# noust dns

DNS accounts, the records Noust manages in them, and the DNS-01 challenge.

```bash
noust dns [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`check`](#noust-dns-check), [`ensure`](#noust-dns-ensure), [`provider`](#noust-dns-provider), [`records`](#noust-dns-records), [`release`](#noust-dns-release), [`sweep`](#noust-dns-sweep)

## noust dns check

Does NAME point at this server? Asked of the public DNS, as the certificate authority will.

```bash
noust dns check [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--resolver` | Ask this resolver instead of dns.resolvers. |  |
| `--json` | Print the verdict as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns ensure

Make HOSTNAME point at this server, creating its record in the account that holds the zone.

```bash
noust dns ensure [OPTIONS] APP HOSTNAME
```

Arguments: `app_domain`, `hostname`

| Option | What it does | Default |
|---|---|---|
| `--content` | What it holds: an address, or a name for a CNAME. This server's public address by default. |  |
| `--type` | The record type. |  |
| `--account` | The account, when more than one holds the zone. |  |
| `--plan` | Say what would be done and change nothing. |  |
| `--replace-record` | Replace the record in the way: its id, as the conflict named it. |  |
| `--replace-current` | What that record held when you looked. |  |
| `--json` | Print the outcome as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns provider

The DNS accounts Noust holds: Cloudflare, DigitalOcean, Hetzner, Gandi and Route 53 (records and the challenge, Cloudflare also tunnels), and certbot's plugins.

```bash
noust dns provider [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-dns-provider-add), [`kinds`](#noust-dns-provider-kinds), [`list`](#noust-dns-provider-list), [`remove`](#noust-dns-provider-remove), [`set`](#noust-dns-provider-set), [`verify`](#noust-dns-provider-verify)

## noust dns provider add

Add a DNS account. Its credential is proven first, and kept only in the secret store.

```bash
noust dns provider add [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--kind` | The provider. |  |
| `--set` | A field that is not secret. |  |
| `--token-stdin` | Read the credential from one line of standard input. |  |
| `--credentials-stdin` | Read every field from a JSON object on standard input. |  |
| `--automatic`, `--ask` | Create the records of a domain when it is added, without asking (providers Noust speaks to). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns provider kinds

List the providers Noust knows, and what an account of each needs.

```bash
noust dns provider kinds [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the providers as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns provider list

List the DNS accounts and when each one's credential last worked.

```bash
noust dns provider list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the accounts as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns provider remove

Remove an account and its credential. The records stay at the provider.

```bash
noust dns provider remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns provider set

Change whether an account creates records on its own, or how long a challenge waits.

```bash
noust dns provider set [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--automatic`, `--ask` | Create records without asking. |  |
| `--propagation` | Seconds to wait for a challenge record. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns provider verify

Try an account's credential again and list the zones it manages.

```bash
noust dns provider verify [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the zones as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns records

List the DNS records Noust manages, who made them and who uses them.

```bash
noust dns records [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the records as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns release

Let APP go of its records (or of HOSTNAME's): the last user's release deletes what Noust made.

```bash
noust dns release [OPTIONS] APP [HOSTNAME]
```

Arguments: `app_domain`, `hostname`

| Option | What it does | Default |
|---|---|---|
| `--keep` | Only forget that APP uses the records; delete nothing. |  |
| `--json` | Print the outcomes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust dns sweep

Release the records nobody has used for an hour. The monitor does this every hour.

```bash
noust dns sweep [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the outcomes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |