feat(provider): new acme dns-01 provider: aws lightsail

go.mod

@@ -36,6 +36,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/acm v1.38.0
 	github.com/aws/aws-sdk-go-v2/service/cloudfront v1.61.0
 	github.com/aws/aws-sdk-go-v2/service/iam v1.53.7
+	github.com/aws/aws-sdk-go-v2/service/lightsail v1.53.0
 	github.com/baidubce/bce-sdk-go v0.9.264
 	github.com/byteplus-sdk/byteplus-sdk-golang v1.0.63
 	github.com/go-acme/lego/v4 v4.34.0

go.sum

@@ -223,6 +223,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhL
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.53.0 h1:4A3tpD+CkJ77Yx9GEupVwMqmgscej35KjNtmnWWBewQ=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.53.0/go.mod h1:4nljpzVOSvMWeN9E7gMMa9aGWZVY0IVkhJ2DygRkV8c=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.62.5 h1:Z+/OLsb85Kpq7TVLCspskqePaf68Tdv6GfmJP4kH6i0=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.62.5/go.mod h1:TmxGowuBYwjmHFOsEDxaZdsQE62JJzOmtiWafTi/czg=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 h1:QKZH0S178gCmFEgst8hN0mCX1KxLgHBKKY/CLqwP8lg=

internal/certacme/certifiers/sp_aws_lightsail.go

@@ -0,0 +1,29 @@
+package certifiers
+
+import (
+	"fmt"
+
+	"github.com/go-acme/lego/v4/challenge"
+
+	"github.com/certimate-go/certimate/internal/domain"
+	awslightsail "github.com/certimate-go/certimate/pkg/core/certifier/challengers/dns01/aws-lightsail"
+	xmaps "github.com/certimate-go/certimate/pkg/utils/maps"
+)
+
+func init() {
+	ACMEDns01Registries.MustRegister(domain.ACMEDns01ProviderTypeAWSLightsail, func(options *ProviderFactoryOptions) (challenge.Provider, error) {
+		credentials := domain.AccessConfigForAWS{}
+		if err := xmaps.Populate(options.ProviderAccessConfig, &credentials); err != nil {
+			return nil, fmt.Errorf("failed to populate provider access config: %w", err)
+		}
+
+		provider, err := awslightsail.NewChallenger(&awslightsail.ChallengerConfig{
+			AccessKeyId:           credentials.AccessKeyId,
+			SecretAccessKey:       credentials.SecretAccessKey,
+			Region:                xmaps.GetString(options.ProviderExtendedConfig, "region"),
+			DnsPropagationTimeout: options.DnsPropagationTimeout,
+			DnsTTL:                options.DnsTTL,
+		})
+		return provider, err
+	})
+}

internal/domain/provider.go

@@ -170,6 +170,7 @@ const (
 	ACMEDns01ProviderTypeAliyunESA         = ACMEDns01ProviderType(AccessProviderTypeAliyun + "-esa")
 	ACMEDns01ProviderTypeArvanCloud        = ACMEDns01ProviderType(AccessProviderTypeArvanCloud)
 	ACMEDns01ProviderTypeAWS               = ACMEDns01ProviderType(AccessProviderTypeAWS) // 兼容旧值，等同于 [ACMEDns01ProviderTypeAWSRoute53]
+	ACMEDns01ProviderTypeAWSLightsail      = ACMEDns01ProviderType(AccessProviderTypeAWS + "-lightsail")
 	ACMEDns01ProviderTypeAWSRoute53        = ACMEDns01ProviderType(AccessProviderTypeAWS + "-route53")
 	ACMEDns01ProviderTypeAzure             = ACMEDns01ProviderType(AccessProviderTypeAzure) // 兼容旧值，等同于 [ACMEDns01ProviderTypeAzure]
 	ACMEDns01ProviderTypeAzureDNS          = ACMEDns01ProviderType(AccessProviderTypeAzure + "-dns")

