

5. issue a cert for other.com
   acme.sh --issue -d other.com --dns dns_cf

6. install cert
   acme.sh --install-cert -d other.com (etc etc etc)

7. the .acme.sh/account.conf file structure does not work with/allow different DNS API variables for the same DNS provider for different domains.

Can the required DNA API variables (currently saved using "_saveaccountconf") be saved to the .acme.sh/example.com/example.com.conf file instead? This would allow different domains to use different accounts.

Debug log

n/a

[Neilpang]

yes, that is known limitation.

for most of the users, there is only one cloudflare account, they just need to save the api key one time. All the the domains will get benefit.

As a workaround, you can run acme.sh with different --config-home.

acme.sh  --config-home "/root/myacme.sh2/"   --issue -d example.com  --dns dns_cf

you will need to add another cronjob to auto-renew the certs:

7 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" --config-home "/root/myacme.sh2/" > /dev/null

[FernandoMiguel]

I've made a Cloudflare PM promise me that they would have keys per domain, not full accounts.
I wish we could go as far as per subdomain / app.

so in the future, this is something @Neilpang might have to address

[Neilpang]

@FernandoMiguel
Yes, I will think about it.

[gitwer]

Thanks @Neilpang and good to know @FernandoMiguel
The different --config-home's will work for me (save me creating a different account to run it from or hacking the script). DIdn't think of that (then again, it is bed time!)

[xBytez]

Just bumping this up. Is there any update on this? I'd prefer to avoid the different config-home workaround.

[chisaato]

maybe store the dns api env into per domain conf?

[senseisimple]

It makes sense to use the per-domain conf rather than account for exactly this issue. Perhaps this wasn't possible when the issue was raised but it certainly is now.

The documentation DNS-API-Dev-Guide is such:

dns_myapi_add() {
...

  MYAPI_Username="${MYAPI_Username:-$(_readaccountconf_mutable MYAPI_Username)}"
  MYAPI_Password="${MYAPI_Password:-$(_readaccountconf_mutable MYAPI_Password)}"
  if [ -z "$MYAPI_Username" ] || [ -z "$MYAPI_Password" ]; then
    MYAPI_Username=""
    MYAPI_Password=""
    _err "You don't specify cloudflare api key and email yet."
    _err "Please create you key and try again."
    return 1
  fi

  #save the credentials to the account conf file.
  _saveaccountconf_mutable MYAPI_Username "$MYAPI_Username"
  _saveaccountconf_mutable MYAPI_Password "$MYAPI_Password"
...

}

Couldn't we just use the following functions instead?

#_savedomainconf   key  value  base64encode
#save to domain.conf
_savedomainconf() {
  _save_conf "$DOMAIN_CONF" "$@"
}

#_cleardomainconf   key
_cleardomainconf() {
  _clear_conf "$DOMAIN_CONF" "$1"
}

#_readdomainconf   key
_readdomainconf() {
  _read_conf "$DOMAIN_CONF" "$1"
}

it would make sense to store the requisite details in the same place as the auth method and hooks are stored (i.e. Le_Webroot "dns_...." or Le_DeployHook since those are stored per-domain.

dns_myapi_add() {
...

  MYAPI_Username="${MYAPI_Username:-$(_readdomainconf MYAPI_Username)}"
  MYAPI_Password="${MYAPI_Password:-$(_readdomainconf MYAPI_Password)}"
  if [ -z "$MYAPI_Username" ] || [ -z "$MYAPI_Password" ]; then
    MYAPI_Username=""
    MYAPI_Password=""
    _err "You don't specify cloudflare api key and email yet."
    _err "Please create you key and try again."
    return 1
  fi

  #save the credentials to the account conf file.
 _savedomainconf MYAPI_Username "$MYAPI_Username"
 _savedomainconf MYAPI_Password "$MYAPI_Password"
...

}

Is this feasible?

[HLFH]

Any updates?

[thompol]

This is discussed in the following duplicate issues: #1278, #3779, #3988

Any reason that this is still a global setting, instead of per domain by default?

[thompol]

To add some info, I want to implement DNS-01 verification for ISPConfig, but with the current storing of credentials this would not work.