win-acme — acme.rtegroup.ie

<#
.SYNOPSIS
  win-acme DNS validation script (create + delete) for acme.rtegroup.ie.

.NOTES
  Install: create a file named rtedns-dns.ps1 anywhere on the machine running
  win-acme and paste this in. Step-by-step instructions: https://acme.rtegroup.ie/docs/win-acme

.DESCRIPTION
  Used as a single combined script with win-acme's Script DNS validation
  plugin via --dnsscript, so win-acme only needs one script path instead of
  a create script and a delete script. It relies on win-acme's default
  argument templates ("create {Identifier} {RecordName} {Token}" and
  "delete {Identifier} {RecordName} {Token}") — no --dnscreatescriptarguments
  or --dnsdeletescriptarguments override is needed.

  Reads the API key from the RTEDNS_API_KEY environment variable (set it once
  with `setx RTEDNS_API_KEY "..." /M` from an elevated prompt so the SYSTEM-run
  renewal task can see it, or set it directly on the calling scheduled task)
  rather than passing it on the command line.

  Optionally reads RTEDNS_LE_ACCOUNT_URI (and RTEDNS_LE_ISSUER, default
  letsencrypt.org). Not required for normal issuance — if set, it's recorded
  server-side against this hostname so that once DNS-PERSIST-01 is available
  (https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-persist-00), we already
  know which ACME account(s) have been issuing for it.

.PARAMETER Action
  "create" or "delete", supplied automatically by win-acme as the first
  argument.

.PARAMETER Identifier
  The hostname being validated, e.g. dev.rtegroup.ie. Not used by rtedns, but
  accepted so win-acme's default argument layout works unmodified.

.PARAMETER RecordName
  Full TXT record name win-acme wants created/deleted, e.g. _acme-challenge.dev.rtegroup.ie

.PARAMETER Token
  The TXT record content (the ACME challenge token).
#>
param(
    [Parameter(Mandatory = $true, Position = 0)][string]$Action,
    [Parameter(Mandatory = $true, Position = 1)][string]$Identifier,
    [Parameter(Mandatory = $true, Position = 2)][string]$RecordName,
    [Parameter(Mandatory = $true, Position = 3)][string]$Token
)

$ErrorActionPreference = 'Stop'

if (-not $env:RTEDNS_API_KEY) {
    Write-Error "RTEDNS_API_KEY environment variable is not set."
    exit 1
}
$base = if ($env:RTEDNS_API_BASE) { $env:RTEDNS_API_BASE } else { 'https://acme.rtegroup.ie' }

$payload = @{ hostname = $RecordName; value = $Token }
if ($env:RTEDNS_LE_ACCOUNT_URI) {
    $payload.leAccountUri = $env:RTEDNS_LE_ACCOUNT_URI
    $payload.leIssuer = if ($env:RTEDNS_LE_ISSUER) { $env:RTEDNS_LE_ISSUER } else { 'letsencrypt.org' }
}
$body = $payload | ConvertTo-Json

switch ($Action.ToLowerInvariant()) {
    'create' {
        Invoke-RestMethod -Uri "$base/api/dns/present" -Method Post `
            -Headers @{ Authorization = "Bearer $($env:RTEDNS_API_KEY)" } `
            -ContentType 'application/json' -Body $body -UseBasicParsing | Out-Null
        Write-Host "rtedns: created $RecordName"
    }
    'delete' {
        Invoke-RestMethod -Uri "$base/api/dns/cleanup" -Method Post `
            -Headers @{ Authorization = "Bearer $($env:RTEDNS_API_KEY)" } `
            -ContentType 'application/json' -Body $body -UseBasicParsing | Out-Null
        Write-Host "rtedns: cleaned up $RecordName"
    }
    default {
        Write-Error "Unknown action '$Action' (expected create or delete)."
        exit 1
    }
}

setx RTEDNS_API_KEY "rtdns_your_team_key_here" /M

wacs.exe --target manual --host dev.rtegroup.ie ^
  --validationmode dns-01 --validation script ^
  --dnsscript "C:\win-acme\rtedns\rtedns-dns.ps1"