pkg/core/certifier/challengers/dns01/aws-lightsail/aws_lightsail.go

@@ -0,0 +1,42 @@
+package awslightsail
+
+import (
+	"errors"
+	"time"
+
+	internal "github.com/go-acme/lego/v4/providers/dns/route53"
+
+	"github.com/certimate-go/certimate/pkg/core/certifier"
+)
+
+type ChallengerConfig struct {
+	AccessKeyId           string `json:"accessKeyId"`
+	SecretAccessKey       string `json:"secretAccessKey"`
+	Region                string `json:"region"`
+	DnsPropagationTimeout int    `json:"dnsPropagationTimeout,omitempty"`
+	DnsTTL                int    `json:"dnsTTL,omitempty"`
+}
+
+func NewChallenger(config *ChallengerConfig) (certifier.ACMEChallenger, error) {
+	if config == nil {
+		return nil, errors.New("the configuration of the acme challenge provider is nil")
+	}
+
+	providerConfig := internal.NewDefaultConfig()
+	providerConfig.AccessKeyID = config.AccessKeyId
+	providerConfig.SecretAccessKey = config.SecretAccessKey
+	providerConfig.Region = config.Region
+	if config.DnsPropagationTimeout != 0 {
+		providerConfig.PropagationTimeout = time.Duration(config.DnsPropagationTimeout) * time.Second
+	}
+	if config.DnsTTL != 0 {
+		providerConfig.TTL = config.DnsTTL
+	}
+
+	provider, err := internal.NewDNSProviderConfig(providerConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider, nil
+}

pkg/core/certifier/challengers/dns01/aws-lightsail/internal/lego.go

@@ -0,0 +1,150 @@
+package internal
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand/v2"
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/lightsail"
+	awstypes "github.com/aws/aws-sdk-go-v2/service/lightsail/types"
+	"github.com/go-acme/lego/v4/challenge"
+	"github.com/go-acme/lego/v4/challenge/dns01"
+	"github.com/go-acme/lego/v4/platform/config/env"
+)
+
+const (
+	envNamespace = "LIGHTSAIL_"
+
+	EnvRegion = envNamespace + "REGION"
+
+	EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
+	EnvPollingInterval    = envNamespace + "POLLING_INTERVAL"
+)
+
+const maxRetries = 5
+
+var _ challenge.ProviderTimeout = (*DNSProvider)(nil)
+
+type Config struct {
+	AccessKeyID     string
+	SecretAccessKey string
+	SessionToken    string
+	Region          string
+
+	PropagationTimeout time.Duration
+	PollingInterval    time.Duration
+}
+
+func NewDefaultConfig() *Config {
+	return &Config{
+		PropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, dns01.DefaultPropagationTimeout),
+		PollingInterval:    env.GetOrDefaultSecond(EnvPollingInterval, dns01.DefaultPollingInterval),
+	}
+}
+
+type DNSProvider struct {
+	client *lightsail.Client
+	config *Config
+}
+
+func NewDNSProvider() (*DNSProvider, error) {
+	config := NewDefaultConfig()
+	config.Region = env.GetOrDefaultString(EnvRegion, "us-east-1")
+
+	return NewDNSProviderConfig(config)
+}
+
+func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
+	if config == nil {
+		return nil, errors.New("lightsail: the configuration of the DNS provider is nil")
+	}
+
+	ctx := context.Background()
+	cfg, err := awsconfig.LoadDefaultConfig(ctx,
+		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(config.AccessKeyID, config.SecretAccessKey, config.SessionToken)),
+		awsconfig.WithRegion(config.Region),
+		awsconfig.WithRetryer(func() aws.Retryer {
+			return retry.NewStandard(func(options *retry.StandardOptions) {
+				options.MaxAttempts = maxRetries
+				options.Backoff = retry.BackoffDelayerFunc(func(attempt int, err error) (time.Duration, error) {
+					retryCount := min(attempt, 7)
+					delay := (1 << uint(retryCount)) * (rand.IntN(50) + 200)
+					return time.Duration(delay) * time.Millisecond, nil
+				})
+			})
+		}),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DNSProvider{
+		config: config,
+		client: lightsail.NewFromConfig(cfg),
+	}, nil
+}
+
+func (d *DNSProvider) Present(domain, _, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+
+	authZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)
+	if err != nil {
+		return fmt.Errorf("lightsail: could not find zone for domain %q: %w", domain, err)
+	}
+
+	subDomain, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)
+	if err != nil {
+		return fmt.Errorf("lightsail: %w", err)
+	}
+
+	if _, err := d.client.CreateDomainEntry(context.Background(), &lightsail.CreateDomainEntryInput{
+		DomainName: aws.String(dns01.UnFqdn(authZone)),
+		DomainEntry: &awstypes.DomainEntry{
+			Type:   aws.String("TXT"),
+			Name:   aws.String(subDomain),
+			Target: aws.String(strconv.Quote(info.Value)),
+		},
+	}); err != nil {
+		return fmt.Errorf("lightsail: %w", err)
+	}
+
+	return nil
+}
+
+func (d *DNSProvider) CleanUp(domain, _, keyAuth string) error {
+	info := dns01.GetChallengeInfo(domain, keyAuth)
+
+	authZone, err := dns01.FindZoneByFqdn(info.EffectiveFQDN)
+	if err != nil {
+		return fmt.Errorf("lightsail: could not find zone for domain %q: %w", domain, err)
+	}
+
+	subDomain, err := dns01.ExtractSubDomain(info.EffectiveFQDN, authZone)
+	if err != nil {
+		return fmt.Errorf("lightsail: %w", err)
+	}
+
+	if _, err := d.client.DeleteDomainEntry(context.Background(), &lightsail.DeleteDomainEntryInput{
+		DomainName: aws.String(dns01.UnFqdn(authZone)),
+		DomainEntry: &awstypes.DomainEntry{
+			Type:   aws.String("TXT"),
+			Name:   aws.String(subDomain),
+			Target: aws.String(strconv.Quote(info.Value)),
+		},
+	}); err != nil {
+		return fmt.Errorf("lightsail: %w", err)
+	}
+
+	return nil
+}
+
+func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
+	return d.config.PropagationTimeout, d.config.PollingInterval
+}

