DigitalOcean (dns_dgon)

DNS-01 proves that you own the name by writing a TXT record _acme-challenge.<name> in your public DNS zone through DigitalOcean's API. No inbound port is needed. See TLS certificates to decide whether you need it.

Variables

Variable	Kind	Notes
DO_API_KEY	secret	Typed on the server or read from the credentials file. Never on a command line.

The names are the exact acme.sh ones.

Least privilege

Create a token with the custom scopes domain:read and domain:update only, with an expiry.

Always use a token dedicated to one host, limited to the zone, with an expiry when DigitalOcean supports it. If you cannot restrict it enough, use a challenge alias so the token only needs rights on a small dedicated zone.

Install with scripts/install.sh

1. Put the secret values in a file only root can read (one VARIABLE=value per line):

   ( umask 077; cat > /root/tenantry-dns.env <<'EOF'
   DO_API_KEY=<value>
   EOF
   )
   

2. Install. The guided mode asks for the same things. This is the equivalent command, for Tenantry on the same server as Teleport:

   sudo scripts/install.sh --name acme --public-url https://tenantry.acme.ch:9443 \
     --teleport-local auto \
     --tls acme-dns --dns-provider dns_dgon \
     --dns-credentials-file /root/tenantry-dns.env \
     --acme-email ops@acme.ch --https-port 9443
   

   --https-port 9443 is used because Teleport already owns port 443 on the same server. On a server without Teleport, leave it out and use --public-url https://tenantry.acme.ch.

3. Delete the credentials file (shred -u /root/tenantry-dns.env). The installer keeps its own copy in <dir>/secrets/acme-dns.env (mode 0600) for the renewals.

To replace the token later, delete <dir>/secrets/acme-dns.env and run install.sh again.

The Teleport master bundle (bootstrap.sh) and the Steward bundles (install.sh) ask for the same variables, or read --dns-credentials-file FILE.