From 7e73d5ab875e924695300e4fa3160af264f0616d Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 6 Jan 2024 23:13:59 +0100
Subject: [PATCH 01/13] security/acme-client: add support for duplicate common
 names, fixes #3127

---
 security/acme-client/pkg-descr                |  10 ++
 .../library/OPNsense/AcmeClient/LeAccount.php |  33 ++++++
 .../OPNsense/AcmeClient/LeAutomation/Base.php |   1 +
 .../OPNsense/AcmeClient/LeCertificate.php     |   1 +
 .../library/OPNsense/AcmeClient/LeCommon.php  |   3 +-
 .../OPNsense/AcmeClient/LeValidation/Base.php |   1 +
 .../models/OPNsense/AcmeClient/AcmeClient.xml |   2 +-
 .../OPNsense/AcmeClient/Migrations/M1_6_0.php |   2 +-
 .../OPNsense/AcmeClient/Migrations/M4_0_0.php | 107 ++++++++++++++++++
 .../scripts/OPNsense/AcmeClient/setup.sh      |   4 +-
 10 files changed, 159 insertions(+), 5 deletions(-)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_0_0.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index bfec3433c..a7435246c 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -8,8 +8,18 @@ WWW: https://github.com/acmesh-official/acme.sh
 Plugin Changelog
 ================
 
+4.0
+
+NOTE: This is a new major release with backwards-incompatible changes.
+Downgrade to older releases is not supported. Be sure to create a
+full backup and include /var/etc/acme-client.
+
+Changed:
+* use a dedicated acme.sh runtime directory for every cert (#3127)
+
 Fixed:
 * fix sporadic command failure with gcloud DNS API (#3745)
+* fix errors when the same Common Name is used multiple times (#3127)
 
 3.20
 
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php
index 1186dbccb..7ff90ceda 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php
@@ -224,6 +224,9 @@ class LeAccount extends LeCommon
                 return false;
             }
 
+            // Fix account config
+            $this->fixConfig();
+
             // Update account status.
             LeUtils::log_error('account registration successful for ' . $this->config->name);
             $this->setStatus(200);
@@ -233,4 +236,34 @@ class LeAccount extends LeCommon
 
         return true;
     }
+
+    /**
+     * Remove CERT_HOME property from account config,
+     * otherwise --cert-home will be ignored by acme.sh.
+     */
+    public function fixConfig()
+    {
+        $account_conf_dir = self::ACME_BASE_ACCOUNT_DIR . '/' . (string)$this->config->id . '_' . $this->ca_compat;
+        $account_conf_file = $account_conf_dir . '/account.conf';
+
+        if (is_dir($account_conf_dir)) {
+            if (is_file($account_conf_file)) {
+                // Parse config file and remove property
+                $account_conf = parse_ini_file($account_conf_file);
+                if (isset($account_conf['CERT_HOME'])) {
+                    unset($account_conf['CERT_HOME']);
+                }
+
+                // Convert array back to ini file format
+                $new_account_conf = array();
+                foreach ($account_conf as $key => $value) {
+                    $new_account_conf[] = "${key}='${value}'";
+                }
+
+                // Write changes back to file
+                file_put_contents($account_conf_file, implode("\n", $new_account_conf) . "\n");
+                chmod($account_conf_file, 0600);
+            }
+        }
+    }
 }
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
index fc3119580..f85a23d14 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
@@ -71,6 +71,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
 
         // Store acme filenames
         $this->acme_args[] = LeUtils::execSafe('--home %s', self::ACME_HOME_DIR);
+        $this->acme_args[] = LeUtils::execSafe('--cert-home %s', sprintf(self::ACME_CERT_HOME_DIR, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--certpath %s', sprintf(self::ACME_CERT_FILE, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--keypath %s', sprintf(self::ACME_KEY_FILE, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--capath %s', sprintf(self::ACME_CHAIN_FILE, $this->cert_id));
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
index 177651853..0b319d34b 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
@@ -95,6 +95,7 @@ class LeCertificate extends LeCommon
 
         // Store acme filenames
         $this->acme_args[] = LeUtils::execSafe('--home %s', self::ACME_HOME_DIR);
+        $this->acme_args[] = LeUtils::execSafe('--cert-home %s', sprintf(self::ACME_CERT_HOME_DIR, $this->config->id));
         $this->acme_args[] = LeUtils::execSafe('--certpath %s', $this->cert_file);
         $this->acme_args[] = LeUtils::execSafe('--keypath %s', $this->cert_key_file);
         $this->acme_args[] = LeUtils::execSafe('--capath %s', $this->cert_chain_file);
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
index bf278b7aa..f7237bfcc 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2020-2021 Frank Wall
+ * Copyright (C) 2020-2024 Frank Wall
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -53,6 +53,7 @@ abstract class LeCommon
     // Filenames for certs, configs, ...
     public const ACME_CERT_DIR = '/var/etc/acme-client/certs/%s/';
     public const ACME_CERT_FILE = '/var/etc/acme-client/certs/%s/cert.pem';
+    public const ACME_CERT_HOME_DIR = '/var/etc/acme-client/cert-home/%s';
     public const ACME_CHAIN_FILE = '/var/etc/acme-client/certs/%s/chain.pem';
     public const ACME_CONFIG_DIR = '/var/etc/acme-client/configs/%s/';
     public const ACME_FULLCHAIN_FILE = '/var/etc/acme-client/certs/%s/fullchain.pem';
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php
index 1af7c8dfe..03e229f01 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php
@@ -94,6 +94,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
 
         // Store acme filenames
         $this->acme_args[] = LeUtils::execSafe('--home %s', self::ACME_HOME_DIR);
+        $this->acme_args[] = LeUtils::execSafe('--cert-home %s', sprintf(self::ACME_CERT_HOME_DIR, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--certpath %s', sprintf(self::ACME_CERT_FILE, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--keypath %s', sprintf(self::ACME_KEY_FILE, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--capath %s', sprintf(self::ACME_CHAIN_FILE, $this->cert_id));
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index a174304f8..b69d95fb3 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/AcmeClient</mount>
-    <version>3.5.0</version>
+    <version>4.0.0</version>
     <description>A secure ACME Client plugin</description>
     <items>
         <settings>
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php
index 22bb91001..f6982d236 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M1_6_0.php
@@ -75,7 +75,7 @@ class M1_6_0 extends BaseModelMigration
                     }
 
                     // Write changes back to file
-                    file_put_contents($account_file, implode("\r\n", $new_account_conf) . "\n");
+                    file_put_contents($account_file, implode("\n", $new_account_conf) . "\n");
                     chmod($account_file, 0600);
 
                     // Finally, rename account directory
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_0_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_0_0.php
new file mode 100644
index 000000000..2a776cbe9
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_0_0.php
@@ -0,0 +1,107 @@
+<?php
+
+/**
+ *    Copyright (C) 2024 Frank Wall
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\AcmeClient\Migrations;
+
+use OPNsense\Base\BaseModelMigration;
+
+class M4_0_0 extends BaseModelMigration
+{
+    public function run($model)
+    {
+        $acme_account_dir = '/var/etc/acme-client/accounts/';
+        $old_acme_home = '/var/etc/acme-client/home/';
+        $new_acme_home = '/var/etc/acme-client/cert-home/';
+
+        // Remove CERT_HOME property from all account configs
+        if (is_dir($acme_account_dir)) {
+            $account_files = glob($acme_account_dir . '*/account.conf');
+            foreach ($account_files as $account_file) {
+                if (is_file($account_file)) {
+                    // Parse config file and remove property
+                    $account_conf = parse_ini_file($account_file);
+                    if (isset($account_conf['CERT_HOME'])) {
+                        unset($account_conf['CERT_HOME']);
+                    }
+
+                    // Convert array back to ini file format
+                    $new_account_conf = array();
+                    foreach ($account_conf as $key => $value) {
+                        $new_account_conf[] = "${key}='${value}'";
+                    }
+
+                    // Write changes back to file
+                    file_put_contents($account_file, implode("\n", $new_account_conf) . "\n");
+                    chmod($account_file, 0600);
+                }
+            }
+        }
+
+        // Create new acme home directory
+        if (!is_dir($new_acme_home)) {
+            mkdir($new_acme_home, 0750);
+        }
+
+        // Migrate all certificates to new directory
+        // OLD: /var/etc/acme-client/home/opnsense.example.com
+        // NEW: /var/etc/acme-client/cert-home/659971be677b69.19708532/opnsense.example.com
+        foreach ($model->getNodeByReference('certificates.certificate')->iterateItems() as $cert) {
+            $cert_id = (string)$cert->id;
+            $cert_name = (string)$cert->name;
+
+            $old_cert_home = $old_acme_home . $cert_name;
+            $new_cert_home = $new_acme_home . $cert_id . '/' . $cert_name;
+            $old_cert_home_ecc = $old_acme_home . $cert_name . '_ecc';
+            $new_cert_home_ecc = $new_acme_home . $cert_id . '/' . $cert_name . '_ecc';
+            $_parent_dir = $new_acme_home . $cert_id;
+
+            // Check if cert home directory exists
+            // Certs that haven't been issued yet don't need to be migrated.
+            if (is_dir($old_cert_home)) {
+                // Create parent directory
+                if (!is_dir($_parent_dir)) {
+                    mkdir($_parent_dir, 0750);
+                }
+                // Rename cert home directory
+                rename($old_cert_home, $new_cert_home);
+            }
+
+            // Migrate ECC certs
+            if (is_dir($old_cert_home_ecc)) {
+                // Create parent directory
+                if (!is_dir($_parent_dir)) {
+                    mkdir($_parent_dir, 0750);
+                }
+                // Rename cert home directory
+                rename($old_cert_home_ecc, $new_cert_home_ecc);
+            }
+        }
+    }
+}
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
index fd9b73425..20a65224b 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/setup.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
 ACME_BASE="/var/etc/acme-client"
-ACME_DIRS="/var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/configs /var/etc/acme-client/challenges /var/etc/acme-client/home"
+ACME_DIRS="/var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/configs /var/etc/acme-client/challenges /var/etc/acme-client/home /var/etc/acme-client/cert-home"
 
-# Generate required directories and set owner/mode recursively.
+# Create required directories and set owner/mode recursively.
 for directory in ${ACME_DIRS}; do
     mkdir -p ${directory}
     chown -R root:wheel ${directory}

From 64f2f3f0827f7af901f8e6293b4fce072eb9b4e1 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 9 Jan 2024 17:07:34 +0100
Subject: [PATCH 02/13] security/acme-client: fix shell processes getting
 stuck, refs #3745

This deals with the following issues that occured while performing
extensive testing:
- acme.sh processes got stuck forever
- PHP memory exhaustion
- PHP processes with high CPU usage
---
 .../mvc/app/library/OPNsense/AcmeClient/LeUtils.php  | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php
index cca7ce55e..abc57c4e5 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeUtils.php
@@ -197,14 +197,14 @@ class LeUtils
             // This workaround ensures that the accurate return code
             // is reliably returned.
             fclose($proc_pipes[0]);
-            $output = array();
-            while (!feof($proc_pipes[1])) {
-                $output[] = rtrim(fgets($proc_pipes[1], 1024), "\n");
+            stream_set_blocking($proc_pipes[1], false);
+            stream_set_blocking($proc_pipes[2], false);
+            while (!feof($proc_pipes[1]) || !feof($proc_pipes[2])) {
+                $stdout = fread($proc_pipes[1], 1024);
+                $stderr = fread($proc_pipes[2], 1024);
+                usleep(50000);
             }
             fclose($proc_pipes[1]);
-            while (!feof($proc_pipes[2])) {
-                $output[] = rtrim(fgets($proc_pipes[2], 1024), "\n");
-            }
             fclose($proc_pipes[2]);
 
             // Get exit code

From cd327d04b21ad5cb64596afc5a1dc608d0f18fea Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Tue, 9 Jan 2024 17:28:49 +0100
Subject: [PATCH 03/13] security/acme-client: update changelog, refs #3752

---
 security/acme-client/pkg-descr | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a7435246c..3e7a9aefb 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -20,6 +20,7 @@ Changed:
 Fixed:
 * fix sporadic command failure with gcloud DNS API (#3745)
 * fix errors when the same Common Name is used multiple times (#3127)
+* fix crash on invalid automations (#3752)
 
 3.20
 

From 2ce4b5ca38ca85c80ac8c00f1d1fea96ed808407 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 10 Jan 2024 23:24:25 +0100
Subject: [PATCH 04/13] security/acme-client: add support for Aurora DNS API

---
 security/acme-client/pkg-descr                |  3 ++
 .../AcmeClient/forms/dialogValidation.xml     | 17 ++++++-
 .../AcmeClient/LeValidation/DnsAurora.php     | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAurora.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 3e7a9aefb..1696ab3f6 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -14,6 +14,9 @@ NOTE: This is a new major release with backwards-incompatible changes.
 Downgrade to older releases is not supported. Be sure to create a
 full backup and include /var/etc/acme-client.
 
