From 3c4fe105cda6d222bd17f143b7829ffd73dfcd35 Mon Sep 17 00:00:00 2001
From: Aleksei Zhukov <me@zhukov.al>
Date: Wed, 9 Mar 2022 18:49:53 -0800
Subject: [PATCH 1/9] Proxy protocol support for SMTP and IMAP

---
 docs/reference/endpoints/imap.md          | 19 +++++
 docs/reference/endpoints/smtp.md          | 15 ++++
 go.mod                                    |  1 +
 go.sum                                    |  2 +
 internal/endpoint/imap/imap.go            | 15 +++-
 internal/endpoint/smtp/smtp.go            | 23 ++++--
 internal/proxy_protocol/proxy_protocol.go | 86 ++++++++++++++++++++++
 tests/smtp_test.go                        | 89 +++++++++++++++++++++++
 8 files changed, 238 insertions(+), 12 deletions(-)
 create mode 100644 internal/proxy_protocol/proxy_protocol.go

diff --git a/docs/reference/endpoints/imap.md b/docs/reference/endpoints/imap.md
index 06247c3..943291a 100644
--- a/docs/reference/endpoints/imap.md
+++ b/docs/reference/endpoints/imap.md
@@ -40,6 +40,25 @@ tls cert.crt key.key {
 
 See [TLS configuration / Server](/reference/tls/#server-side) for details.
 
+**Syntax**: proxy_protocol _trusted ips..._ { ... } <br>
+**Default**: not enabled
+
+Enable use of HAProxy PROXY protocol. Supports both v1 and v2 protocols.
+If a list of trusted IP addresses or subnets is provided, only connections
+from those will be trusted.
+
+TLS for the channel between the proxies and maddy can be configured
+using a 'tls' directive:
+```
+proxy_protocol {
+    trust 127.0.0.1 ::1 192.168.0.1/24
+    tls &proxy_tls
+}
+```
+Note that the top-level 'tls' directive is not inherited here. If you
+need TLS on top of the PROXY protocol, securing the protocol header,
+you must declare TLS explicitly.
+
 **Syntax**: io\_debug _boolean_ <br>
 **Default**: no
 
diff --git a/docs/reference/endpoints/smtp.md b/docs/reference/endpoints/smtp.md
index cd99df9..8849d25 100644
--- a/docs/reference/endpoints/smtp.md
+++ b/docs/reference/endpoints/smtp.md
@@ -58,6 +58,21 @@ tls cert.crt key.key {
 
 See [TLS configuration / Server](/reference/tls/#server-side) for details.
 
+**Syntax**: proxy_protocol _trusted ips..._ { ... } <br>
+**Default**: not enabled
+
+Enable use of HAProxy PROXY protocol. Supports both v1 and v2 protocols.
+If a list of trusted IP addresses or subnets is provided, only connections
+from those will be trusted.
+
+TLS for the channel between the proxies and maddy can be configured
+using a 'tls' directive:
+```
+proxy_protocol {
+    trust 127.0.0.1 ::1 192.168.0.1/24
+    tls &proxy_tls
+}
+```
 
 **Syntax**: io\_debug _boolean_ <br>
 **Default**: no
diff --git a/go.mod b/go.mod
index 2b3f9a1..1aaad67 100644
--- a/go.mod
+++ b/go.mod
@@ -73,6 +73,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.18.3 // indirect
 	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/c0va23/go-proxyprotocol v0.9.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/digitalocean/godo v1.96.0 // indirect
diff --git a/go.sum b/go.sum
index ddf6797..868d84d 100644
--- a/go.sum
+++ b/go.sum
@@ -236,6 +236,8 @@ github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLj
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/c0va23/go-proxyprotocol v0.9.1 h1:5BCkp0fDJOhzzH1lhjUgHhmZz9VvRMMif1U2D31hb34=
+github.com/c0va23/go-proxyprotocol v0.9.1/go.mod h1:TNjUV+llvk8TvWJxlPYAeAYZgSzT/iicNr3nWBWX320=
 github.com/caddyserver/certmagic v0.17.2 h1:o30seC1T/dBqBCNNGNHWwj2i5/I/FMjBbTAhjADP3nE=
 github.com/caddyserver/certmagic v0.17.2/go.mod h1:ouWUuC490GOLJzkyN35eXfV8bSbwMwSf4bdhkIxtdQE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
diff --git a/internal/endpoint/imap/imap.go b/internal/endpoint/imap/imap.go
index c7aac5e..d047e88 100644
--- a/internal/endpoint/imap/imap.go
+++ b/internal/endpoint/imap/imap.go
@@ -44,14 +44,16 @@ import (
 	"github.com/foxcpp/maddy/framework/module"
 	"github.com/foxcpp/maddy/internal/auth"
 	"github.com/foxcpp/maddy/internal/authz"
+	"github.com/foxcpp/maddy/internal/proxy_protocol"
 	"github.com/foxcpp/maddy/internal/updatepipe"
 )
 
 type Endpoint struct {
-	addrs     []string
-	serv      *imapserver.Server
-	listeners []net.Listener
-	Store     module.Storage
+	addrs         []string
+	serv          *imapserver.Server
+	listeners     []net.Listener
+	proxyProtocol *proxy_protocol.ProxyProtocol
+	Store         module.Storage
 
