Allow domain overrides for challenge delegation

[jpeddicord]

This enables delegation of a challenge for a domain (e.g.
my.example.com) to a DuckDNS subdomain (example.duckdns.org) as
described on the LetsEncrypt website. This is useful if your
"main" domain has a difficult DNS API or you'd rather just use
DuckDNS'. Example setup:

my.example.com -> CNAME example.duckdns.org
_acme-challenge.my.example.com -> CNAME example.duckdns.org

DNS challenges will be performed on example.duckdns.org, while the
actual certificate will be issued for my.example.com.

---

From LE:

Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server.

I'm writing up an equivalent commit for caddy-dns/duckdns, too. I've gotten this working on my own home network pretty easily, and figured I'd share the change since it's (IMO) super useful and often much easier to delegate the DNS work to DuckDNS instead of messing with most other providers. At least for home networks, where DuckDNS is mostly used.

Without this change, the domain isn't overridden, and Caddy attempts to ask DuckDNS to update DNS entries for the "main" domain (in the example above, that's my.example.com). DuckDNS has no idea what to do with that, and returns an error.

[francislavoie]

Huh, that's really interesting. So basically it would work like this?

foo.example.com {
	tls {
		dns duckdns <token> {
			override_domain my-duckdns-domain.duckdns.org
		}
	}

	...
}

[jpeddicord]

Exactly -- my snippet in my config looks just like that.

For your example, foo.example.com would be a CNAME to my-duckdns-domain.duckdns.org. You'd then want another CNAME from _acme-challenge.foo.example.com to my-duckdns-domain.duckdns.org. That's all that's needed to get the correct certs.

[francislavoie]

Very cool. TIL. Thanks!

Surprised to get a PR only like a week after publishing this repo 😅

[jpeddicord]

Haha yeah the timing is funny. I found out about Caddy in general this week while off on holiday and wanted to try things out. Love some fresh new code. :)

[francislavoie]

Awesome! Feel free to come hang out on the forums for any discussion/question you might have https://caddy.community

I'll await your followup PR on https://github.com/caddy-dns/duckdns 😁

[cameronelliott]

This is a cool PR! I learned something new today! 🚀