Add automatic dns-01/http-01 challenge detection for Let's Encrypt via Azure DNS REST API

[Copilot]

Extends letsencrypt_drupal.sh to support DNS-01 challenge validation via Azure DNS, enabling wildcard certificates and validation without web server access. Challenge type is automatically detected based on domain types.

Changes

Script modification:

• Automatic challenge type detection based on domains in configuration file
• Hook selection logic routes to appropriate hook based on detected domain types

# Single command - challenge type auto-detected
./letsencrypt_drupal.sh projectname prod

Automatic detection logic:

• dns-01 challenge: Automatically used for apex domains (example.com) and wildcard domains (*.example.com)
• http-01 challenge: Automatically used for subdomains (www.example.com, api.example.com)

The script analyzes the domains file at runtime and selects the appropriate challenge type - no manual parameter needed.

Azure DNS hook (hooks/azure_dns_hook.sh):

• Implements dehydrated hook interface for DNS-01 validation
• Azure REST API integration using curl (no Azure CLI dependency)
• OAuth2 token acquisition, TXT record lifecycle management
• 60-second DNS propagation wait

Required environment variables (for dns-01):

• AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
• AZURE_RESOURCE_GROUP, AZURE_DNS_ZONE

Documentation:

• Azure Service Principal setup instructions
• Configuration template with credential placeholders
• Testing guide covering automatic detection scenarios

Implementation notes

• Challenge type selection is implicit and automatic based on domain analysis
• Apex domains detected by counting dots (domain.tld = 1 dot)
• Wildcard domains detected by *. prefix
• Service Principal requires DNS Zone Contributor role (for dns-01 only)
• TXT records created at _acme-challenge.[subdomain] with 60s TTL
• Subdomain extraction handles root and nested subdomains correctly
• Certificate deployment logic reused from existing http-01 hook

Original prompt

Enhance letsencrypt_drupal.sh script to allow dns-01 challenge type, keeping http-01 as default. Challenge type should be provided as the script parameter. use appropriate configuration for the "dehydrated" script (https://github.com/dehydrated-io/dehydrated). Instructions: https://github.com/dehydrated-io/dehydrated/blob/master/docs/dns-verification.md . Create separate shell script to create respective TXT record on Azure DNS using REST API and curl (avoid using az cli). Use environment variables/secrets for all required Azure information.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Jura]

@copilot Make challenge choice implicit, based on the domain name type which needs to be verified: apex domains (example.com) and wildcard domains (*.example.com) should use dns-01 challenge, other domains (i.e. www.example.com) - http-01 challenge

[Copilot]

@copilot Make challenge choice implicit, based on the domain name type which needs to be verified: apex domains (example.com) and wildcard domains (*.example.com) should use dns-01 challenge, other do...

Done! Challenge type is now automatically detected based on domain types in the domains file:

• dns-01: Apex domains (example.com) and wildcard domains (*.example.com)
• http-01: Subdomains (www.example.com, api.example.com)

The script analyzes domains at runtime and selects the appropriate challenge type automatically. No manual parameter needed.

Changes in commit: 0e91739