Dns validation for https (#49)

* Add DNS-01 challenge support for Let's Encrypt Co-authored-by: mathieumoran1 <[email protected]> * Refactor letsencrypt script to use /dev/tty for interactive prompts Co-authored-by: mathieumoran1 <[email protected]> * feat: Add optional DNS hook mode for certonly Co-authored-by: mathieumoran1 <[email protected]> * Refactor: Improve MongoDB connection and add certifi Co-authored-by: mathieumoran1 <[email protected]> * Checkpoint before follow-up message Co-authored-by: mathieumoran1 <[email protected]> --------- Co-authored-by: Cursor Agent <[email protected]>
2025-12-22 04:16:45 -05:00
parent 812590d262
commit 5325576dc4
6 changed files with 315 additions and 26 deletions
@@ -37,6 +37,38 @@ sudo -E python3 -m python_video_server.letsencrypt certonly \
  --domains example.com,www.example.com
 ```

+### 1b) Issue a certificate (DNS-01 manual TXT record — no port 80, no root)
+
+If your host already uses port **80** (or you don't have permission to bind it), use DNS-01.
+This does **not** require any inbound ports on the machine, but you must be able to edit DNS for the domain.
+
+```bash
+python3 -m pip install -r python_video_server/requirements.txt
+
+# Add --production when staging works.
+python3 -m python_video_server.letsencrypt certonly \
+  --challenge dns \
+  --email [email protected] \
+  --domains example.com,www.example.com
+```
+
+During issuance, certbot will prompt you to create a TXT record like:
+- Name: `_acme-challenge.example.com`
+- Type: `TXT`
+- Value: (a token certbot prints)
+
+After it propagates, press Enter and certbot will continue.
+
+If you run into a situation where the prompt/token only shows up in logs, you can try the hook-based mode:
+
+```bash
+python3 -m python_video_server.letsencrypt certonly \
+  --challenge dns \
+  --dns-hooks \
+  --email [email protected] \
+  --domains example.com,www.example.com
+```
+
 Certificates will be written under:
 - `python_video_server/certs/config/live/<primary-domain>/fullchain.pem`
 - `python_video_server/certs/config/live/<primary-domain>/privkey.pem`