+Added:
+* add Aurora DNS API
+
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
 
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index c714ce8ed..204ed2bf6 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1702,4 +1702,19 @@
         <label>Password</label>
         <type>password</type>
     </field>
-</form>
\ No newline at end of file
+    <field>
+        <label>Aurora (PCextreme/Versio)</label>
+        <type>header</type>
+        <style>table_dns table_dns_aurora</style>
+    </field>
+    <field>
+        <id>validation.dns_aurora_key</id>
+        <label>Key</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_aurora_secret</id>
+        <label>Secret</label>
+        <type>password</type>
+    </field>
+</form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAurora.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAurora.php
new file mode 100644
index 000000000..64dd25622
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAurora.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Aurora API
+ * @package OPNsense\AcmeClient
+ */
+class DnsAurora extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['AURORA_Key'] = (string)$this->config->dns_aurora_key;
+        $this->acme_env['AURORA_Secret'] = (string)$this->config->dns_aurora_secret;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index b69d95fb3..24770735a 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -426,6 +426,7 @@
                         <dns_ali>aliyun.com</dns_ali>
                         <dns_kas>All-Inkl.com</dns_kas>
                         <dns_arvan>ArvanCloud</dns_arvan>
+                        <dns_aurora>Aurora (PCextreme/Versio)</dns_aurora>
                         <dns_autodns>AutoDNS (InterNetX)</dns_autodns>
                         <dns_aws>AWS Route 53</dns_aws>
                         <dns_azure>Azure DNS</dns_azure>
@@ -1195,6 +1196,12 @@
                 <dns_world4you_password type="TextField">
                     <Required>N</Required>
                 </dns_world4you_password>
+                <dns_aurora_key type="TextField">
+                    <Required>N</Required>
+                </dns_aurora_key>
+                <dns_aurora_secret type="TextField">
+                    <Required>N</Required>
+                </dns_aurora_secret>
             </validation>
         </validations>
         <actions>

From 2b8c1f667985a77b29805e518d91c1e4847409bb Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 10 Jan 2024 23:36:06 +0100
Subject: [PATCH 05/13] security/acme-client: add support for ConoHa DNS API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 25 ++++++++++
 .../AcmeClient/LeValidation/DnsConoha.php     | 46 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml | 14 ++++++
 4 files changed, 86 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConoha.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 1696ab3f6..c9429ff87 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -16,6 +16,7 @@ full backup and include /var/etc/acme-client.
 
 Added:
 * add Aurora DNS API
+* add ConoHa DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 204ed2bf6..7f6addf3d 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1717,4 +1717,29 @@
         <label>Secret</label>
         <type>password</type>
     </field>
+    <field>
+        <label>ConoHa</label>
+        <type>header</type>
+        <style>table_dns table_dns_conoha</style>
+    </field>
+    <field>
+        <id>validation.dns_conoha_user</id>
+        <label>User</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_conoha_password</id>
+        <label>Password</label>
+        <type>password</type>
+    </field>
+    <field>
+        <id>validation.dns_conoha_tenantid</id>
+        <label>Tenant ID</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_conoha_idapi</id>
+        <label>Identity Service API</label>
+        <type>text</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConoha.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConoha.php
new file mode 100644
index 000000000..f1c46fc51
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConoha.php
@@ -0,0 +1,46 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * ConoHa API
+ * @package OPNsense\AcmeClient
+ */
+class DnsConoha extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['CONOHA_Username'] = (string)$this->config->dns_conoha_user;
+        $this->acme_env['CONOHA_Password'] = (string)$this->config->dns_conoha_password;
+        $this->acme_env['CONOHA_TenantId'] = (string)$this->config->dns_conoha_tenantid;
+        $this->acme_env['CONOHA_IdentityServiceApi'] = (string)$this->config->dns_conoha_idapi;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 24770735a..82bad6b75 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -435,6 +435,7 @@
                         <dns_cf>CloudFlare.com</dns_cf>
                         <dns_cx>CloudXNS.com</dns_cx>
                         <dns_cn>Core-Networks</dns_cn>
+                        <dns_conoha>ConoHa</dns_conoha>
                         <dns_cpanel>cPanel</dns_cpanel>
                         <dns_cyon>cyon.ch</dns_cyon>
                         <dns_ddnss>DDNSS</dns_ddnss>
@@ -1202,6 +1203,19 @@
                 <dns_aurora_secret type="TextField">
                     <Required>N</Required>
                 </dns_aurora_secret>
+                <dns_conoha_user type="TextField">
+                    <Required>N</Required>
+                </dns_conoha_user>
+                <dns_conoha_password type="TextField">
+                    <Required>N</Required>
+                </dns_conoha_password>
+                <dns_conoha_tenantid type="TextField">
+                    <Required>N</Required>
+                </dns_conoha_tenantid>
+                <dns_conoha_idapi type="TextField">
+                    <Required>N</Required>
+                    <default>https://identity.xxxx.conoha.io/v2.0</default>
+                </dns_conoha_idapi>
             </validation>
         </validations>
         <actions>

From 6db88d7ce0f07c473c617aa16b60e3b5122b7f3d Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 10 Jan 2024 23:40:54 +0100
Subject: [PATCH 06/13] security/acme-client: add support for Constellix DNS
 API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsConstellix.php | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 67 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConstellix.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index c9429ff87..219c7a8e1 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -17,6 +17,7 @@ full backup and include /var/etc/acme-client.
 Added:
 * add Aurora DNS API
 * add ConoHa DNS API
+* add Constellix DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 7f6addf3d..6babbccd5 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1742,4 +1742,19 @@
         <label>Identity Service API</label>
         <type>text</type>
     </field>
+    <field>
+        <label>Constellix</label>
+        <type>header</type>
+        <style>table_dns table_dns_constellix</style>
+    </field>
+    <field>
+        <id>validation.dns_constellix_key</id>
+        <label>Key</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_constellix_secret</id>
+        <label>Secret</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConstellix.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConstellix.php
new file mode 100644
index 000000000..6d6e53699
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsConstellix.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Constellix API
+ * @package OPNsense\AcmeClient
+ */
+class DnsConstellix extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['CONSTELLIX_Key'] = (string)$this->config->dns_constellix_key;
+        $this->acme_env['CONSTELLIX_Secret'] = (string)$this->config->dns_constellix_secret;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 82bad6b75..13c804c07 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -436,6 +436,7 @@
                         <dns_cx>CloudXNS.com</dns_cx>
                         <dns_cn>Core-Networks</dns_cn>
                         <dns_conoha>ConoHa</dns_conoha>
+                        <dns_constellix>Constellix</dns_constellix>
                         <dns_cpanel>cPanel</dns_cpanel>
                         <dns_cyon>cyon.ch</dns_cyon>
                         <dns_ddnss>DDNSS</dns_ddnss>
@@ -1216,6 +1217,12 @@
                     <Required>N</Required>
                     <default>https://identity.xxxx.conoha.io/v2.0</default>
                 </dns_conoha_idapi>
+                <dns_constellix_key type="TextField">
+                    <Required>N</Required>
+                </dns_constellix_key>
+                <dns_constellix_secret type="TextField">
+                    <Required>N</Required>
+                </dns_constellix_secret>
             </validation>
         </validations>
         <actions>

From 80206e3d6f2ef1b284869e0795b1ee2c08bb5a62 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 10 Jan 2024 23:45:58 +0100
Subject: [PATCH 07/13] security/acme-client: add support for Exoscale DNS API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsExoscale.php   | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 67 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsExoscale.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 219c7a8e1..c4183c106 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -18,6 +18,7 @@ Added:
 * add Aurora DNS API
 * add ConoHa DNS API
 * add Constellix DNS API
+* add Exoscale DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 6babbccd5..3ec67c095 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1757,4 +1757,19 @@
         <label>Secret</label>
         <type>password</type>
     </field>
+    <field>
+        <label>Exoscale</label>
+        <type>header</type>
+        <style>table_dns table_dns_exoscale</style>
+    </field>
+    <field>
+        <id>validation.dns_exoscale_key</id>
+        <label>API Key</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_exoscale_secret</id>
+        <label>Secret Key</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsExoscale.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsExoscale.php
new file mode 100644
index 000000000..f3204e216
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsExoscale.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Exoscale API
+ * @package OPNsense\AcmeClient
+ */
+class DnsExoscale extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['EXOSCALE_API_KEY'] = (string)$this->config->dns_exoscale_key;
+        $this->acme_env['EXOSCALE_SECRET_KEY'] = (string)$this->config->dns_exoscale_secret;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 13c804c07..b4470c465 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -458,6 +458,7 @@
                         <dns_dynv6>dynv6</dns_dynv6>
                         <dns_easydns>EasyDNS</dns_easydns>
                         <dns_euserv>EUserv</dns_euserv>
+                        <dns_exoscale>Exoscale</dns_exoscale>
                         <dns_freedns>FreeDNS</dns_freedns>
                         <dns_gandi_livedns>Gandi LiveDNS</dns_gandi_livedns>
                         <dns_gd>GoDaddy.com</dns_gd>
@@ -1223,6 +1224,12 @@
                 <dns_constellix_secret type="TextField">
                     <Required>N</Required>
                 </dns_constellix_secret>
+                <dns_exoscale_key type="TextField">
+                    <Required>N</Required>
+                </dns_exoscale_key>
+                <dns_exoscale_secret type="TextField">
+                    <Required>N</Required>
+                </dns_exoscale_secret>
             </validation>
         </validations>
         <actions>

From 8a4f7ac2fd0e0b470faa3464a6c68dff2691da26 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 10 Jan 2024 23:51:36 +0100
Subject: [PATCH 08/13] security/acme-client: add support for internetbs.net
 DNS API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsInternetbs.php | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 67 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInternetbs.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index c4183c106..0eb8aefa2 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -19,6 +19,7 @@ Added:
 * add ConoHa DNS API
 * add Constellix DNS API
 * add Exoscale DNS API
+* add internetbs.net DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 3ec67c095..321d5d828 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1772,4 +1772,19 @@
         <label>Secret Key</label>
         <type>password</type>
     </field>
+    <field>
+        <label>internetbs.net</label>
+        <type>header</type>
+        <style>table_dns table_dns_internetbs</style>
+    </field>
+    <field>
+        <id>validation.dns_internetbs_key</id>
+        <label>API Key</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_internetbs_password</id>
+        <label>Password</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInternetbs.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInternetbs.php
new file mode 100644
index 000000000..3d9f40e80
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsInternetbs.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * internetbs.net API
+ * @package OPNsense\AcmeClient
+ */
+class DnsInternetbs extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['INTERNETBS_API_KEY'] = (string)$this->config->dns_internetbs_key;
+        $this->acme_env['INTERNETBS_API_PASSWORD'] = (string)$this->config->dns_internetbs_password;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index b4470c465..4327f6d39 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -471,6 +471,7 @@
                         <dns_he>Hurricane Electric</dns_he>
                         <dns_infoblox>Infoblox</dns_infoblox>
                         <dns_infomaniak>Infomaniak</dns_infomaniak>
+                        <dns_internetbs>internetbs.net</dns_internetbs>
                         <dns_inwx>INWX XMLRPC</dns_inwx>
                         <dns_ionos>IONOS domain</dns_ionos>
                         <dns_ipv64>IPv64.net</dns_ipv64>
@@ -1230,6 +1231,12 @@
                 <dns_exoscale_secret type="TextField">
                     <Required>N</Required>
                 </dns_exoscale_secret>
+                <dns_internetbs_key type="TextField">
+                    <Required>N</Required>
+                </dns_internetbs_key>
+                <dns_internetbs_password type="TextField">
+                    <Required>N</Required>
+                </dns_internetbs_password>
             </validation>
         </validations>
         <actions>

From b76b978fe7c78b1ee2adcb2dd0a7b33fd754ad7d Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Wed, 10 Jan 2024 23:59:24 +0100
Subject: [PATCH 09/13] security/acme-client: add support for PointHQ DNS API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsPointhq.php    | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 67 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPointhq.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 0eb8aefa2..c3d32cbdb 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -20,6 +20,7 @@ Added:
 * add Constellix DNS API
 * add Exoscale DNS API
 * add internetbs.net DNS API
+* add PointHQ DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 321d5d828..dbebb2354 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1787,4 +1787,19 @@
         <label>Password</label>
         <type>password</type>
     </field>
+    <field>
+        <label>PointHQ</label>
+        <type>header</type>
+        <style>table_dns table_dns_pointhq</style>
+    </field>
+    <field>
+        <id>validation.dns_pointhq_key</id>
+        <label>API Key</label>
+        <type>password</type>
+    </field>
+    <field>
+        <id>validation.dns_pointhq_email</id>
+        <label>E-Mail</label>
+        <type>text</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPointhq.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPointhq.php
new file mode 100644
index 000000000..6abc9deb9
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsPointhq.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * PointHQ API
+ * @package OPNsense\AcmeClient
+ */
+class DnsPointhq extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['PointHQ_Key'] = (string)$this->config->dns_pointhq_key;
+        $this->acme_env['exportPointHQ_Email'] = (string)$this->config->dns_pointhq_email;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 4327f6d39..02b2b894f 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -502,6 +502,7 @@
                         <dns_ovh>OVH, kimsufi, soyoustart and runabove</dns_ovh>
                         <dns_pdns>PowerDNS.com</dns_pdns>
                         <dns_pleskxml>Plesk</dns_pleskxml>
+                        <dns_pointhq>PointHQ</dns_pointhq>
                         <dns_porkbun>Porkbun</dns_porkbun>
                         <dns_regru>RegRu</dns_regru>
                         <dns_schlundtech>SchlundTech</dns_schlundtech>
@@ -1237,6 +1238,12 @@
                 <dns_internetbs_password type="TextField">
                     <Required>N</Required>
                 </dns_internetbs_password>
+                <dns_pointhq_key type="TextField">
+                    <Required>N</Required>
+                </dns_pointhq_key>
+                <dns_pointhq_email type="TextField">
+                    <Required>N</Required>
+                </dns_pointhq_email>
             </validation>
         </validations>
         <actions>