ui/src/components/workflow/designer/forms/BizApplyNodeConfigFieldsProvider.tsx

@@ -3,6 +3,7 @@ import { useEffect, useState } from "react";
 import { type ACMEDns01ProviderType, type ACMEHttp01ProviderType, ACME_DNS01_PROVIDERS, ACME_HTTP01_PROVIDERS } from "@/domain/provider";
 
 import BizApplyNodeConfigFieldsProviderAliyunESA from "./BizApplyNodeConfigFieldsProviderAliyunESA";
+import BizApplyNodeConfigFieldsProviderAWSLightsail from "./BizApplyNodeConfigFieldsProviderAWSLightsail";
 import BizApplyNodeConfigFieldsProviderAWSRoute53 from "./BizApplyNodeConfigFieldsProviderAWSRoute53";
 import BizApplyNodeConfigFieldsProviderFTP from "./BizApplyNodeConfigFieldsProviderFTP";
 import BizApplyNodeConfigFieldsProviderHuaweiCloudDNS from "./BizApplyNodeConfigFieldsProviderHuaweiCloudDNS";
@@ -18,6 +19,7 @@ const acmeDns01ProviderComponentMap: Partial<Record<ACMEDns01ProviderType, React
     */
   [ACME_DNS01_PROVIDERS.ALIYUN_ESA]: BizApplyNodeConfigFieldsProviderAliyunESA,
   [ACME_DNS01_PROVIDERS.AWS]: BizApplyNodeConfigFieldsProviderAWSRoute53,
+  [ACME_DNS01_PROVIDERS.AWS_LIGHTSAIL]: BizApplyNodeConfigFieldsProviderAWSLightsail,
   [ACME_DNS01_PROVIDERS.AWS_ROUTE53]: BizApplyNodeConfigFieldsProviderAWSRoute53,
   [ACME_DNS01_PROVIDERS.HUAWEICLOUD]: BizApplyNodeConfigFieldsProviderHuaweiCloudDNS,
   [ACME_DNS01_PROVIDERS.HUAWEICLOUD_DNS]: BizApplyNodeConfigFieldsProviderHuaweiCloudDNS,

ui/src/components/workflow/designer/forms/BizApplyNodeConfigFieldsProviderAWSLightsail.tsx

