Added plugin to support DNS in HETZNER Cloud Console.

Posh-ACME/Plugins/HetznerCloud.ps1

@@ -0,0 +1,331 @@
+function Get-CurrentPluginType { 'dns-01' }
+
+Function Add-DnsTxt {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory,Position = 0)]
+        [string]$RecordName,
+        [Parameter(Mandatory,Position = 1)]
+        [string]$TxtValue,
+        [Parameter(Mandatory,Position = 2)]
+        [securestring]$HCToken,
+        [Parameter(ValueFromRemainingArguments)]
+        $ExtraParams
+    )
+
+    # un-secure the password so we can add it to the auth header
+    $HCTokenInsecure = [pscredential]::new('a',$HCToken).GetNetworkCredential().Password
+    $restParams = @{
+        Headers = @{
+            Authorization = "Bearer $HCTokenInsecure"
+            Accept = 'application/json'
+        }
+        ContentType = 'application/json'
+        Verbose = $false
+    }
+
+    # find matching ZoneID to check, if the records exists already
+    if (-not ($zone = Find-HetznerZone $RecordName $restParams)) {
+        throw "Unable to find matching zone for $RecordName"
+    }
+
+    # separate the portion of the name that doesn't contain the zone name
+    $recShort = $RecordName -ireplace "\.?$([regex]::Escape($zone.name.TrimEnd('.')))$",''
+    if ($recShort -eq '') { $recShort = '@' }
+
+    # Get a list of existing TXT records for this record name
+    try {
+        Write-Verbose "Searching for existing TXT record"
+        $query = "https://api.hetzner.cloud/v1/zones/$($zone.id)/rrsets?type=TXT&name=$recShort"
+        Write-Debug "GET $query"
+        $recs = Invoke-RestMethod $query @restParams @Script:UseBasic -EA Stop
+        Write-Debug ($recs | ConvertTo-Json -Depth 5)
+    } catch {
+        if (404 -ne $_.Exception.Response.StatusCode) {
+            throw
+        }
+    }
+
+    # check for a matching record. Partially redacted example follows:
+    # {
+    #   "meta": { ... },
+    #   "rrsets": [
+    #     {
+    #       "id": "_acme-challenge/TXT",
+    #       "name": "_acme-challenge",
+    #       "type": "TXT",
+    #       "ttl": 600,
+    #       "records": [
+    #         {
+    #           "value": "\"3Sf2LzKsq12Av-nfduZjxebiOd2FhccQXeLVx5eDrGM\"",
+    #           "comment": "ACME cert validation"
+    #         }
+    #       ],
+    #       "zone": 69323
+    #     }
+    #   ]
+    # }
+    $rec = $recs.rrsets[0]
+    $valToFind = "`"$TxtValue`""
+
+    if ($rec) {
+        # check if the value already exists
+        if ($valToFind -in $rec.records.value) {
+            Write-Debug "Record $RecordName already contains $TxtValue. Nothing to do."
+            return
+        }
+        # add the new value
+        $queryParams = @{
+            Uri = "https://api.hetzner.cloud/v1/zones/$($zone.id)/rrsets/$($rec.id)/actions/add_records"
+            Method = 'POST'
+            Body = @{
+                records = @(@{
+                    value = $valToFind
+                    comment = "ACME cert validation"
+                })
+            } | ConvertTo-Json
+            ErrorAction = 'Stop'
+        }
+
+        Write-Verbose "Update Record $RecordName with new value $TxtValue."
+
+    } else {
+        # add a new record
+        $queryParams = @{
+            Uri = "https://api.hetzner.cloud/v1/zones/$($zone.id)/rrsets"
+            Method = 'POST'
+            Body = @{
+                name = $recShort
+                type = 'TXT'
+                ttl = 300
+                records = @(@{
+                    value = $valToFind
+                    comment = "ACME cert validation"
+                })
+            } | ConvertTo-Json
+            ErrorAction = 'Stop'
+        }
+
+        Write-Verbose "Add Record $RecordName with value $TxtValue."