From 0da8174c36e6eea277cc1a6820a3962feaf33186 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 11 Jan 2024 00:03:17 +0100
Subject: [PATCH 10/13] security/acme-client: add support for Rackspace DNS API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsRackspace.php  | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 67 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRackspace.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index c3d32cbdb..4e952cc42 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -21,6 +21,7 @@ Added:
 * add Exoscale DNS API
 * add internetbs.net DNS API
 * add PointHQ DNS API
+* add Rackspace DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index dbebb2354..0b33d093b 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1802,4 +1802,19 @@
         <label>E-Mail</label>
         <type>text</type>
     </field>
+    <field>
+        <label>Rackspace</label>
+        <type>header</type>
+        <style>table_dns table_dns_rackspace</style>
+    </field>
+    <field>
+        <id>validation.dns_rackspace_user</id>
+        <label>Username</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_rackspace_key</id>
+        <label>API Key</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRackspace.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRackspace.php
new file mode 100644
index 000000000..1b4c1e6a1
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRackspace.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * Rackspace API
+ * @package OPNsense\AcmeClient
+ */
+class DnsRackspace extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['RACKSPACE_Username'] = (string)$this->config->dns_rackspace_user;
+        $this->acme_env['RACKSPACE_Apikey'] = (string)$this->config->dns_rackspace_key;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 02b2b894f..a168bb824 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -504,6 +504,7 @@
                         <dns_pleskxml>Plesk</dns_pleskxml>
                         <dns_pointhq>PointHQ</dns_pointhq>
                         <dns_porkbun>Porkbun</dns_porkbun>
+                        <dns_rackspace>Rackspace</dns_rackspace>
                         <dns_regru>RegRu</dns_regru>
                         <dns_schlundtech>SchlundTech</dns_schlundtech>
                         <dns_selectel>selectel.com / selectel.ru</dns_selectel>
@@ -1244,6 +1245,12 @@
                 <dns_pointhq_email type="TextField">
                     <Required>N</Required>
                 </dns_pointhq_email>
+                <dns_rackspace_user type="TextField">
+                    <Required>N</Required>
+                </dns_rackspace_user>
+                <dns_rackspace_key type="TextField">
+                    <Required>N</Required>
+                </dns_rackspace_key>
             </validation>
         </validations>
         <actions>

From 225173a56297c7d05b1b474df56c8a4480bcb192 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 11 Jan 2024 00:07:02 +0100
Subject: [PATCH 11/13] security/acme-client: add support for rage4 DNS API

---
 security/acme-client/pkg-descr                |  1 +
 .../AcmeClient/forms/dialogValidation.xml     | 15 +++++++
 .../AcmeClient/LeValidation/DnsRage4.php      | 44 +++++++++++++++++++
 .../models/OPNsense/AcmeClient/AcmeClient.xml |  7 +++
 4 files changed, 67 insertions(+)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRage4.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 4e952cc42..a1e577a1f 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -22,6 +22,7 @@ Added:
 * add internetbs.net DNS API
 * add PointHQ DNS API
 * add Rackspace DNS API
+* add rage4 DNS API
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 0b33d093b..4fd1fd5d4 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1817,4 +1817,19 @@
         <label>API Key</label>
         <type>password</type>
     </field>
+    <field>
+        <label>rage4</label>
+        <type>header</type>
+        <style>table_dns table_dns_rage4</style>
+    </field>
+    <field>
+        <id>validation.dns_rage4_user</id>
+        <label>Username</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>validation.dns_rage4_token</id>
+        <label>Token</label>
+        <type>password</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRage4.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRage4.php
new file mode 100644
index 000000000..86e598a72
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsRage4.php
@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (C) 2024 Frank Wall
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * rage4 API
+ * @package OPNsense\AcmeClient
+ */
+class DnsRage4 extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['RAGE4_TOKEN'] = (string)$this->config->dns_rage4_user;
+        $this->acme_env['RAGE4_USERNAME'] = (string)$this->config->dns_rage4_token;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index a168bb824..bc0a32b0a 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -505,6 +505,7 @@
                         <dns_pointhq>PointHQ</dns_pointhq>
                         <dns_porkbun>Porkbun</dns_porkbun>
                         <dns_rackspace>Rackspace</dns_rackspace>
+                        <dns_rage4>rage4</dns_rage4>
                         <dns_regru>RegRu</dns_regru>
                         <dns_schlundtech>SchlundTech</dns_schlundtech>
                         <dns_selectel>selectel.com / selectel.ru</dns_selectel>
@@ -1251,6 +1252,12 @@
                 <dns_rackspace_key type="TextField">
                     <Required>N</Required>
                 </dns_rackspace_key>
+                <dns_rage4_token type="TextField">
+                    <Required>N</Required>
+                </dns_rage4_token>
+                <dns_rage4_user type="TextField">
+                    <Required>N</Required>
+                </dns_rage4_user>
             </validation>
         </validations>
         <actions>

From a99bfebb71bfd6bbc976d7dd63dd00f984aa0df2 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 11 Jan 2024 00:29:44 +0100
Subject: [PATCH 12/13] security/acme-client: update changelog, refs #3684

---
 security/acme-client/pkg-descr | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index a1e577a1f..d943ce1d0 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -15,6 +15,7 @@ Downgrade to older releases is not supported. Be sure to create a
 full backup and include /var/etc/acme-client.
 
 Added:
+* add nic.ru DNS API (#3684)
 * add Aurora DNS API
 * add ConoHa DNS API
 * add Constellix DNS API

From 1eae27c69f3843f833b801097337c79eaf9e9652 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Mon, 15 Jan 2024 01:05:13 +0100
Subject: [PATCH 13/13] security/acme-client: deprecate lexicon, refs #2920

---
 security/acme-client/pkg-descr                |  54 ++++
 .../AcmeClient/forms/dialogValidation.xml     |   7 +-
 .../models/OPNsense/AcmeClient/AcmeClient.xml | 100 +++----
 .../OPNsense/AcmeClient/Migrations/M4_1_0.php | 266 ++++++++++++++++++
 4 files changed, 371 insertions(+), 56 deletions(-)
 create mode 100644 security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php

diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index d943ce1d0..2a5039e66 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -14,6 +14,10 @@ NOTE: This is a new major release with backwards-incompatible changes.
 Downgrade to older releases is not supported. Be sure to create a
 full backup and include /var/etc/acme-client.
 
