gibdns-gcore

gibdns provider for Gcore DNS. Hosts such as gibcert execute this binary to publish ACME DNS-01 TXT records.

Gcore's API has no TLSA support. Do not use this provider for automatic DANE publication.

Protocol	TXT	TLSA	Zone discovery
gibdns/draft-01	yes	no	yes
gibdns/draft-02	yes	no	yes

Install

Download the archive or .deb for your OS from the releases page.

Debian package (installs to /usr/libexec/gibdns):

sudo dpkg -i gibdns-gcore_*_linux_amd64.deb

Tarball:

sudo install -D -m 0755 gibdns-gcore /usr/local/libexec/gibdns/gibdns-gcore

From source:

make install PREFIX=/usr/local

The binary is not an interactive CLI and is intentionally not installed on PATH. Confirm the installation, then let the host invoke it:

# Debian package:
test -x /usr/libexec/gibdns/gibdns-gcore
# Source or tarball install:
test -x /usr/local/libexec/gibdns/gibdns-gcore

Use /usr/libexec/gibdns/gibdns-gcore for a Debian package or /usr/local/libexec/gibdns/gibdns-gcore for a source or tarball install in host configuration. See Using gibdns for the host and provider split.

Use with gibcert

Store a Gcore permanent API key at /etc/gibcert/gcore-api-key with mode 0600. Then:

provider gcore {
  type dns
  driver exec
  command /usr/libexec/gibdns/gibdns-gcore
  zone example.com.

  secret api_key {
    file /etc/gibcert/gcore-api-key
  }
}

certificate wildcard-example.com {
  account letsencrypt
  names example.com *.example.com

  challenge dns-01 {
    provider gcore
    propagation-timeout 120s
  }
}

zone is optional because this provider advertises zone discovery. Set it when you want an exact zone selector. If installed from source or a tarball, use /usr/local/libexec/gibdns/gibdns-gcore instead.

gibcert binding details are in External DNS Providers.

Secrets

• api_key (required): a Gcore permanent API key

Config

• api_url (optional)

Minimum TTL depends on the Gcore plan. The provider advertises 120 seconds as a conservative hint. Patch is a full RRset replace, so concurrent_safe_patch is false; use if_revision. TLSA is not advertised.

This provider talks to the official Gcore DNS SDK rather than libdns/gcore.

Batching

gibdns/draft-02 adds rrset.batch. The Gcore DNS API (checked against Gcore DNS SDK v0.3.3 and the Gcore API reference) has only single-RRset create, update and delete calls, besides whole-zone import, so there is no batch endpoint. This provider therefore applies a batch one RRset at a time, in request order, issuing the same create, update or delete requests as the equivalent single rrset.patch or rrset.replace calls. There is no bulk read either: all RRsets are read first, one request each, and each is read again after the writes to report the result. The first failing operation stops the batch and is returned with its details.op_index; the operations before it stay applied and the ones after it are not attempted. atomic: true is not supported: capabilities report features.batch.atomic: false, and such a request fails with unsupported_precondition before any upstream request. No maximum batch size is advertised.

In gibdns/draft-02 capabilities, if_revision and if_absent are check_then_write: the precondition is evaluated against freshly read state and the write follows. Gcore has no conditional write, so a concurrent writer between the read and the write can be overwritten. gibdns/draft-01 behaves as before.

Development

make test
make build
make snapshot

Publish a tagged release with make release. That target runs GoReleaser via go run; a GITEA_TOKEN with package/release access is required.