使用 LetsEncrypt Boulder 作为 DNS 服务器

Question

我有一个本地 docker-compose 设置，我正在其中测试一些 HTTPS 要求。为了进行同样的设置，LetsEncrypt Boulder Docker 镜像被用作本地 CA。我已经用相同的方法测试了 CertBot，并且能够生成证书。

此外，traefik 被用作反向代理系统，试图验证 DNS 服务器上的 HTTPS TXT、AAAA 等。

我需要知道我是否可以将 Boulder 用作本地 DNS 服务器，如果可以，那么是否有任何文档。

另外，我目前正在使用 DNSMASQ 作为本地 DNS 服务器。有什么办法可以在运行时更新 TXT 值以及 DNSMASQ 中的所有内容..？

提前致谢

Answer 1

是的，你可以。检查这个docker-compose.yml 文件：

version: "3"

networks:
  test:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.77.77.0/24

services:
  boulder:
    # To minimize fetching this should be the same version used below
    image: containous/boulder:containous-acmev2
    environment:
      FAKE_DNS: 10.77.77.1
      PKCS11_PROXY_SOCKET: tcp://boulder-hsm:5657
    restart: unless-stopped
    extra_hosts:
      - docker.com:10.77.77.66
      - boulder:10.77.77.77
    ports:
      - 4000:4000 # ACME
      - 4001:4001 # ACMEv2
      - 4002:4002 # OCSP
      - 4003:4003 # OCSP
      - 4430:4430 # ACME via HTTPS
      - 4431:4431 # ACMEv2 via HTTPS
      - 8055:8055 # dns-test-srv updates
    depends_on:
      - bhsm
      - bmysql
    networks:
      test:
        ipv4_address: 10.77.77.77
        aliases:
          - sa2.boulder
          - ca2.boulder
          - ra2.boulder
          - va2.boulder
          - publisher2.boulder

  bhsm:
    # To minimize fetching this should be the same version used above
    image: letsencrypt/boulder-tools:2018-03-07
    hostname: boulder-hsm
    environment:
      PKCS11_DAEMON_SOCKET: tcp://0.0.0.0:5657
    command: /usr/local/bin/pkcs11-daemon /usr/lib/softhsm/libsofthsm2.so
    expose:
      - 5657
    networks:
      test:
        aliases:
          - boulder-hsm

  bmysql:
    image: mariadb:10.1
    hostname: boulder-mysql
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    command: mysqld --bind-address=0.0.0.0
    logging:
        driver: none
    networks:
      test:
        aliases:
          - boulder-mysql

  proxy:
    image: containous/traefik
    depends_on:
      - boulder
    extra_hosts:
      - traefik.boulder.com:10.77.77.77
    networks:
      test:
        ipv4_address: 10.77.77.66
    ports:
      - "0.0.0.0:80:80"
      - "5002:80"
      - "0.0.0.0:443:443"
      - "0.0.0.0:8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.toml:/traefik.toml
      - "./acme/:/acme/:rw"

  consul:
    image: consul
    networks:
      - test
    command: agent -server -bootstrap -ui -client 0.0.0.0 -log-level debug
    ports:
      - "8400:8400"
      - "0.0.0.0:8500:8500"
      - "8600:53/udp"
    expose:
      - "8300"
      - "8301"
      - "8301/udp"
      - "8302"
      - "8302/udp"

  whoami:
    image: containous/whoami
    networks:
      - test
    labels:
      - traefik.enable=true
      - traefik.port=80
      - traefik.backend=whoami
      - traefik.network=test
      - traefik.frontend.rule=Host:whoami.docker.com

  storeconfig:
    image: containous/traefik
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    - ./traefik.toml:/traefik.toml
    - "./acme/:/acme/:rw"
    command: storeconfig --debug --configfile=/traefik.toml --logLevel="DEBUG"
    networks:
      - test