 	tlsConfig   *tls.Config
 	listenersWg sync.WaitGroup
@@ -90,6 +92,7 @@ func (endp *Endpoint) Init(cfg *config.Map) error {
 	})
 	cfg.Custom("storage", false, true, nil, modconfig.StorageDirective, &endp.Store)
 	cfg.Custom("tls", true, true, nil, tls2.TLSDirective, &endp.tlsConfig)
+	cfg.Custom("proxy_protocol", false, false, nil, proxy_protocol.ProxyProtocolDirective, &endp.proxyProtocol)
 	cfg.Bool("insecure_auth", false, false, &insecureAuth)
 	cfg.Bool("io_debug", false, false, &ioDebug)
 	cfg.Bool("io_errors", false, false, &ioErrors)
@@ -167,6 +170,10 @@ func (endp *Endpoint) setupListeners(addresses []config.Endpoint) error {
 			l = tls.NewListener(l, endp.tlsConfig)
 		}
 
+		if endp.proxyProtocol != nil {
+			l = proxy_protocol.NewListener(l, endp.proxyProtocol, endp.Log)
+		}
+
 		endp.listeners = append(endp.listeners, l)
 
 		endp.listenersWg.Add(1)
diff --git a/internal/endpoint/smtp/smtp.go b/internal/endpoint/smtp/smtp.go
index a322b6d..e01ae57 100644
--- a/internal/endpoint/smtp/smtp.go
+++ b/internal/endpoint/smtp/smtp.go
@@ -46,18 +46,20 @@ import (
 	"github.com/foxcpp/maddy/internal/authz"
 	"github.com/foxcpp/maddy/internal/limits"
 	"github.com/foxcpp/maddy/internal/msgpipeline"
+	"github.com/foxcpp/maddy/internal/proxy_protocol"
 	"golang.org/x/net/idna"
 )
 
 type Endpoint struct {
-	saslAuth  auth.SASLAuth
-	serv      *smtp.Server
-	name      string
-	addrs     []string
-	listeners []net.Listener
-	pipeline  *msgpipeline.MsgPipeline
-	resolver  dns.Resolver
-	limits    *limits.Group
+	saslAuth      auth.SASLAuth
+	serv          *smtp.Server
+	name          string
+	addrs         []string
+	listeners     []net.Listener
+	proxyProtocol *proxy_protocol.ProxyProtocol
+	pipeline      *msgpipeline.MsgPipeline
+	resolver      dns.Resolver
+	limits        *limits.Group
 
 	buffer func(r io.Reader) (buffer.Buffer, error)
 
@@ -263,6 +265,7 @@ func (endp *Endpoint) setConfig(cfg *config.Map) error {
 		return autoBufferMode(1*1024*1024 /* 1 MiB */, path), nil
 	}, bufferModeDirective, &endp.buffer)
 	cfg.Custom("tls", true, endp.name != "lmtp", nil, tls2.TLSDirective, &endp.serv.TLSConfig)
+	cfg.Custom("proxy_protocol", false, false, nil, proxy_protocol.ProxyProtocolDirective, &endp.proxyProtocol)
 	cfg.Bool("insecure_auth", endp.name == "lmtp", false, &endp.serv.AllowInsecureAuth)
 	cfg.Int("smtp_max_line_length", false, false, 4000, &endp.serv.MaxLineLength)
 	cfg.Bool("io_debug", false, false, &ioDebug)
@@ -350,6 +353,10 @@ func (endp *Endpoint) setupListeners(addresses []config.Endpoint) error {
 			l = tls.NewListener(l, endp.serv.TLSConfig)
 		}
 
+		if endp.proxyProtocol != nil {
+			l = proxy_protocol.NewListener(l, endp.proxyProtocol, endp.Log)
+		}
+
 		endp.listeners = append(endp.listeners, l)
 
 		endp.listenersWg.Add(1)
diff --git a/internal/proxy_protocol/proxy_protocol.go b/internal/proxy_protocol/proxy_protocol.go
new file mode 100644
index 0000000..1a3a787
--- /dev/null
+++ b/internal/proxy_protocol/proxy_protocol.go
@@ -0,0 +1,86 @@
+package proxy_protocol
+
+import (
+	"crypto/tls"
+	"net"
+	"strings"
+
+	"github.com/c0va23/go-proxyprotocol"
+	"github.com/foxcpp/maddy/framework/config"
+	tls2 "github.com/foxcpp/maddy/framework/config/tls"
+	"github.com/foxcpp/maddy/framework/log"
+)
+
+type ProxyProtocol struct {
+	trust     []net.IPNet
+	tlsConfig *tls.Config
+}
+
+func ProxyProtocolDirective(_ *config.Map, node config.Node) (interface{}, error) {
+	p := ProxyProtocol{}
+
+	childM := config.NewMap(nil, node)
+	var trustList []string
+
+	childM.StringList("trust", false, false, nil, &trustList)
+	childM.Custom("tls", true, false, nil, tls2.TLSDirective, &p.tlsConfig)
+
+	if _, err := childM.Process(); err != nil {
+		return nil, err
+	}
+
+	if len(node.Args) > 0 {
+		if trustList == nil {
+			trustList = make([]string, 0)
+		}
+		trustList = append(trustList, node.Args...)
+	}
+
+	for _, trust := range trustList {
+		if !strings.Contains(trust, "/") {
+			trust += "/32"
+		}
+		_, ipNet, err := net.ParseCIDR(trust)
+		if err != nil {
+			return nil, err
+		}
+		p.trust = append(p.trust, *ipNet)
+	}
+
+	return &p, nil
+}
+
+func NewListener(inner net.Listener, p *ProxyProtocol, logger log.Logger) net.Listener {
+	var listener net.Listener
+
+	sourceChecker := func(upstream net.Addr) (bool, error) {
+		if tcpAddr, ok := upstream.(*net.TCPAddr); ok {
+			if len(p.trust) == 0 {
+				return true, nil
+			}
+			for _, trusted := range p.trust {
+				if trusted.Contains(tcpAddr.IP) {
+					return true, nil
+				}
+			}
+		} else if _, ok := upstream.(*net.UnixAddr); ok {
+			// UNIX local socket connection, always trusted
+			return true, nil
+		}
+
+		logger.Printf("proxy_protocol: connection from untrusted source %s", upstream)
+		return false, nil
+	}
+
+	listener = proxyprotocol.NewDefaultListener(inner).
+		WithLogger(proxyprotocol.LoggerFunc(func(format string, v ...interface{}) {
+			logger.Debugf("proxy_protocol: "+format, v...)
+		})).
+		WithSourceChecker(sourceChecker)
+
+	if p.tlsConfig != nil {
+		listener = tls.NewListener(listener, p.tlsConfig)
+	}
+
+	return listener
+}
diff --git a/tests/smtp_test.go b/tests/smtp_test.go
index 85a5173..7e5eda1 100644
--- a/tests/smtp_test.go
+++ b/tests/smtp_test.go
@@ -23,6 +23,7 @@ package tests_test
 
 import (
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"path/filepath"
 	"strings"
@@ -68,6 +69,94 @@ func TestCheckRequireTLS(tt *testing.T) {
 	conn.ExpectPattern("221 *")
 }
 
+func TestProxyProtocolTrustedSource(tt *testing.T) {
+	tt.Parallel()
+	t := tests.NewT(tt)
+	t.DNS(map[string]mockdns.Zone{
+		"one.maddy.test.": {
+			TXT: []string{"v=spf1 ip4:127.0.0.17 -all"},
+		},
+	})
+	t.Port("smtp")
+	t.Config(`
+		smtp tcp://127.0.0.1:{env:TEST_PORT_smtp} {
+			hostname mx.maddy.test
+			tls off
+
+			proxy_protocol {
+				trust ` + tests.DefaultSourceIP.String() + ` ::1/128
+				tls off
+			}
+
+			defer_sender_reject no
+
+			check {
+				spf {
+					enforce_early yes
+					fail_action reject
+				}
+			}
+
+			deliver_to dummy
+		}
+	`)
+	t.Run(1)
+	defer t.Close()
+
+	conn := t.Conn("smtp")
+	defer conn.Close()
+	conn.Writeln(fmt.Sprintf("PROXY TCP4 127.0.0.17 %s 12345 %d", tests.DefaultSourceIP.String(), t.Port("smtp")))
+	conn.SMTPNegotation("localhost", nil, nil)
+	conn.Writeln("MAIL FROM:<testing@one.maddy.test>")
+	conn.ExpectPattern("250 *")
+	conn.Writeln("QUIT")
+	conn.ExpectPattern("221 *")
+}
+
+func TestProxyProtocolUntrustedSource(tt *testing.T) {
+	tt.Parallel()
+	t := tests.NewT(tt)
+	t.DNS(map[string]mockdns.Zone{
+		"one.maddy.test.": {
+			TXT: []string{"v=spf1 ip4:127.0.0.17 -all"},
+		},
+	})
+	t.Port("smtp")
+	t.Config(`
+		smtp tcp://127.0.0.1:{env:TEST_PORT_smtp} {
+			hostname mx.maddy.test
+			tls off
+
+			proxy_protocol {
+				trust fe80::bad/128
+				tls off
+			}
+
+			defer_sender_reject no
+
+			check {
+				spf {
+					enforce_early yes
+					fail_action reject
+				}
+			}
+
+			deliver_to dummy
+		}
+	`)
+	t.Run(1)
+	defer t.Close()
+
+	conn := t.Conn("smtp")
+	defer conn.Close()
+	conn.Writeln(fmt.Sprintf("PROXY TCP4 127.0.0.17 %s 12345 %d", tests.DefaultSourceIP.String(), t.Port("smtp")))
+	conn.SMTPNegotation("localhost", nil, nil)
+	conn.Writeln("MAIL FROM:<testing@one.maddy.test>")
+	conn.ExpectPattern("550 *")
+	conn.Writeln("QUIT")
+	conn.ExpectPattern("221 *")
+}
+
 func TestCheckSPF(tt *testing.T) {
 	tt.Parallel()
 	t := tests.NewT(tt)

From dbb424f1649f36c8f0121b724ca72a57ea30520d Mon Sep 17 00:00:00 2001
From: Martin Matous <m@matous.dev>
Date: Tue, 22 Aug 2023 17:52:22 +0200
Subject: [PATCH 2/9] fix(milter): remove erroneous path check

A remnant of d0e7df023cadb3d7068e5b09509bc562ad63f10b when milter.NewClient() didn't accept path.

Signed-off-by: Martin Matous <m@matous.dev>
---
 internal/check/milter/milter.go      |  3 --
 internal/check/milter/milter_test.go | 61 ++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 3 deletions(-)
 create mode 100644 internal/check/milter/milter_test.go

diff --git a/internal/check/milter/milter.go b/internal/check/milter/milter.go
index c0f3700..37704d4 100644
--- a/internal/check/milter/milter.go
+++ b/internal/check/milter/milter.go
@@ -90,9 +90,6 @@ func (c *Check) Init(cfg *config.Map) error {
 	default:
 		return fmt.Errorf("%s: scheme unsupported: %v", modName, endp.Scheme)
 	}
-	if endp.Path != "" {
-		return fmt.Errorf("%s: stray path in endpoint: %v", modName, endp)
-	}
 
 	c.cl = milter.NewClientWithOptions(endp.Network(), endp.Address(), milter.ClientOptions{
 		Dialer: &net.Dialer{
diff --git a/internal/check/milter/milter_test.go b/internal/check/milter/milter_test.go
new file mode 100644
index 0000000..d2ec19d
--- /dev/null
+++ b/internal/check/milter/milter_test.go
@@ -0,0 +1,61 @@
+/*
+Maddy Mail Server - Composable all-in-one email server.
+Copyright © 2019-2020 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package milter
+
+import (
+	"testing"
+
+	"github.com/foxcpp/maddy/framework/config"
+)
+
+func TestAcceptValidEndpoints(t *testing.T) {
+	for _, endpoint := range []string{
+		"tcp://0.0.0.0:10025",
+		"tcp://[::]:10025",
+		"tcp:127.0.0.1:10025",
+		"unix://path",
+		"unix:path",
+		"unix:/path",
+		"unix:///path",
+		"unix://also/path",
+		"unix:///also/path",
+	} {
+		c := &Check{milterUrl: endpoint}
+
+		err := c.Init(&config.Map{})
+		if err != nil {
+			t.Errorf("Unexpected failure for %s: %v", endpoint, err)
+			return
+		}
+	}
+}
+
+func TestRejectInvalidEndpoints(t *testing.T) {
+	for _, endpoint := range []string{
+		"tls://0.0.0.0:10025",
+		"tls:0.0.0.0:10025",
+	} {
+		c := &Check{milterUrl: endpoint}
+		err := c.Init(&config.Map{})
+		if err == nil {
+			t.Errorf("Accepted invalid endpoint: %s", endpoint)
+			return
+		}
+	}
+}
\ No newline at end of file

From 4b64657ed16f3fcad229db19a25f24241a31a5cc Mon Sep 17 00:00:00 2001
From: Martin Matous <m@matous.dev>
Date: Tue, 22 Aug 2023 18:00:44 +0200
Subject: [PATCH 3/9] fix(f2b): use correct retry directive

Signed-off-by: Martin Matous <m@matous.dev>
---
 dist/fail2ban/jail.d/maddy-dictonary-attack.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dist/fail2ban/jail.d/maddy-dictonary-attack.conf b/dist/fail2ban/jail.d/maddy-dictonary-attack.conf
index c4f7ff3..ebeb33f 100644
--- a/dist/fail2ban/jail.d/maddy-dictonary-attack.conf
+++ b/dist/fail2ban/jail.d/maddy-dictonary-attack.conf
@@ -2,6 +2,6 @@
 port     = 993,465,25
 filter   = maddy-dictonary-attack
 bantime  = 72h
-maxtries = 3
+maxretry = 3
 findtime = 6h
 backend  = systemd

From 250ee6fd876298e7df24974e887dcf643df07557 Mon Sep 17 00:00:00 2001
From: reind33r <louis@hostux.fr>
Date: Mon, 12 Feb 2024 23:25:25 +0100
Subject: [PATCH 4/9] libdns/rfc2136 added as a provider

---
 docs/reference/tls-acme.md | 11 +++++++++++
 go.mod                     |  3 ++-
 go.sum                     | 30 +++++++++++++++---------------
 internal/libdns/rfc2136.go | 28 ++++++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 16 deletions(-)
 create mode 100644 internal/libdns/rfc2136.go