@@ -0,0 +1,52 @@
+import { getI18n, useTranslation } from "react-i18next";
+import { Form, Input } from "antd";
+import { createSchemaFieldRule } from "antd-zod";
+import { z } from "zod";
+
+import { useFormNestedFieldsContext } from "./_context";
+
+const BizApplyNodeConfigFieldsProviderAWSLightsail = () => {
+  const { i18n, t } = useTranslation();
+
+  const { parentNamePath } = useFormNestedFieldsContext();
+  const formSchema = z.object({
+    [parentNamePath]: getSchema({ i18n }),
+  });
+  const formRule = createSchemaFieldRule(formSchema);
+  const initialValues = getInitialValues();
+
+  return (
+    <>
+      <Form.Item
+        name={[parentNamePath, "region"]}
+        initialValue={initialValues.region}
+        label={t("workflow_node.apply.form.aws_lightsail_region.label")}
+        rules={[formRule]}
+        tooltip={<span dangerouslySetInnerHTML={{ __html: t("workflow_node.apply.form.aws_lightsail_region.tooltip") }}></span>}
+      >
+        <Input placeholder={t("workflow_node.apply.form.aws_lightsail_region.placeholder")} />
+      </Form.Item>
+    </>
+  );
+};
+
+const getInitialValues = (): Nullish<z.infer<ReturnType<typeof getSchema>>> => {
+  return {
+    region: "us-east-1",
+  };
+};
+
+const getSchema = ({ i18n = getI18n() }: { i18n?: ReturnType<typeof getI18n> }) => {
+  const { t } = i18n;
+
+  return z.object({
+    region: z.string().nonempty(t("workflow_node.apply.form.aws_lightsail_region.placeholder")),
+  });
+};
+
+const _default = Object.assign(BizApplyNodeConfigFieldsProviderAWSLightsail, {
+  getInitialValues,
+  getSchema,
+});
+
+export default _default;

ui/src/domain/provider.ts

@@ -359,6 +359,7 @@ export const ACME_DNS01_PROVIDERS = Object.freeze({
   ALIYUN_ESA: `${ACCESS_PROVIDERS.ALIYUN}-esa`,
   ARVANCLOUD: `${ACCESS_PROVIDERS.ARVANCLOUD}`,
   AWS: `${ACCESS_PROVIDERS.AWS}`, // 兼容旧值，等同于 `AWS_ROUTE53`
+  AWS_LIGHTSAIL: `${ACCESS_PROVIDERS.AWS}-lightsail`,
   AWS_ROUTE53: `${ACCESS_PROVIDERS.AWS}-route53`,
   AZURE: `${ACCESS_PROVIDERS.AZURE}`, // 兼容旧值，等同于 `AZURE_DNS`
   AZURE_DNS: `${ACCESS_PROVIDERS.AZURE}-dns`,
@@ -445,6 +446,7 @@ export const acmeDns01ProvidersMap: Map<ACMEDns01Provider["type"] | string, ACME
       [ACME_DNS01_PROVIDERS.VOLCENGINE_DNS, "provider.volcengine_dns"],
       [ACME_DNS01_PROVIDERS.JDCLOUD_DNS, "provider.jdcloud_dns"],
       [ACME_DNS01_PROVIDERS.AWS_ROUTE53, "provider.aws_route53"],
+      [ACME_DNS01_PROVIDERS.AWS_LIGHTSAIL, "provider.aws_lightsail"],
       [ACME_DNS01_PROVIDERS.AZURE_DNS, "provider.azure_dns"],
       [ACME_DNS01_PROVIDERS.AKAMAI_EDGEDNS, "provider.akamai_edgedns"],
       [ACME_DNS01_PROVIDERS.ARVANCLOUD, "provider.arvancloud"],

ui/src/i18n/locales/en/nls.provider.json

@@ -35,6 +35,7 @@
   "provider.aws_acm": "AWS - ACM (Amazon Certificate Manager)",
   "provider.aws_cloudfront": "AWS - CloudFront",
   "provider.aws_iam": "AWS - IAM (Identity and Access Management)",
+  "provider.aws_lightsail": "AWS - Lightsail",
   "provider.aws_route53": "AWS - Route53",
   "provider.azure": "Azure",
   "provider.azure_dns": "Azure - DNS",

ui/src/i18n/locales/en/nls.workflow.nodes.json

@@ -70,6 +70,9 @@
   "workflow_node.apply.form.aliyun_esa_region.label": "Alibaba Cloud region",
   "workflow_node.apply.form.aliyun_esa_region.placeholder": "Please enter Alibaba Cloud ESA region (e.g. cn-hangzhou)",
   "workflow_node.apply.form.aliyun_esa_region.tooltip": "For more information, see <a href=\"https://www.alibabacloud.com/help/en/edge-security-acceleration/esa/api-esa-2024-09-10-endpoint\" target=\"_blank\">https://www.alibabacloud.com/help/en/edge-security-acceleration/esa/api-esa-2024-09-10-endpoint</a>",
+  "workflow_node.apply.form.aws_lightsail_region.label": "AWS Region",
+  "workflow_node.apply.form.aws_lightsail_region.placeholder": "Please enter AWS Lightsail region (e.g. us-east-1)",
+  "workflow_node.apply.form.aws_lightsail_region.tooltip": "For more information, see <a href=\"https://docs.aws.amazon.com/en_us/general/latest/gr/rande.html#regional-endpoints\" target=\"_blank\">https://docs.aws.amazon.com/en_us/general/latest/gr/rande.html#regional-endpoints</a>",
   "workflow_node.apply.form.aws_route53_region.label": "AWS Region",
   "workflow_node.apply.form.aws_route53_region.placeholder": "Please enter AWS Route53 region (e.g. us-east-1)",
   "workflow_node.apply.form.aws_route53_region.tooltip": "For more information, see <a href=\"https://docs.aws.amazon.com/en_us/general/latest/gr/rande.html#regional-endpoints\" target=\"_blank\">https://docs.aws.amazon.com/en_us/general/latest/gr/rande.html#regional-endpoints</a>",

ui/src/i18n/locales/zh/nls.provider.json

@@ -35,6 +35,7 @@
   "provider.aws_acm": "AWS - ACM (Amazon Certificate Manager)",
   "provider.aws_cloudfront": "AWS - CloudFront",
   "provider.aws_iam": "AWS - IAM (Identity and Access Management)",
+  "provider.aws_lightsail": "AWS - Lightsail",
   "provider.aws_route53": "AWS - Route53",
   "provider.azure": "Azure",
   "provider.azure_dns": "Azure - DNS",

ui/src/i18n/locales/zh/nls.workflow.nodes.json

@@ -70,6 +70,9 @@
   "workflow_node.apply.form.aliyun_esa_region.label": "阿里云服务地域",
   "workflow_node.apply.form.aliyun_esa_region.placeholder": "请输入阿里云 ESA 服务地域（例如：cn-hangzhou）",
   "workflow_node.apply.form.aliyun_esa_region.tooltip": "这是什么？请参阅 <a href=\"https://help.aliyun.com/zh/edge-security-acceleration/esa/api-esa-2024-09-10-endpoint\" target=\"_blank\">https://help.aliyun.com/zh/edge-security-acceleration/esa/api-esa-2024-09-10-endpoint</a>",
+  "workflow_node.apply.form.aws_lightsail_region.label": "AWS 服务区域",
+  "workflow_node.apply.form.aws_lightsail_region.placeholder": "请输入 AWS Lightsail 服务区域（例如：us-east-1）",
+  "workflow_node.apply.form.aws_lightsail_region.tooltip": "这是什么？请参阅 <a href=\"https://docs.aws.amazon.com/zh_cn/general/latest/gr/rande.html#regional-endpoints\" target=\"_blank\">https://docs.aws.amazon.com/zh_cn/general/latest/gr/rande.html#regional-endpoints</a>",
   "workflow_node.apply.form.aws_route53_region.label": "AWS 服务区域",
   "workflow_node.apply.form.aws_route53_region.placeholder": "请输入 AWS Route53 服务区域（例如：us-east-1）",
   "workflow_node.apply.form.aws_route53_region.tooltip": "这是什么？请参阅 <a href=\"https://docs.aws.amazon.com/zh_cn/general/latest/gr/rande.html#regional-endpoints\" target=\"_blank\">https://docs.aws.amazon.com/zh_cn/general/latest/gr/rande.html#regional-endpoints</a>",