+    }
+
+    try {
+        Write-Debug "$($queryParams.Method) $($queryParams.Uri)`n$($queryParams.Body)"
+        Invoke-RestMethod @queryParams @restParams @Script:UseBasic | Out-Null
+    } catch { throw }
+
+
+    <#
+    .SYNOPSIS
+        Add a DNS TXT record to Hetzner.
+    .DESCRIPTION
+        Uses the Hetzner DNS API to add or update a DNS TXT record.
+    .PARAMETER RecordName
+        The fully qualified name of the TXT record.
+    .PARAMETER TxtValue
+        The value of the TXT record.
+    .PARAMETER HCToken
+        The API token for your Hetzner account.
+    .PARAMETER ExtraParams
+        This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.
+    .EXAMPLE
+        $token = Read-Host 'Token' -AsSecureString
+        Add-DnsTxt '_acme-challenge.example.com' 'txt-value' -HCToken $token
+
+        Adds or updates the specified TXT record with the specified value.
+    #>
+}
+
+Function Remove-DnsTxt {
+    [CmdletBinding(DefaultParameterSetName='Secure')]
+    param(
+        [Parameter(Mandatory,Position = 0)]
+        [string]$RecordName,
+        [Parameter(Mandatory,Position = 1)]
+        [string]$TxtValue,
+        [Parameter(Mandatory,Position = 2)]
+        [securestring]$HCToken,
+        [Parameter(ValueFromRemainingArguments)]
+        $ExtraParams
+    )
+
+    # un-secure the password so we can add it to the auth header
+    $HCTokenInsecure = [pscredential]::new('a',$HCToken).GetNetworkCredential().Password
+    $restParams = @{
+        Headers = @{
+            Authorization = "Bearer $HCTokenInsecure"
+            Accept = 'application/json'
+        }
+        ContentType = 'application/json'
+        Verbose = $false
+    }
+
+    # find matching ZoneID to check, if the records exists already
+    if (-not ($zone = Find-HetznerZone $RecordName $restParams)) {
+        throw "Unable to find matching zone for $RecordName"
+    }
+
+    # separate the portion of the name that doesn't contain the zone name
+    $recShort = $RecordName -ireplace "\.?$([regex]::Escape($zone.name.TrimEnd('.')))$",''
+    if ($recShort -eq '') { $recShort = '@' }
+
+    # Get a list of existing TXT records for this record name
+    try {
+        Write-Verbose "Searching for existing TXT record"
+        $query = "https://api.hetzner.cloud/v1/zones/$($zone.id)/rrsets?type=TXT&name=$recShort"
+        Write-Debug "GET $query"
+        $recs = Invoke-RestMethod $query @restParams @Script:UseBasic -EA Stop
+        Write-Debug ($recs | ConvertTo-Json -Depth 5)
+    } catch {
+        if (404 -ne $_.Exception.Response.StatusCode) {
+            throw
+        }
+    }
+
+    # check for a matching record
+    $rec = $recs.rrsets[0]
+    $valToFind = "`"$TxtValue`""
+
+    if ($rec) {
+        if (-not ($valToFind -in $rec.records.value)) {
+            Write-Debug "Record $RecordName does not contain $TxtValue. Nothing to do."
+            return
+        }
+
+        if ($rec.records.Count -gt 1) {
+            # remove just the one value
+            $queryParams = @{
+                Uri = "https://api.hetzner.cloud/v1/zones/$($zone.id)/rrsets/$($rec.id)/actions/remove_records"
+                Method = 'POST'
+                Body = @{
+                    records = @(@{
+                        value = $valToFind
+                    })
+                } | ConvertTo-Json
+                ErrorAction = 'Stop'
+            }
+            Write-Verbose "Remove value $TxtValue from Record $RecordName."
+            Write-Debug "POST $($queryParams.Uri)`n$($queryParams.Body)"
+        } else {
+            # remove the entire record set
+            $queryParams = @{
+                Uri = "https://api.hetzner.cloud/v1/zones/$($zone.id)/rrsets/$($rec.id)"
