13 ธันวาคม 2568

Traefik dnsChallenge with RFC2136 (Bind9)

 .env
RFC2136_NAMESERVER=<your_nameserver>
RFC2136_TSIG_KEY=<tsig_key>
RFC2136_TSIG_ALGORITHM=<tsig_algorithm>
RFC2136_TSIG_SECRET=<tsig_secret>

docker-compose.yml
- TRAEFIK_CERTIFICATESRESOLVERS_RFC2136_ACME_DNSCHALLENGE_RFC2136_NAMESERVER=${RFC2136_NAMESERVER}
- TRAEFIK_CERTIFICATESRESOLVERS_RFC2136_ACME_DNSCHALLENGE_RFC2136_TSIG_KEY=${RFC2136_TSIG_KEY}
- TRAEFIK_CERTIFICATESRESOLVERS_RFC2136_ACME_DNSCHALLENGE_RFC2136_TSIG_ALGORITHM=${RFC2136_TSIG_ALGORITHM}
- TRAEFIK_CERTIFICATESRESOLVERS_RFC2136_ACME_DNSCHALLENGE_RFC2136_TSIG_SECRET=${RFC2136_TSIG_SECRET}

traefik_config.yml
certificatesResolvers:
  rfc2136:
    acme:
      dnsChallenge:
        provider: "rfc2136"
      email: "<your_email>"
      storage: "/letsencrypt/rfc2136.json"

ref: https://go-acme.github.io/lego/dns/rfc2136/

HmacSHA1   = "hmac-sha1."
HmacSHA224 = "hmac-sha224."
HmacSHA256 = "hmac-sha256."
HmacSHA384 = "hmac-sha384."
HmacSHA512 = "hmac-sha512."