OVHcloud (dns_ovh)

DNS-01 proves that you own the name by writing a TXT record _acme-challenge.<name> in your public DNS zone through OVHcloud's API. No inbound port is needed. See TLS certificates to decide whether you need it.

Variables

Variable	Kind	Notes
OVH_AK	secret	Typed on the server or read from the credentials file. Never on a command line.
OVH_AS	secret	Typed on the server or read from the credentials file. Never on a command line.
OVH_CK	secret	Typed on the server or read from the credentials file. Never on a command line.
OVH_END_POINT	setting	required; ovh-eu (default), ovh-us, ovh-ca, kimsufi-eu, kimsufi-ca, soyoustart-eu, soyoustart-ca. Passed with --dns-setting OVH_END_POINT=....

The names are the exact acme.sh ones.

Least privilege

Create the application keys with rights restricted to the zone: GET /domain/zone/<zone>/*, POST /domain/zone/<zone>/* and DELETE /domain/zone/<zone>/record/*. No account-wide rights.

Always use a token dedicated to one host, limited to the zone, with an expiry when OVHcloud supports it. If you cannot restrict it enough, use a challenge alias so the token only needs rights on a small dedicated zone.

Install with scripts/install.sh

1. Put the secret values in a file only root can read (one VARIABLE=value per line):

   ( umask 077; cat > /root/tenantry-dns.env <<'EOF'
   OVH_AK=<value>
   OVH_AS=<value>
   OVH_CK=<value>
   EOF
   )
   

2. Install. The guided mode asks for the same things. This is the equivalent command, for Tenantry on the same server as Teleport:

   sudo scripts/install.sh --name acme --public-url https://tenantry.acme.ch:9443 \
     --teleport-local auto \
     --tls acme-dns --dns-provider dns_ovh \
     --dns-setting OVH_END_POINT=ovh-eu \
     --dns-credentials-file /root/tenantry-dns.env \
     --acme-email ops@acme.ch --https-port 9443
   

   --https-port 9443 is used because Teleport already owns port 443 on the same server. On a server without Teleport, leave it out and use --public-url https://tenantry.acme.ch.

3. Delete the credentials file (shred -u /root/tenantry-dns.env). The installer keeps its own copy in <dir>/secrets/acme-dns.env (mode 0600) for the renewals.

To replace the token later, delete <dir>/secrets/acme-dns.env and run install.sh again.

The Teleport master bundle (bootstrap.sh) and the Steward bundles (install.sh) ask for the same variables, or read --dns-credentials-file FILE.