+                Method = 'DELETE'
+                ErrorAction = 'Stop'
+            }
+            Write-Verbose "Remove Record $RecordName with value $TxtValue."
+            Write-Debug "DELETE $($queryParams.Uri)"
+        }
+
+        try {
+            Invoke-RestMethod @queryParams @restParams @Script:UseBasic -EA Stop | Out-Null
+        } catch { throw }
+
+    } else {
+        Write-Debug "Record $RecordName with value $TxtValue doesn't exist. Nothing to do."
+    }
+
+    <#
+    .SYNOPSIS
+        Remove a DNS TXT record from Hetzner.
+    .DESCRIPTION
+        Uses the Hetzner DNS API to remove DNS TXT record.
+    .PARAMETER RecordName
+        The fully qualified name of the TXT record.
+    .PARAMETER TxtValue
+        The value of the TXT record.
+    .PARAMETER HCToken
+        The API token for your Hetzner account.
+    .PARAMETER ExtraParams
+        This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.
+    .EXAMPLE
+        $token = Read-Host 'Token' -AsSecureString
+        Remove-DnsTxt '_acme-challenge.example.com' 'txt-value' -HCToken $token
+
+        Removes the specified TXT record with the specified value.
+    #>
+}
+
+function Save-DnsTxt {
+    [CmdletBinding()]
+    param(
+        [Parameter(ValueFromRemainingArguments)]
+        $ExtraParams
+    )
+    <#
+    .SYNOPSIS
+        Not required.
+    .DESCRIPTION
+        This provider does not require calling this function to commit changes to DNS records.
+    .PARAMETER ExtraParams
+        This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.
+    #>
+}
+
+############################
+# Helper Functions
+############################
+
+# API Docs: https://docs.hetzner.cloud/reference/cloud#dns
+
+Function Find-HetznerZone {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory, Position=0)]
+        [string]$RecordName,
+        [Parameter(Mandatory, Position=1)]
+        [hashtable]$RestParameters
+    )
+
+    # setup a module variable to cache the record to zone mapping
+    # so it's quicker to find later
+    if (!$script:HCRecordZones) { $script:HCRecordZones = @{} }
+
+    # check for the record in the cache
+    if ($script:HCRecordZones.ContainsKey($RecordName)) {
+        Write-Debug "Result from Cache $($script:HCRecordZones.$RecordName.Name)"
+        return $script:HCRecordZones.$RecordName
+    }
+
+    # We need to find the closest/deepest
+    # sub-zone that would hold the record rather than just adding it to the apex. So for something
+    # like _acme-challenge.site1.sub1.sub2.example.com, we'd look for zone matches in the following
+    # order:
+    # - site1.sub1.sub2.example.com
+    # - sub1.sub2.example.com
+    # - sub2.example.com
+    # - example.com
+    $pieces = $RecordName.Split('.')
+    for ($i=0; $i -lt ($pieces.Count-1); $i++) {
+        $zoneTest = $pieces[$i..($pieces.Count-1)] -join '.'
+        Write-Debug "Checking $zoneTest"
+
+        try {
+            $query = "https://api.hetzner.cloud/v1/zones/$zoneTest"
+            Write-Debug "GET $query"
+            $response = Invoke-RestMethod $query @RestParameters @Script:UseBasic -EA Stop
+        } catch {
+            if (404 -eq $_.Exception.Response.StatusCode) {
+                Write-Debug "Zone $zoneTest does not exist"
+                continue
+            }
+            else { throw }
+        }
+
+        if(!$response.zone) {
+            return $null;
+        }
+
+        Write-Debug "Zone $zoneTest found"
+
+        $zone = @{
+            id = ($response.zone.id)
+            name = ($response.zone.name)
+        }
+
+        $script:HCRecordZones.$RecordName = $zone
+        return $zone
+    }
+
+    return $null
+}