diff --git a/docs/reference/tls-acme.md b/docs/reference/tls-acme.md
index 9baccb5..1cc7423 100644
--- a/docs/reference/tls-acme.md
+++ b/docs/reference/tls-acme.md
@@ -263,3 +263,14 @@ dns namedotcom {
 }
 ```
 
+- rfc2136 (non-default)
+
+```
+dns rfc2136 {
+    KeyName "..."
+    Key "..."
+    KeyAlg "..."
+    Server "..."
+}
+```
+
diff --git a/go.mod b/go.mod
index 68bf8a7..7b2334a 100644
--- a/go.mod
+++ b/go.mod
@@ -5,6 +5,7 @@ go 1.19
 require (
 	blitiri.com.ar/go/spf v1.5.1
 	github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5
+	github.com/c0va23/go-proxyprotocol v0.9.1
 	github.com/caddyserver/certmagic v0.20.0
 	github.com/emersion/go-imap v1.2.2-0.20220928192137-6fac715be9cf
 	github.com/emersion/go-imap-compress v0.0.0-20201103190257-14809af1d1b9
@@ -39,6 +40,7 @@ require (
 	github.com/libdns/metaname v0.3.0
 	github.com/libdns/namecheap v0.0.0-20211109042440-fc7440785c8e
 	github.com/libdns/namedotcom v0.3.3
+	github.com/libdns/rfc2136 v0.1.0
 	github.com/libdns/route53 v1.3.3
 	github.com/libdns/vultr v1.0.0
 	github.com/mattn/go-sqlite3 v1.14.19
@@ -75,7 +77,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
 	github.com/aws/smithy-go v1.19.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/c0va23/go-proxyprotocol v0.9.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/digitalocean/godo v1.108.0 // indirect
diff --git a/go.sum b/go.sum
index 005925b..672f327 100644
--- a/go.sum
+++ b/go.sum
@@ -237,6 +237,7 @@ github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
 github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/c0va23/go-proxyprotocol v0.9.1 h1:5BCkp0fDJOhzzH1lhjUgHhmZz9VvRMMif1U2D31hb34=
 github.com/c0va23/go-proxyprotocol v0.9.1/go.mod h1:TNjUV+llvk8TvWJxlPYAeAYZgSzT/iicNr3nWBWX320=
 github.com/caddyserver/certmagic v0.17.2 h1:o30seC1T/dBqBCNNGNHWwj2i5/I/FMjBbTAhjADP3nE=
@@ -261,6 +262,8 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -341,6 +344,7 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
 github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
+github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -348,6 +352,7 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
 github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -476,10 +481,12 @@ github.com/johannesboyne/gofakes3 v0.0.0-20210704111953-6a9f95c2941c h1:lx/uPI+m
 github.com/johannesboyne/gofakes3 v0.0.0-20210704111953-6a9f95c2941c/go.mod h1:LIAXxPvcUXwOcTIj9LSNSUpE9/eMHalTWxsP/kmWxQI=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
@@ -489,6 +496,7 @@ github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa02
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
 github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
 github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -521,6 +529,8 @@ github.com/libdns/namecheap v0.0.0-20211109042440-fc7440785c8e h1:WCcKyxiiK/sJnS
 github.com/libdns/namecheap v0.0.0-20211109042440-fc7440785c8e/go.mod h1:dED6sMLZxIcilF1GjrcpwgVoCglXGMn86irqQzRhqRY=
 github.com/libdns/namedotcom v0.3.3 h1:R10C7+IqQGVeC4opHHMiFNBxdNBg1bi65ZwqLESl+jE=
 github.com/libdns/namedotcom v0.3.3/go.mod h1:GbYzsAF2yRUpI0WgIK5fs5UX+kDVUPaYCFLpTnKQm0s=
+github.com/libdns/rfc2136 v0.1.0 h1:BlGOPfx/R3xqKrgHT9TlreA8Ulw8ti8+VtJj8E0H9hE=
+github.com/libdns/rfc2136 v0.1.0/go.mod h1:tgXWavE+5OiAfdKxBnuG8OBEwQFAu7uuiS3+laspAGs=
 github.com/libdns/route53 v1.3.3 h1:16sTxbbRGm0zODz0p0aVHHIyTqtHzEn3j0s4dGzQvNI=
 github.com/libdns/route53 v1.3.3/go.mod h1:n1Xy55lpfdxMIx4CVWAM16GQac+/OZcnm1xBjMyhZAo=
 github.com/libdns/vultr v1.0.0 h1:W8B4+k2bm9ro3bZLSZV9hMOQI+uO6Svu+GmD+Olz7ZI=
@@ -553,6 +563,7 @@ github.com/minio/minio-go/v7 v7.0.66 h1:bnTOXOHjOqv/gcMuiVbN9o2ngRItvqE774dG9nq0
 github.com/minio/minio-go/v7 v7.0.66/go.mod h1:DHAgmyQEGdW3Cif0UooKOyrT3Vxs82zNdV6tkKhRtbs=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -560,10 +571,12 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/netauth/netauth v0.6.2-0.20220831214440-1df568cd25d6 h1:TsF5Cl0Mj5JMvPOP2ySVq+CZoiPrTGwvNPbuQotuSAE=
 github.com/netauth/netauth v0.6.2-0.20220831214440-1df568cd25d6/go.mod h1:4PEbISVqRCQaXaDAt289w3nK9UhoF8/ZOLy31Hbv7ds=
 github.com/netauth/protocol v0.0.0-20210918062754-7fee492ffcbd h1:4yVpQ/+li28lQ/daYCWeDB08obRmjaoAw2qfFFaCQ40=
 github.com/netauth/protocol v0.0.0-20210918062754-7fee492ffcbd/go.mod h1:wpK5wqysOJU1w2OxgG65du8M7UqBkxzsNaJdjwiRqAs=
+github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.1.1 h1:LWAJwfNvjQZCFIDKWYQaM62NcYeYViCmWIwmOStowAI=
 github.com/pelletier/go-toml/v2 v2.1.1/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pierrec/lz4 v2.6.1+incompatible h1:9UY3+iC23yxF0UfGaYrGplQ+79Rg+h/q9FV9ix19jjM=
@@ -572,7 +585,6 @@ github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
 github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -586,7 +598,6 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -597,8 +608,8 @@ github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6ke
 github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
 github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
 github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
-github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63 h1:J6qvD6rbmOil46orKqJaRPG+zTpoGlBTUdyv8ki63L0=
 github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63/go.mod h1:n+VKSARF5y/tS9XFSP7vWDfS+GUC5vs/YT7M5XDTUEM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
@@ -609,6 +620,7 @@ github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
 github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
 github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
 github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
@@ -626,7 +638,6 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
@@ -643,11 +654,9 @@ github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
 github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
-github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -668,7 +677,6 @@ go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xC
 go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
 go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
@@ -1150,8 +1158,6 @@ google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqw
 google.golang.org/genproto v0.0.0-20221014173430-6e2ab493f96b/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221014213838-99cd37c6964a/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221018160656-63c7b68cfc55/go.mod h1:45EK0dUbEZ2NHjCeAd2LXmyjAgGUGrpGROgjhC3ADck=
-google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 h1:nz5NESFLZbJGPFxDT/HCn+V1mZ8JGNoY4nUpmW/Y2eg=
-google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240116215550-a9fa1716bcac h1:nUQEQmH/csSvFECKYRv6HWEyypysidKl2I6Qpsglq/0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240116215550-a9fa1716bcac/go.mod h1:daQN87bsDqDoe316QbbvX60nMoJQa4r6Ds0ZuoAe5yA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1211,7 +1217,6 @@ google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7
 google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
@@ -1219,7 +1224,6 @@ gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3M
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
@@ -1239,8 +1243,6 @@ modernc.org/cc/v3 v3.41.0 h1:QoR1Sn3YWlmA1T4vLaKZfawdVtSiGx8H+cEojbC7v1Q=
 modernc.org/cc/v3 v3.41.0/go.mod h1:Ni4zjJYJ04CDOhG7dn640WGfwBzfE0ecX8TyMB0Fv0Y=
 modernc.org/ccgo/v3 v3.16.15 h1:KbDR3ZAVU+wiLyMESPtbtE/Add4elztFyfsWoNTgxS0=
 modernc.org/ccgo/v3 v3.16.15/go.mod h1:yT7B+/E2m43tmMOT51GMoM98/MtHIcQQSleGnddkUNI=
-modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
-modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
 modernc.org/libc v1.40.6 h1:141JHq3SjhOOCjECBgD4K8VgTFOy19CnHwroC08DAig=
 modernc.org/libc v1.40.6/go.mod h1:YAXkAZ8ktnkCKaN9sw/UDeUVkGYJ/YquGO4FTi5nmHE=
 modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
@@ -1253,10 +1255,8 @@ modernc.org/sqlite v1.28.0 h1:Zx+LyDDmXczNnEQdvPuEfcFVA2ZPyaD7UCZDjef3BHQ=
 modernc.org/sqlite v1.28.0/go.mod h1:Qxpazz0zH8Z1xCFyi5GSL3FzbtZ3fvbjmywNogldEW0=
 modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
 modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
-modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/z v1.7.3 h1:zDJf6iHjrnB+WRD88stbXokugjyc0/pB91ri1gO6LZY=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/internal/libdns/rfc2136.go b/internal/libdns/rfc2136.go
new file mode 100644
index 0000000..aa75562
--- /dev/null
+++ b/internal/libdns/rfc2136.go
@@ -0,0 +1,28 @@
+//go:build libdns_rfc2136 || libdns_all
+// +build libdns_rfc2136 libdns_all
+
+package libdns
+
+import (
+	"github.com/foxcpp/maddy/framework/config"
+	"github.com/foxcpp/maddy/framework/module"
+	"github.com/libdns/rfc2136"
+)
+
+func init() {
+	module.Register("libdns.rfc2136", func(modName, instName string, _, _ []string) (module.Module, error) {
+		p := rfc2136.Provider{}
+		return &ProviderModule{
+			RecordDeleter:  &p,
+			RecordAppender: &p,
+			setConfig: func(c *config.Map) {
+				c.String("KeyName", false, true, "", &p.KeyName)
+				c.String("Key", false, true, "", &p.Key)
+				c.String("KeyAlg", false, true, "", &p.KeyAlg)
+				c.String("Server", false, true, "", &p.Server)
+			},
+			instName: instName,
+			modName:  modName,
+		}, nil
+	})
+}

From eeb49621f48886300452975dc32437bd8d8a7d07 Mon Sep 17 00:00:00 2001
From: Louis Guidez reind33r <louis@hostux.fr>
Date: Thu, 15 Feb 2024 23:55:55 +0100
Subject: [PATCH 5/9] libdns/rfc2136 use snake_case instead of PascalCase for
 configuration directives; clarify the meaning of the configuration directives

---
 docs/reference/tls-acme.md | 12 ++++++++----
 internal/libdns/rfc2136.go |  8 ++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/docs/reference/tls-acme.md b/docs/reference/tls-acme.md
index 1cc7423..d6479de 100644
--- a/docs/reference/tls-acme.md
+++ b/docs/reference/tls-acme.md
@@ -267,10 +267,14 @@ dns namedotcom {
 
 ```
 dns rfc2136 {
-    KeyName "..."
-    Key "..."
-    KeyAlg "..."
-    Server "..."
+    key_name "..."
+    # Secret
+    key "..."
+    # HMAC algorithm used to generate the key, lowercase, e.g. hmac-sha512
+    key_alg "..."
+    # server to which the dynamic update will be sent, e.g. 127.0.0.1
+    # you can also specify the port: 127.0.0.1:53
+    server "..."
 }
 ```
 
diff --git a/internal/libdns/rfc2136.go b/internal/libdns/rfc2136.go
index aa75562..19751f6 100644
--- a/internal/libdns/rfc2136.go
+++ b/internal/libdns/rfc2136.go
@@ -16,10 +16,10 @@ func init() {
 			RecordDeleter:  &p,
 			RecordAppender: &p,
 			setConfig: func(c *config.Map) {
-				c.String("KeyName", false, true, "", &p.KeyName)
-				c.String("Key", false, true, "", &p.Key)
-				c.String("KeyAlg", false, true, "", &p.KeyAlg)
-				c.String("Server", false, true, "", &p.Server)
+				c.String("key_name", false, true, "", &p.KeyName)
+				c.String("key", false, true, "", &p.Key)
+				c.String("key_alg", false, true, "", &p.KeyAlg)
+				c.String("server", false, true, "", &p.Server)
 			},
 			instName: instName,
 			modName:  modName,

From bb2c0c9bcc8a52af22991a7445d718f762c24c68 Mon Sep 17 00:00:00 2001
From: Louis Guidez reind33r <louis@hostux.fr>
Date: Fri, 16 Feb 2024 00:14:44 +0100
Subject: [PATCH 6/9] docs: corrected typo for rspamd check configuration

---
 docs/third-party/rspamd.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/third-party/rspamd.md b/docs/third-party/rspamd.md
index b528215..3d2ce48 100644
--- a/docs/third-party/rspamd.md
+++ b/docs/third-party/rspamd.md
@@ -7,7 +7,7 @@ If rspamd is running locally, it is enough to just add `rspamd` check
 with default configuration into appropriate check block (probably in
 local_routing):
 ```
-checks {
+check {
     ...
     rspamd
 }

From 62799b4b1e23735851939d40c9b31aba67b126fa Mon Sep 17 00:00:00 2001
From: oidq <oidq@oidq.dev>
Date: Wed, 13 Mar 2024 09:26:57 +0100
Subject: [PATCH 7/9] build: make "build.sh install" reusable

* prevent the script form blindly overwriting the current configuration
* force maddyctl linking so that we can reuse the script
* fix indentation in build.sh
---
 build.sh | 42 ++++++++++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/build.sh b/build.sh
index 68e71db..3dc76de 100755
--- a/build.sh
+++ b/build.sh
@@ -3,6 +3,7 @@
 destdir=/
 builddir="$PWD/build"
 prefix=/usr/local
+configdir="${destdir}etc/maddy"
 version=
 static=0
 if [ "${GOFLAGS}" = "" ]; then
@@ -139,9 +140,18 @@ install() {
 
 	command install -m 0755 -d "${destdir}/${prefix}/bin/"
 	command install -m 0755 "${builddir}/maddy" "${destdir}/${prefix}/bin/"
-	command ln -s maddy "${destdir}/${prefix}/bin/maddyctl"
-	command install -m 0755 -d "${destdir}/etc/maddy/"
-	command install -m 0644 ./maddy.conf "${destdir}/etc/maddy/maddy.conf"
+	command ln -sf maddy "${destdir}/${prefix}/bin/maddyctl"
+	command install -m 0755 -d "${configdir}"
+
+
+	# We do not want to overwrite existing configuration.
+	# If the file exists, then save it with .default suffix and warn user.
+	if [ ! -e "${configdir}/maddy.conf" ]; then
+		command install -m 0644 ./maddy.conf "${configdir}/maddy.conf"
+	else
+		echo "-- [!] Configuration file ${configdir}/maddy.conf exists, saving to ${configdir}/maddy.conf.default" >&2
+		command install -m 0644 ./maddy.conf "${configdir}/maddy.conf.default"
+	fi
 
 	# Attempt to install systemd units only for Linux.
 	# Check is done using GOOS instead of uname -s to account for possible
@@ -150,19 +160,19 @@ install() {
 	# with sudo and go installation is user-specific, so fallback
 	# to using uname -s in the end.
 	set +e
-  if command -v go >/dev/null 2>/dev/null; then
-    set -e
-    if [ "$(go env GOOS)" = "linux" ]; then
-    		command install -m 0755 -d "${destdir}/${prefix}/lib/systemd/system/"
-    		command install -m 0644 "${builddir}"/systemd/*.service "${destdir}/${prefix}/lib/systemd/system/"
-    fi
-  else
-    set -e
-    if [ "$(uname -s)" = "Linux" ]; then
-        		command install -m 0755 -d "${destdir}/${prefix}/lib/systemd/system/"
-        		command install -m 0644 "${builddir}"/systemd/*.service "${destdir}/${prefix}/lib/systemd/system/"
-        fi
-  fi
+	if command -v go >/dev/null 2>/dev/null; then
+		set -e
+		if [ "$(go env GOOS)" = "linux" ]; then
+			command install -C -m 0755 -d "${destdir}/${prefix}/lib/systemd/system/"
+			command install -C -m 0644 "${builddir}"/systemd/*.service "${destdir}/${prefix}/lib/systemd/system/"
+		fi
+	else
+		set -e
+		if [ "$(uname -s)" = "Linux" ]; then
+			command install -C -m 0755 -d "${destdir}/${prefix}/lib/systemd/system/"
+			command install -C -m 0644 "${builddir}"/systemd/*.service "${destdir}/${prefix}/lib/systemd/system/"
+		fi
+	fi
 
 	if [ -e "${builddir}"/man ]; then
 		command install -m 0755 -d "${destdir}/${prefix}/share/man/man1/"

From 198a9a3fb57da4f69c897ac4f2489d1d7415736e Mon Sep 17 00:00:00 2001
From: Robert Coleman <git@robert.net.nz>
Date: Sat, 16 Mar 2024 16:03:57 +1300
Subject: [PATCH 8/9] add ACME-DNS provider for libdns

---
 docs/reference/tls-acme.md | 12 +++++++++++-
 go.mod                     |  1 +
 go.sum                     |  2 ++
 internal/libdns/acmedns.go | 28 ++++++++++++++++++++++++++++
 4 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 internal/libdns/acmedns.go

diff --git a/docs/reference/tls-acme.md b/docs/reference/tls-acme.md
index 9baccb5..be29f94 100644
--- a/docs/reference/tls-acme.md
+++ b/docs/reference/tls-acme.md
@@ -149,7 +149,7 @@ To be able to use these, you need to compile maddy
 with "libdns_PROVIDER" build tag.
 E.g.
 ```
-./build.sh -tags 'libdns_googleclouddns'
+./build.sh --tags 'libdns_googleclouddns'
 ```
 
 - gandi
@@ -263,3 +263,13 @@ dns namedotcom {
 }
 ```
 
+- acmedns (non-default)
+
+```
+dns acmedns {
+    username "..."
+    password "..."
+    subdomain "..."
+    server_url "..."
+}
+```
diff --git a/go.mod b/go.mod
index 68bf8a7..3ac8482 100644
--- a/go.mod
+++ b/go.mod
@@ -103,6 +103,7 @@ require (
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/klauspost/compress v1.17.4 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
+	github.com/libdns/acmedns v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
diff --git a/go.sum b/go.sum
index 005925b..be1dc81 100644
--- a/go.sum
+++ b/go.sum
@@ -496,6 +496,8 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/libdns/acmedns v0.2.0 h1:zTXdHZwe3r2issdVRyqt5/4X2yHpiBVmFnTrwBA29ik=
+github.com/libdns/acmedns v0.2.0/go.mod h1:XlKHilQQK/IGHYY//vCb903PdG4Wc/XnDQzcMp2hV3g=
 github.com/libdns/alidns v1.0.3-0.20230628155627-8d5d630d5516 h1:tPVSANkA4lo+K65YjsQcaQ1uh6sb0zRBQDz78l1Fo4Y=
 github.com/libdns/alidns v1.0.3-0.20230628155627-8d5d630d5516/go.mod h1:e18uAG6GanfRhcJj6/tps2rCMzQJaYVcGKT+ELjdjGE=
 github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd h1:c5hc0b5/pFqFeyQaOTVmYJbyr+QwZZFcMnjgtZGIk6k=
diff --git a/internal/libdns/acmedns.go b/internal/libdns/acmedns.go
new file mode 100644
index 0000000..cb657ee
--- /dev/null
+++ b/internal/libdns/acmedns.go
@@ -0,0 +1,28 @@
+//go:build libdns_acmedns || libdns_all
+// +build libdns_acmedns libdns_all
+
+package libdns
+
+import (
+	"github.com/foxcpp/maddy/framework/config"
+	"github.com/foxcpp/maddy/framework/module"
+	"github.com/libdns/acmedns"
+)
+
+func init() {
+	module.Register("libdns.acmedns", func(modName, instName string, _, _ []string) (module.Module, error) {
+		p := acmedns.Provider{}
+		return &ProviderModule{
+			RecordDeleter:  &p,
+			RecordAppender: &p,
+			setConfig: func(c *config.Map) {
+				c.String("username", false, true, "", &p.Username)
+				c.String("password", false, true, "", &p.Password)
+				c.String("subdomain", false, true, "", &p.Subdomain)
+				c.String("server_url", false, true, "", &p.ServerURL)
+			},
+			instName: instName,
+			modName:  modName,
+		}, nil
+	})
+}

From 3d81feeeaadcc951eb177e0d346a049c247c00ea Mon Sep 17 00:00:00 2001
From: Robert Coleman <git@robert.net.nz>
Date: Sat, 16 Mar 2024 16:17:46 +1300
Subject: [PATCH 9/9] Add additional build tags to Dockerfile

---
 Dockerfile     | 4 +++-
 docs/docker.md | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5ceb6f7..0cad071 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,7 @@
 FROM golang:1.19-alpine AS build-env
 
+ARG ADDITIONAL_BUILD_TAGS=""
+
 RUN set -ex && \
     apk upgrade --no-cache --available && \
     apk add --no-cache build-base
@@ -12,7 +14,7 @@ RUN go mod download
 COPY . ./
 RUN mkdir -p /pkg/data && \
     cp maddy.conf.docker /pkg/data/maddy.conf && \
-    ./build.sh --builddir /tmp --destdir /pkg/ --tags docker build install
+    ./build.sh --builddir /tmp --destdir /pkg/ --tags "docker ${ADDITIONAL_BUILD_TAGS}" build install
 
 FROM alpine:3.18.4
 LABEL maintainer="fox.cpp@disroot.org"
diff --git a/docs/docker.md b/docs/docker.md
index 2898a07..decb787 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -54,6 +54,11 @@ command. One way to it is to run it using `docker exec` instead of `docker run`:
 docker exec -it container_name_here maddy creds create foxcpp@maddy.test
 ```
 
+## Build Tags
+
+Some Maddy features (such as automatic certificate management via ACME with [a non-default libdns provider](../reference/tls-acme/#dns-providers)) require build tags to be passed to Maddy's `build.sh`, as this is run in the Dockerfile you must compile your own Docker image. Build tags can be set via the docker build argument `ADDITIONAL_BUILD_TAGS` e.g. `docker build --build-arg ADDITIONAL_BUILD_TAGS="libdns_acmedns libdns_route53" -t yourorgname/maddy:yourtagname .`.
+
+
 ## TL;DR
 
 ```