+NOTE: Lexicon is deprecated and most configurations are converted
+to native acme.sh DNS APIs. However, in some case manual reconfiguration
+may be necessary.
+
 Added:
 * add nic.ru DNS API (#3684)
 * add Aurora DNS API
@@ -27,12 +31,62 @@ Added:
 
 Changed:
 * use a dedicated acme.sh runtime directory for every cert (#3127)
+* migrate lexicon provider aliyun to acme.sh DNS API (#2920)
+* migrate lexicon provider aurora to acme.sh DNS API (#2920)
+* migrate lexicon provider azure to acme.sh DNS API (#2920)
+* migrate lexicon provider cloudflare to acme.sh DNS API (#2920)
+* migrate lexicon provider cloudns to acme.sh DNS API (#2920)
+* migrate lexicon provider cloudxns to acme.sh DNS API (#2920)
+* migrate lexicon provider conoha to acme.sh DNS API (#2920)
+* migrate lexicon provider constellix to acme.sh DNS API (#2920)
+* migrate lexicon provider digitalocean to acme.sh DNS API (#2920)
+* migrate lexicon provider directadmin to acme.sh DNS API (#2920)
+* migrate lexicon provider dnsimple to acme.sh DNS API (#2920)
+* migrate lexicon provider dnsmadeeasy to acme.sh DNS API (#2920)
+* migrate lexicon provider dnspod to acme.sh DNS API (#2920)
+* migrate lexicon provider dreamhost to acme.sh DNS API (#2920)
+* migrate lexicon provider easydns to acme.sh DNS API (#2920)
+* migrate lexicon provider exoscale to acme.sh DNS API (#2920)
+* migrate lexicon provider gandi to acme.sh DNS API (#2920)
+* migrate lexicon provider godaddy to acme.sh DNS API (#2920)
+* migrate lexicon provider googleclouddns to acme.sh DNS API (#2920)
+* migrate lexicon provider gratisdns to acme.sh DNS API (#2920)
+* migrate lexicon provider henet to acme.sh DNS API (#2920)
+* migrate lexicon provider hetzner to acme.sh DNS API (#2920)
+* migrate lexicon provider infoblox to acme.sh DNS API (#2920)
+* migrate lexicon provider internetbs to acme.sh DNS API (#2920)
+* migrate lexicon provider inwx to acme.sh DNS API (#2920)
+* migrate lexicon provider linode to acme.sh DNS API (#2920)
+* migrate lexicon provider linode4 to acme.sh DNS API (#2920)
+* migrate lexicon provider luadns to acme.sh DNS API (#2920)
+* migrate lexicon provider namecheap to acme.sh DNS API (#2920)
+* migrate lexicon provider namesilo to acme.sh DNS API (#2920)
+* migrate lexicon provider netcup to acme.sh DNS API (#2920)
+* migrate lexicon provider nfsn to acme.sh DNS API (#2920)
+* migrate lexicon provider nsone to acme.sh DNS API (#2920)
+* migrate lexicon provider online to acme.sh DNS API (#2920)
+* migrate lexicon provider ovh to acme.sh DNS API (#2920)
+* migrate lexicon provider plesk to acme.sh DNS API (#2920)
+* migrate lexicon provider pointhq to acme.sh DNS API (#2920)
+* migrate lexicon provider powerdns to acme.sh DNS API (#2920)
+* migrate lexicon provider rackspace to acme.sh DNS API (#2920)
+* migrate lexicon provider rage4 to acme.sh DNS API (#2920)
+* migrate lexicon provider route53 to acme.sh DNS API (#2920)
+* migrate lexicon provider transip to acme.sh DNS API (#2920)
+* migrate lexicon provider vultr to acme.sh DNS API (#2920)
+* migrate lexicon provider yandex to acme.sh DNS API (#2920)
+* migrate lexicon provider zeit to acme.sh DNS API (#2920)
+* migrate lexicon provider zilore to acme.sh DNS API (#2920)
+* migrate lexicon provider zonomi to acme.sh DNS API (#2920)
 
 Fixed:
 * fix sporadic command failure with gcloud DNS API (#3745)
 * fix errors when the same Common Name is used multiple times (#3127)
 * fix crash on invalid automations (#3752)
 
+Deprecated:
+* deprecate support for lexicon DNS APIs (no removal date yet)
+
 3.20
 
