Infomaniak (dns_infomaniak)

Infomaniak is one choice among many

This page is one provider page of a list. Pick the page of the company that hosts your DNS zone: OVHcloud, Cloudflare, Gandi, Hetzner, AWS Route 53, Azure DNS, deSEC, DigitalOcean, Linode / Akamai, PowerDNS, or any other acme.sh hook.

DNS-01 proves that you own the name by writing a TXT record _acme-challenge.<name> in your public DNS zone through Infomaniak's API. No inbound port is needed. See TLS certificates to decide whether you need it.

Variables

Variable	Kind	Notes
INFOMANIAK_API_TOKEN	secret	Typed on the server or read from the credentials file. Never on a command line.

The names are the exact acme.sh ones.

Least privilege

Create an API token with the domain scope only (Manager > API tokens), dedicated to this host. Revoke it when the host is retired.

Always use a token dedicated to one host, limited to the zone, with an expiry when Infomaniak supports it. If you cannot restrict it enough, use a challenge alias so the token only needs rights on a small dedicated zone.

Example: install with scripts/install.sh

This is an example

Replace the provider, the domain and the e-mail with yours.

1. Put the secret values in a file only root can read (one VARIABLE=value per line):

   ( umask 077; cat > /root/tenantry-dns.env <<'EOF'
   INFOMANIAK_API_TOKEN=<value>
   EOF
   )
   

2. Install. The guided mode asks for the same things. This is the equivalent command, for Tenantry on the same server as Teleport:

   sudo scripts/install.sh --name acme --public-url https://tenantry.acme.ch:9443 \
     --teleport-local auto \
     --tls acme-dns --dns-provider dns_infomaniak \
     --dns-credentials-file /root/tenantry-dns.env \
     --acme-email ops@acme.ch --https-port 9443
   

   --https-port 9443 is used because Teleport already owns port 443 on the same server. On a server without Teleport, leave it out and use --public-url https://tenantry.acme.ch.

3. Delete the credentials file (shred -u /root/tenantry-dns.env). The installer keeps its own copy in <dir>/secrets/acme-dns.env (mode 0600) for the renewals.

To replace the token later, delete <dir>/secrets/acme-dns.env and run install.sh again.

The Teleport master bundle (bootstrap.sh) and the Steward bundles (install.sh) ask for the same variables, or read --dns-credentials-file FILE.