mirror of
https://code.forgejo.org/actions/ovh-dns-update.git
synced 2024-11-25 07:00:55 -05:00
57 lines
2.5 KiB
Markdown
57 lines
2.5 KiB
Markdown
# OVH DNS Update
|
|
|
|
<!-- action-docs-description -->
|
|
## Description
|
|
|
|
Update a given DNS record using the OVH API for use in the [Release Version Check Over DNS (RVCoDNS)](https://codeberg.org/forgejo-contrib/rvcodns).
|
|
|
|
**NOTE:** This action is written in Go. Please setup the Go environment (>=1.21) before running this action or use a runner with Go environment installed.
|
|
|
|
<!-- action-docs-description -->
|
|
<!-- action-docs-inputs -->
|
|
## Inputs
|
|
|
|
| parameter | description | required | default |
|
|
| --- | --- | --- | --- |
|
|
| subdomain | The subdomain to update (e.g. _release) | `true` | |
|
|
| domain | The domain (zoneName in the OVH API) | `true` | |
|
|
| record-id | The ID of the record to update | `true` | |
|
|
| value | The TXT value to set | `true` | |
|
|
| ovh-endpoint | The OVH API endpoint | `false` | `ovh-eu` |
|
|
| ovh-app-key | The OVH API Application Key | `true` | |
|
|
| ovh-app-secret | The OVH API Application Secret | `true` | |
|
|
| ovh-consumer-key | The OVH API Consumer Key | `true` | |
|
|
<!-- action-docs-inputs -->
|
|
|
|
## Security notice
|
|
|
|
You should create restricted credentials for only the specific record you want to update. See https://api.ovh.com/console/#/domain/zone/%7BzoneName%7D/record~GET to retrieve its `record-id` and then visit https://www.ovh.com/auth/api/createToken?PUT=/domain/zone/{domain}/record/{record-id} (replacing the placeholders) to create dedicated credentials.
|
|
|
|
**However be aware that the credentials can also update the subdmain!** This means that anyone with this credentials can publish a TXT record under any `subdomain` of the `domain` (for instance to get a signed certificate by completing the [DNS challenge of the ACME protocol](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge)).
|
|
|
|
To mitigate this issue, [forgejo.org decided to use a dedicated `domain`](https://codeberg.org/forgejo/infrastructure-as-code/issues/5) with only TXT records (and CNAME records on the main `domain`, which points to those TXT records).
|
|
|
|
|
|
## Example
|
|
|
|
```
|
|
on: [tag]
|
|
jobs:
|
|
upload-release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- uses: https://code.forgejo.org/actions/setup-go@v4
|
|
with:
|
|
go-version: ">=1.21"
|
|
check-latest: true
|
|
- uses: actions/forgejo-release@v1
|
|
with:
|
|
subdomain: _release
|
|
domain: example.org
|
|
record-id: 12345
|
|
value: v=${{ github.ref_name }}
|
|
ovh-app-key: ${{ secrets.OVH_APP_KEY }}
|
|
ovh-app-secret: ${{ secrets.OVH_APP_SECRET }}
|
|
ovh-consumer-key: ${{ secrets.OVH_CON_KEY }}
|
|
```
|