 Added:
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 4fd1fd5d4..98fdc7e56 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -788,12 +788,7 @@
         <help>Specify the location of the generated TSIG Key inside the TSIG file using grep and cut, example: grep \# /etc/knot/acme.key | cut -d' ' -f2</help>
     </field>
     <field>
-        <label>lexicon</label>
-        <type>header</type>
-        <style>table_dns table_dns_lexicon</style>
-    </field>
-    <field>
-        <label>NOTE: A DNS sleep time of at least 1000 may be required.</label>
+        <label>lexicon (DEPRECATED)</label>
         <type>header</type>
         <style>table_dns table_dns_lexicon</style>
     </field>
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index bc0a32b0a..a583d068b 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/AcmeClient</mount>
-    <version>4.0.0</version>
+    <version>4.1.0</version>
     <description>A secure ACME Client plugin</description>
     <items>
         <settings>
@@ -481,7 +481,7 @@
                         <dns_kinghost>KingHost</dns_kinghost>
                         <dns_knot>Knot (knsupdate)</dns_knot>
                         <dns_leaseweb>LeaseWeb</dns_leaseweb>
-                        <dns_lexicon>lexicon</dns_lexicon>
+                        <dns_lexicon>lexicon (DEPRECATED)</dns_lexicon>
                         <dns_linode>Linode (v3 / Deprecated)</dns_linode>
                         <dns_linode_v4>Linode (v4)</dns_linode_v4>
                         <dns_loopia>Loopia</dns_loopia>
@@ -787,67 +787,67 @@
                     <Required>N</Required>
                     <default>cloudflare</default>
                     <OptionValues>
-                        <aliyun>Aliyun.com</aliyun>
-                        <aurora>AuroraDNS</aurora>
+                        <aliyun>Aliyun.com (UNSUPPORTED)</aliyun>
+                        <aurora>AuroraDNS (UNSUPPORTED)</aurora>
                         <auto>Auto API</auto>
-                        <azure>Azure</azure>
-                        <cloudflare>CloudFlare</cloudflare>
-                        <cloudns>ClouDNS</cloudns>
-                        <cloudxns>CloudXNS</cloudxns>
-                        <conoha>ConoHa</conoha>
-                        <constellix>Constellix</constellix>
-                        <digitalocean>DigitalOcean</digitalocean>
-                        <dinahosting>Dinahosting</dinahosting>
-                        <directadmin>DirectAdmin</directadmin>
-                        <dnsimple>DNSimple</dnsimple>
-                        <dnsmadeeasy>DnsMadeEasy</dnsmadeeasy>
+                        <azure>Azure (UNSUPPORTED)</azure>
+                        <cloudflare>CloudFlare (UNSUPPORTED)</cloudflare>
+                        <cloudns>ClouDNS (UNSUPPORTED)</cloudns>
+                        <cloudxns>CloudXNS (UNSUPPORTED)</cloudxns>
+                        <conoha>ConoHa (UNSUPPORTED)</conoha>
+                        <constellix>Constellix (UNSUPPORTED)</constellix>
+                        <digitalocean>DigitalOcean (UNSUPPORTED)</digitalocean>
+                        <dinahosting>Dinahosting (UNSUPPORTED)</dinahosting>
+                        <directadmin>DirectAdmin (UNSUPPORTED)</directadmin>
+                        <dnsimple>DNSimple (UNSUPPORTED)</dnsimple>
+                        <dnsmadeeasy>DnsMadeEasy (UNSUPPORTED)</dnsmadeeasy>
                         <dnspark>DNSPark</dnspark>
-                        <dnspod>DNSPod</dnspod>
-                        <dreamhost>Dreamhost</dreamhost>
-                        <easydns>EasyDNS</easydns>
+                        <dnspod>DNSPod (UNSUPPORTED)</dnspod>
+                        <dreamhost>Dreamhost (UNSUPPORTED)</dreamhost>
+                        <easydns>EasyDNS (UNSUPPORTED)</easydns>
                         <easyname>Easyname</easyname>
-                        <exoscale>ExoScale</exoscale>
-                        <gandi>Gandi</gandi>
+                        <exoscale>ExoScale (UNSUPPORTED)</exoscale>
+                        <gandi>Gandi (UNSUPPORTED)</gandi>
                         <gehirn>Gehirn</gehirn>
                         <glesys>Glesys</glesys>
-                        <godaddy>GoDaddy</godaddy>
-                        <googleclouddns>Google Cloud</googleclouddns>
-                        <gratisdns>GratisDNS</gratisdns>
-                        <henet>Hurricane Electric</henet>
-                        <hetzner>Hetzner</hetzner>
+                        <godaddy>GoDaddy (UNSUPPORTED)</godaddy>
+                        <googleclouddns>Google Cloud (UNSUPPORTED)</googleclouddns>
+                        <gratisdns>GratisDNS (UNSUPPORTED)</gratisdns>
+                        <henet>Hurricane Electric (UNSUPPORTED)</henet>
+                        <hetzner>Hetzner (UNSUPPORTED)</hetzner>
                         <hover>Hover</hover>
-                        <infoblox>Infoblox</infoblox>
-                        <internetbs>Internet.bs</internetbs>
-                        <inwx>INWX</inwx>
-                        <linode>Linode (v3 / Deprecated)</linode>
-                        <linode4>Linode (v4)</linode4>
+                        <infoblox>Infoblox (UNSUPPORTED)</infoblox>
+                        <internetbs>Internet.bs (UNSUPPORTED)</internetbs>
+                        <inwx>INWX (UNSUPPORTED)</inwx>
+                        <linode>Linode v3 (UNSUPPORTED)</linode>
+                        <linode4>Linode v4 (UNSUPPORTED)</linode4>
                         <localzone>Localzone</localzone>
-                        <luadns>LuaDNS</luadns>
+                        <luadns>LuaDNS (UNSUPPORTED)</luadns>
                         <memset>Memset</memset>
-                        <namecheap>Namecheap</namecheap>
-                        <namesilo>Namesilo</namesilo>
-                        <netcup>Netcup</netcup>
-                        <nfsn>NFSN</nfsn>
-                        <nsone>NS1</nsone>
+                        <namecheap>Namecheap (UNSUPPORTED)</namecheap>
+                        <namesilo>Namesilo (UNSUPPORTED)</namesilo>
+                        <netcup>Netcup (UNSUPPORTED)</netcup>
+                        <nfsn>NFSN (UNSUPPORTED)</nfsn>
+                        <nsone>NS1 (UNSUPPORTED)</nsone>
                         <onapp>OnApp</onapp>
-                        <online>Online</online>
-                        <ovh>OVH</ovh>
-                        <plesk>Plesk</plesk>
-                        <pointhq>PointHQ</pointhq>
-                        <powerdns>PowerDNS</powerdns>
-                        <rackspace>Rackspace</rackspace>
-                        <rage4>Rage4</rage4>
-                        <route53>Route 53</route53>
+                        <online>Online (UNSUPPORTED)</online>
+                        <ovh>OVH (UNSUPPORTED)</ovh>
+                        <plesk>Plesk (UNSUPPORTED)</plesk>
+                        <pointhq>PointHQ (UNSUPPORTED)</pointhq>
+                        <powerdns>PowerDNS (UNSUPPORTED)</powerdns>
+                        <rackspace>Rackspace (UNSUPPORTED)</rackspace>
+                        <rage4>Rage4 (UNSUPPORTED)</rage4>
+                        <route53>Route 53 (UNSUPPORTED)</route53>
                         <safedns>SafeDNS</safedns>
                         <sakuracloud>SakuraCloud</sakuracloud>
                         <softlayer>Softlayer</softlayer>
                         <subreg>Subreg</subreg>
-                        <transip>Transip</transip>
-                        <vultr>Vultr</vultr>
-                        <yandex>Yandex</yandex>
-                        <zeit>Zeit</zeit>
-                        <zilore>Zilore</zilore>
-                        <zonomi>Zonomi</zonomi>
+                        <transip>Transip (UNSUPPORTED)</transip>
+                        <vultr>Vultr (UNSUPPORTED)</vultr>
+                        <yandex>Yandex (UNSUPPORTED)</yandex>
+                        <zeit>Zeit (UNSUPPORTED)</zeit>
+                        <zilore>Zilore (UNSUPPORTED)</zilore>
+                        <zonomi>Zonomi (UNSUPPORTED)</zonomi>
                     </OptionValues>
                 </dns_lexicon_provider>
                 <dns_lexicon_user type="TextField">
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php
new file mode 100644
index 000000000..a28ae71f4
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/Migrations/M4_1_0.php
@@ -0,0 +1,266 @@
+<?php
+
+/**
+ *    Copyright (C) 2024 Frank Wall
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\AcmeClient\Migrations;
+
+use OPNsense\Base\BaseModelMigration;
+
+class M4_1_0 extends BaseModelMigration
+{
+    public function run($model)
+    {
+        // Migrate validations from "lexicon" to native acme.sh DNS API
+        foreach ($model->getNodeByReference('validations.validation')->iterateItems() as $validation) {
+            $dns_service = (string)$validation->dns_service;
+            $dns_lexicon_provider = (string)$validation->dns_lexicon_provider;
+
+            if (!empty($dns_lexicon_provider) && ($dns_service === 'dns_lexicon')) {
+                // Migrate old lexicon values to DNS API values.
+                switch ($dns_lexicon_provider) {
+                    case 'aliyun':
+                        $validation->dns_service = 'dns_ali';
+                        $validation->dns_ali_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_ali_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'aurora':
+                        $validation->dns_service = 'dns_aurora';
+                        $validation->dns_aurora_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_aurora_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'cloudflare':
+                        $validation->dns_service = 'dns_cf';
+                        $validation->dns_cf_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_cf_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'cloudns':
+                        $validation->dns_service = 'dns_cloudns';
+                        $validation->dns_cloudns_auth_id = (string)$validation->dns_lexicon_user;
+                        $validation->dns_cloudns_auth_password = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'cloudxns':
+                        $validation->dns_service = 'dns_cx';
+                        $validation->dns_cx_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_cx_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'conoha':
+                        $validation->dns_service = 'dns_conoha';
+                        $validation->dns_conoha_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_conoha_password = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'constellix':
+                        $validation->dns_service = 'dns_constellix';
+                        $validation->dns_constellix_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_constellix_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'digitalocean':
+                        $validation->dns_service = 'dns_dgon';
+                        $validation->dns_dgon_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'directadmin':
+                        $validation->dns_service = 'dns_da';
+                        $validation->dns_da_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'dnsimple':
+                        $validation->dns_service = 'dns_dnsimple';
+                        $validation->dns_dnsimple_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'dnsmadeeasy':
+                        $validation->dns_service = 'dns_me';
+                        $validation->dns_me_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_me_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'dnspod':
+                        $validation->dns_service = 'dns_dp';
+                        $validation->dns_dp_id = (string)$validation->dns_lexicon_user;
+                        $validation->dns_dp_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'dreamhost':
+                        $validation->dns_service = 'dns_dreamhost';
+                        // FIXME: parameter prefix should match $dns_service
+                        $validation->dns_dh_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'easydns':
+                        $validation->dns_service = 'dns_easydns';
+                        $validation->dns_easydns_apikey = (string)$validation->dns_lexicon_user;
+                        $validation->dns_easydns_apitoken = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'exoscale':
+                        $validation->dns_service = 'dns_exoscale';
+                        $validation->dns_exoscale_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_exoscale_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'gandi':
+                        $validation->dns_service = 'dns_gandi_livedns';
+                        $validation->dns_gandi_livedns_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_gandi_livedns_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'godaddy':
+                        $validation->dns_service = 'dns_gd';
+                        $validation->dns_gd_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_gd_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'googleclouddns':
+                        $validation->dns_service = 'dns_gcloud';
+                        $validation->dns_gcloud_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'gratisdns':
+                        $validation->dns_service = 'dns_gdnsdk';
+                        $validation->dns_gdnsdk_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_gdnsdk_password = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'henet':
+                        $validation->dns_service = 'dns_he';
+                        $validation->dns_he_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_he_password = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'hetzner':
+                        $validation->dns_service = 'dns_hetzner';
+                        $validation->dns_hetzner_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'infoblox':
+                        $validation->dns_service = 'dns_infoblox';
+                        $validation->dns_infoblox_credentials = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'internetbs':
+                        $validation->dns_service = 'dns_internetbs';
+                        $validation->dns_internetbs_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_internetbs_password = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'inwx':
+                        $validation->dns_service = 'dns_inwx';
+                        $validation->dns_inwx_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_inwx_password = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'linode':
+                        $validation->dns_service = 'dns_linode';
+                        $validation->dns_linode_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'linode4':
+                        $validation->dns_service = 'dns_linode_v4';
+                        $validation->dns_linode_v4_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'luadns':
+                        $validation->dns_service = 'dns_lua';
+                        $validation->dns_lua_email = (string)$validation->dns_lexicon_user;
+                        $validation->dns_lua_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'namecheap':
+                        $validation->dns_service = 'dns_namecheap';
+                        $validation->dns_namecheap_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_namecheap_api = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'namesilo':
+                        $validation->dns_service = 'dns_namesilo';
+                        $validation->dns_namesilo_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'netcup':
+                        $validation->dns_service = 'dns_netcup';
+                        $validation->dns_netcup_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_netcup_pw = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'nfsn':
+                        $validation->dns_service = 'dns_njalla';
+                        $validation->dns_njalla_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'nsone':
+                        $validation->dns_service = 'dns_nsone';
+                        $validation->dns_nsone_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'online':
+                        $validation->dns_service = 'dns_online';
+                        $validation->dns_online_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'ovh':
+                        $validation->dns_service = 'dns_ovh';
+                        $validation->dns_ovh_app_key = (string)$validation->dns_lexicon_user;
+                        $validation->dns_ovh_app_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'plesk':
+                        $validation->dns_service = 'dns_pleskxml';
+                        $validation->dns_pleskxml_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_pleskxml_pass = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'pointhq':
+                        $validation->dns_service = 'dns_pointhq';
+                        $validation->dns_pointhq_email = (string)$validation->dns_lexicon_user;
+                        $validation->dns_pointhq_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'powerdns':
+                        $validation->dns_service = 'dns_pdns';
+                        $validation->dns_pdns_serverid = (string)$validation->dns_lexicon_user;
+                        $validation->dns_pdns_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'rackspace':
+                        $validation->dns_service = 'dns_rackspace';
+                        $validation->dns_rackspace_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_rackspace_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'rage4':
+                        $validation->dns_service = 'dns_rage4';
+                        $validation->dns_rage4_user = (string)$validation->dns_lexicon_user;
+                        $validation->dns_rage4_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'route53':
+                        $validation->dns_service = 'dns_aws';
+                        $validation->dns_aws_id = (string)$validation->dns_lexicon_user;
+                        $validation->dns_aws_secret = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'transip':
+                        $validation->dns_service = 'dns_transip';
+                        $validation->dns_transip_username = (string)$validation->dns_lexicon_user;
+                        $validation->dns_transip_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'vultr':
+                        $validation->dns_service = 'dns_vultr';
+                        $validation->dns_vultr_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'yandex':
+                        $validation->dns_service = 'dns_yandex';
+                        $validation->dns_yandex_token = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'zeit':
+                        // URL points to zilore, so we'll use this DNS API as a replacement.
+                        $validation->dns_service = 'dns_zilore';
+                        $validation->dns_zilore_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'zilore':
+                        $validation->dns_service = 'dns_zilore';
+                        $validation->dns_zilore_key = (string)$validation->dns_lexicon_token;
+                        break;
+                    case 'zonomi':
+                        $validation->dns_service = 'dns_zonomi';
+                        // FIXME: parameter prefix should match $dns_service
+                        $validation->dns_zm_key = (string)$validation->dns_lexicon_token;
+                        break;
+                }
+            }
+        }
+    }
+}