Using dnscontrol with the Proton Pass CLI

This is Part 3 on how to get the most out of dnscontrol. You can read Part 1 here, on how to use dnscontrol with GitHub Actions and Part 2 here on how to use it with the 1Password CLI

Proton has released a CLI for Proton Pass, so naturally, I put it to test to see if I could use it with dnscontrol. In short, it works the same as with the 1Password CLI, with only minor tweaks.

If using dnscontrol with GitHub Actions is overkill or you want to keep it all local, this guide will show you how to use the Proton Pass CLI to automatically inject the secrets into the creds.json file so your API creds are not stored in the file and written to disk, and instead injected at runtime via the CLI.

This will not be a 'Getting started with dnscontrol' post, therefore I will assume you've already set it up. If you have never used it, read their Getting started guide first and set it up.

Second, you must have a Proton Pass subscription. Chances are you don't have the CLI, so go ahead, get it and sign in.

Once you've setup dnscontrol and the Pass CLI, go find your creds.json file. You will have to rename it to creds.json.tpl to use it with the CLI.

Credentials are fetched using secret references to the item in Pass using the following syntax:

pass://vault/item/field

In creds.json.tpl define the provider and link to the secret reference:

Note: You must wrap the secret reference in double brackets {{ }}

    "dnsimple": {
      "TYPE": "DNSIMPLE",
      "token": "{{ pass://Secrets/dnscontrol - DNSimple/secret }}"
    },

I am using the API Credential item type, so the field name is secret. If you stored it as a password, it may be password.

Lastly, when it comes to running dnscontrol you run it like this:

dnscontrol preview --creds='!pass-cli inject -i creds.json.tpl'

dnscontrol push --creds='!pass-cli inject -i creds.json.tpl'

and the CLI will automatically inject the credentials, authenticate into the API, and make the changes to your domains, all without your credentials ever touching the disk.