[GH-ISSUE #278] Allowing acme-dns API from limited set of IP addresses #140

New issue

Closed

opened 2026-03-13 15:55:31 +03:00 by kerem · 2 comments

kerem commented

2026-03-13 15:55:31 +03:00

Owner

Originally created by @shalak on GitHub (Sep 18, 2021).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/278

I'm trying to understand the [api] > ip entry of the configuration file. As far as I understand, this is the only IP address from which I can reach the acme-dns API via the acme-dns-client - is this correct?

My issue is that I'd like to set up a publicly exposed acme-dns server, which will also run the acme-dns-client locally:

the public exposure is for hosts that come with their own acme-dns integration (e.g. proxmox server), so they will provision themselves (they will call acme-dns from static IPs)
the acme-dns-client will produce certs that will be provisioned to hosts that are unable to do it themselves (i.e. printers, etc) by multitude of custom scripts

So basically, for security reasons, I need to limit acme-dns API to allow only those static IPs and the localhost. How can I do it?

Bonus question: I'd like the point no. 1 to be using different domains per each of the hosts, but on point no. 2 - the wildcard. Is this possible (I do not fully understand the issue of limir of 2 TXT records in acme-dns)

Originally created by @shalak on GitHub (Sep 18, 2021). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/278 I'm trying to understand the `[api]` > `ip` entry of the configuration file. As far as I understand, this is the only IP address from which I can reach the acme-dns API via the acme-dns-client - is this correct? My issue is that I'd like to set up a publicly exposed acme-dns server, which will also run the acme-dns-client locally: 1. the public exposure is for hosts that come with their own acme-dns integration (e.g. proxmox server), so they will provision themselves (they will call acme-dns from static IPs) 2. the acme-dns-client will produce certs that will be provisioned to hosts that are unable to do it themselves (i.e. printers, etc) by multitude of custom scripts So basically, for security reasons, I need to limit acme-dns API to allow only those static IPs **and** the localhost. How can I do it? Bonus question: I'd like the point no. 1 to be using different domains per each of the hosts, but on point no. 2 - the wildcard. Is this possible (I do not fully understand the issue of limir of 2 TXT records in acme-dns)

kerem closed this issue

2026-03-13 15:55:36 +03:00

kerem commented

2026-03-13 15:55:42 +03:00

Author

Owner

@shalak commented on GitHub (Sep 19, 2021):

Argh... Now I started to realise, that the [api] > ip entry is just a bind for an interface over which the API is exposed. Is my understanding correct?

@shalak commented on GitHub (Sep 19, 2021): Argh... Now I started to realise, that the `[api] > ip` entry is just a bind for an interface over which the API is exposed. Is my understanding correct?

kerem commented

2026-03-13 15:55:47 +03:00

Author

Owner

@joohoi commented on GitHub (Jan 25, 2022):

Yes, your understanding is correct. This way you can bind the API to an internal network IP address, there's no requirement for the HTTP api to be accesible from external network.

That said, acme-dns doesn't offer an built-in way to restrict the access to specific source addresses, but this is where your OS firewall configuration comes to help.

Closing this issue now as I feel it has been properly resolved, feel free to comment if there's something else, and we can reopen if needed.

@joohoi commented on GitHub (Jan 25, 2022): Yes, your understanding is correct. This way you can bind the API to an internal network IP address, there's no requirement for the HTTP api to be accesible from external network. That said, acme-dns doesn't offer an built-in way to restrict the access to specific source addresses, but this is where your OS firewall configuration comes to help. Closing this issue now as I feel it has been properly resolved, feel free to comment if there's something else, and we can reopen if needed.

kerem referenced this issue

2026-03-13 16:17:24 +03:00

[PR #140] [CLOSED] Update README.md #320