Bdtjtk

For those who use lexicon for dns manipulation

I'm trying to use lexicon dns api with gandi as dns provider, and have authentication error.

In fact I'm trying to generate letsencrypt certificate on a non publicly accessible vagrant box, using an ansible playbook, for my domain hosted by gandi.

In the list of providers here in the documentation page, I don't see gandi name.

Is that why it fails? An I saw AWS Route53 in the potential providers list, does it mean AWS is supported by lexicon or no?

Here is the error I get when executing my playbook :

fatal: [172.16.2.15]: FAILED! => {"changed": true, "cmd": "/srv/dehydrated/dehydrated --cron --hook /srv/dehydrated/dehydrated.default.sh --challenge dns-01 --accept-terms", "delta": "0:00:05.839602", "end": "2018-12-28 15:34:52.558788", "msg": "non-zero return code", "rc": 1, "start": "2018-12-28 15:34:46.719186", "stderr": "#n# !! WARNING !! No main config file found, using default config!n#nTraceback (most recent call last):n  File "/usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py", line 286, in authenticaten    payload = self._api.domain.info(self._api_key, self._domain)n  File "/usr/lib/python3.6/xmlrpc/client.py", line 1112, in __call__n    return self.__send(self.__name, args)n  File "/usr/lib/python3.6/xmlrpc/client.py", line 1452, in __requestn    verbose=self.__verbosen  File "/usr/lib/python3.6/xmlrpc/client.py", line 1154, in requestn    return self.single_request(host, handler, request_body, verbose)n  File "/usr/lib/python3.6/xmlrpc/client.py", line 1170, in single_requestn    return self.parse_response(resp)n  File "/usr/lib/python3.6/xmlrpc/client.py", line 1342, in parse_responsen    return u.close()n  File "/usr/lib/python3.6/xmlrpc/client.py", line 656, in closen    raise Fault(**self._stack[0])nxmlrpc.client.Fault: <Fault 510150: 'Error on object : OBJECT_ACCOUNT (CAUSE_NORIGHT) [Invalid API key]'>nnDuring handling of the above exception, another exception occurred:nnTraceback (most recent call last):n  File "/usr/local/bin/lexicon", line 11, in <module>n    sys.exit(main())n  File "/usr/local/lib/python3.6/dist-packages/lexicon/cli.py", line 102, in mainn    results = client.execute()n  File "/usr/local/lib/python3.6/dist-packages/lexicon/client.py", line 64, in executen    self.provider.authenticate()n  File "/usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py", line 81, in authenticaten    domain_id = self.rpc_helper.authenticate()n  File "/usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py", line 290, in authenticaten    raise Exception("Failed to authenticate: '{0}'".format(err))nException: Failed to authenticate: '<Fault 510150: 'Error on object : OBJECT_ACCOUNT (CAUSE_NORIGHT) [Invalid API key]'>'", "stderr_lines": ["#", "# !! WARNING !! No main config file found, using default config!", "#", "Traceback (most recent call last):", "  File "/usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py", line 286, in authenticate", "    payload = self._api.domain.info(self._api_key, self._domain)", "  File "/usr/lib/python3.6/xmlrpc/client.py", line 1112, in __call__", "    return self.__send(self.__name, args)", "  File "/usr/lib/python3.6/xmlrpc/client.py", line 1452, in __request", "    verbose=self.__verbose", "  File "/usr/lib/python3.6/xmlrpc/client.py", line 1154, in request", "    return self.single_request(host, handler, request_body, verbose)", "  File "/usr/lib/python3.6/xmlrpc/client.py", line 1170, in single_request", "    return self.parse_response(resp)", "  File "/usr/lib/python3.6/xmlrpc/client.py", line 1342, in parse_response", "    return u.close()", "  File "/usr/lib/python3.6/xmlrpc/client.py", line 656, in close", "    raise Fault(**self._stack[0])", "xmlrpc.client.Fault: <Fault 510150: 'Error on object : OBJECT_ACCOUNT (CAUSE_NORIGHT) [Invalid API key]'>", "", "During handling of the above exception, another exception occurred:", "", "Traceback (most recent call last):", "  File "/usr/local/bin/lexicon", line 11, in <module>", "    sys.exit(main())", "  File "/usr/local/lib/python3.6/dist-packages/lexicon/cli.py", line 102, in main", "    results = client.execute()", "  File "/usr/local/lib/python3.6/dist-packages/lexicon/client.py", line 64, in execute", "    self.provider.authenticate()", "  File "/usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py", line 81, in authenticate", "    domain_id = self.rpc_helper.authenticate()", "  File "/usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py", line 290, in authenticate", "    raise Exception("Failed to authenticate: '{0}'".format(err))", "Exception: Failed to authenticate: '<Fault 510150: 'Error on object : OBJECT_ACCOUNT (CAUSE_NORIGHT) [Invalid API key]'>'"], "stdout": "+ Generating account key...n+ Registering account key with ACME server...n + Creating chain cache directory /srv/dehydrated/chainsnProcessing gitlab.lescdn.comn + Creating new directory /srv/dehydrated/certs/gitlab.lescdn.com ...n + Signing domains...n + Generating private key...n + Generating signing request...n + Requesting new certificate order from CA...n + Received 1 authorizations URLs from the CAn + Handling authorization for gitlab.lescdn.comn + 1 pending challenge(s)n + Deploying challenge tokens...ndeploy_challenge called: gitlab.lescdn.com, 1ifWXObduKNTkKbqkpXEtBpie_p1p1xL2ivugVS9Z3c, 2TgAYwV1RyI-gy6cXAtav36NI7LElHLjoKhcv0ugsag", "stdout_lines": ["+ Generating account key...", "+ Registering account key with ACME server...", " + Creating chain cache directory /srv/dehydrated/chains", "Processing gitlab.lescdn.com", " + Creating new directory /srv/dehydrated/certs/gitlab.lescdn.com ...", " + Signing domains...", " + Generating private key...", " + Generating signing request...", " + Requesting new certificate order from CA...", " + Received 1 authorizations URLs from the CA", " + Handling authorization for gitlab.lescdn.com", " + 1 pending challenge(s)", " + Deploying challenge tokens...", "deploy_challenge called: gitlab.lescdn.com, 1ifWXObduKNTkKbqkpXEtBpie_p1p1xL2ivugVS9Z3c, 2TgAYwV1RyI-gy6cXAtav36NI7LElHLjoKhcv0ugsag"]}

I can see the file /usr/local/lib/python3.6/dist-packages/lexicon/providers/gandi.py is executed and fails at line 286, so for my the gandi provider is supported but not listed in the lexicon page, so I'm confusing about the ansible task fails.

I found the issue.

It was specific to the gandi provider lexicon module, which use rpc protocol by default.

As I'm using the gandi liveDNS API, I should you the rest protocol.

To solve the issue, I use a LEXICON_GANDI_API_PROTOCOL dynamic environment variable set from my ansible playbook to rest, and it works.