Certbot hook to update a DDNS zone using nsupdate

certbot-ddns-hook.sh

#!/bin/bash
# Pre- and post-hook for certbot dns-01 to use DDNS

# Where we put our TSIG for dynamic udpates
TSIG=/etc/letsencrypt/acme.key

# We need the authoritative nameserver
NS="dig +short $(host -v $CERTBOT_DOMAIN | awk '/SOA/ {print $5}' | head -1)"

# The actual challenge record to use
RECORD="_acme-challenge.${CERTBOT_DOMAIN}"

# Create the challenge record with TTL of 60s
add_challenge=$(cat <<EOF
server $NS
update add $RECORD 60 TXT $CERTBOT_VALIDATION
send
EOF
)

# Remove all existing challenge records
clean_challenge=$(cat <<EOF
server $NS
prereq yxdomain $RECORD
update delete $RECORD
send
EOF
)

# If this is null, we are running in auth mode
[[ -n CERTBOT_AUTH_OUTPUT ]] || {{
    echo 'Adding challenge records...'
    nsupdate -k $TSIG <<< "$add_challenge"
}

# If not null, we are running in cleanup mode
[[ -n CERTBOT_AUTH_OUTPUT ]] && {{
    echo 'Cleaning challenge records...'
    nsupdate -k $TSIG <<< "$clean_challenge"
}

exit 0

This is handy when your _acme-challenge record isn't in the same zone as your certificate domain, which was a scenario the certbot-dns-rfc2136 plugin only recently added support for.