Posh-ACME/Private/Import-PluginDetail.ps1

@@ -47,6 +47,7 @@ function Import-PluginDetail {
         'GoogleDomains'        = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'GoogleDomains'}
         'GoDaddy'              = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'GoDaddy'}
         'Hetzner'              = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'Hetzner'}
+        'HetznerCloud'         = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'HetznerCloud'}
         'HostingDe'            = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'HostingDe'}
         'HurricaneElectric'    = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'HurricaneElectric'}
         'HurricaneElectricDyn' = [pscustomobject]@{PSTypeName = 'PoshACME.PAPluginDetail'; ChallengeType = 'dns-01'; Path = ''; Name = 'HurricaneElectric'}

docs/Plugins/Hetzner.md

@@ -2,7 +2,11 @@ title: Hetzner
 
 # How To Use the Hetzner DNS Plugin
 
-This plugin works against the [Hetzner](https://www.hetzner.de/) DNS provider. It is assumed that you have already setup an account and created the DNS zone(s) you will be working against.
+This plugin works against the [Hetzner](https://www.hetzner.de/) DNS provider. It is specifically for DNS zones in the legacy DNS Console. It is assumed that you have already setup an account and created the DNS zone(s) you will be working against.
+
+!!! warning
+    The legacy DNS Console is scheduled to be shut down in May 2026. Please migrate your zones to the new Hetzner Console before then and re-configure your certificates to use the new `HetznerCloud` plugin.
+    https://www.hetzner.com/news/dns-beta/
 
 ## Setup
 

docs/Plugins/HetznerCloud.md

@@ -0,0 +1,20 @@
+title: HetznerCloud
+
+# How To Use the Hetzner DNS Plugin
+
+This plugin works against the [Hetzner](https://www.hetzner.de/) DNS provider. It is specifically for DNS zones that have been migrated to Hetzner Console from the old DNS Console which uses a different API and tokens. It is assumed that you have already setup an account and created or migrated the DNS zone(s) you will be working against.
+
+## Setup
+
+You will need to generate an API Token if you haven't already done so. Go to the `Security - API tokens` section after logging in to the [HETZNER Console](https://console.hetzner.comn). Give the token a name, select `Read & Write` permissions, and click `Generate API Token`. Make a note of the token value as you'll need it later and won't be able to retrieve it after this point.
+
+## Using the Plugin
+
+You will need to provide the API Token as a SecureString value to `HCToken`.
+
+```powershell
+$pArgs = @{
+    HCToken = (Read-Host 'Hetzner Token' -AsSecureString)
+}
+New-PACertificate example.com -Plugin HetznerCloud -PluginArgs $pArgs
+```

docs/Plugins/index.md

@@ -48,7 +48,8 @@ Gandi | [Gandi LiveDNS](https://www.gandi.net) | [Usage Guide](Gandi.md) | :whit
 GCloud | [Google Cloud DNS](https://cloud.google.com/dns) | [Usage Guide](GCloud.md) | :white_check_mark:
 Google Domains | [Google Domains](https://domains.google/) | [Usage Guide](GoogleDomains.md) | :white_check_mark:
 GoDaddy | [GoDaddy](https://www.godaddy.com) | [Usage Guide](GoDaddy.md) | :white_check_mark:
-Hetzner | [Hetzner](https://hetzner.de/) | [Usage Guide](Hetzner.md) | :white_check_mark:
+Hetzner | [Hetzner](https://hetzner.de/) (Deprecated) | [Usage Guide](Hetzner.md) | :white_check_mark:
+HetznerCloud | [Hetzner](https://hetzner.de/) | [Usage Guide](Hetzner.md) | :white_check_mark:
 HostingDe | [Hosting.de](https://hosting.de) | [Usage Guide](HostingDe.md) | :white_check_mark:
 HurricaneElectric | [Hurricane Electric DNS](https://dns.he.net/) | [Usage Guide](HurricaneElectric.md) | :white_check_mark:
 HurricaneElectricDyn | [Hurricane Electric DNS](https://dns.he.net/) | [Usage Guide](HurricaneElectricDyn.md) | :white_check_mark: