Show OVH: A small tool to automate adding new subdomain DNS zone + Let's Encrypt credentials

Domains and Hosting
, , ,
1

I self-host a bunch of tools, like I believe many here do, and I issue a subdomain + Let's Encrypt certificate for the vast majority of them. I also use the DNS-01 challenge to avoid exposing an HTTP server to the outside world. Since DNS-01 requires OVH API credentials, I create a DNS zone for each subdomain, then delegate the NS, then issue a set of API keys for that zone to keep things isolated for security.

This is somewhat tedious, so I (and Claude) wrote a simple script that automates the process:

  • orders the zone
  • adds the NS delegation and waits until everything is live
  • issues a set of API keys for the new subdomain
  • prints ready-to-paste blocks for acme.sh (with renewal cron) or a Caddy container

Every consumer key is requested with the minimum access rules and has to be validated in the browser before it becomes active — the script picks the keys up over the API, so nothing is ever copy-pasted.

Single Python file, no dependencies beyond the standard library. Feedback welcome:

https://github.com/wrobelda/ovh-subdomain-provision

2

Hi @wrobelda

The automation of DNS zone creation, delegation, and generation of API keys with limited permissions is a very elegant solution :ok_hand: I love the idea of isolating each subdomain in its own DNS zone for security, so that if a key gets compromised, the damage is limited to that subdomain.

Thanks for sharing it, I'm sure many will find it great :folded_hands:

Best regards,
Sergio Turpín

3

Interesting project, thanks for sharing! :slight_smile:

4

Hehe, like you, I'm careful not to expose the SSL certificates of certain subdomains to the outside world.

I did the same thing but in a Bash version; however, I generate a wildcard certificate (Let's Encrypt now allows it), so a single cert covers all subdomains.

5

How do you usually do it?

6

For a typical site I handle it with certbot, e.g.:
certbot --apache certonly -d <domainName>