deSEC is a free, open-source DNS hosting service with a focus on security and privacy. This Terraform/OpenTofu provider lets you manage deSEC resources - DNS domains, record sets, API tokens, and token scoping policies - as infrastructure code.

Install the provider by adding it to your required_providers block:

terraform {
  required_providers {
    desec = {
      source  = "timofurrer/desec"
      version = "~> 0"
    }
  }
}

Configure the provider with your deSEC API token. The token can also be supplied via the DESEC_API_TOKEN environment variable:

provider "desec" {
  api_token = "your-desec-api-token"
}

Create a DNS zone and add records:

resource "desec_domain" "example" {
  name = "example.com"
}

resource "desec_rrset" "www" {
  domain  = desec_domain.example.name
  subname = "www"
  type    = "A"
  ttl     = 3600
  rdata   = ["1.2.3.4"]
}

data "desec_rrset" "nameservers" {
  domain  = desec_domain.example.name
  subname = "@"
  type    = "NS"
}

output "nameservers" {
  description = "The deSEC nameservers to enter at your domain registrar."
  value       = data.desec_rrset.nameservers.rdata
}

For the full list of resources, data sources, and configuration options see the provider documentation.

Then commit the changes to go.mod and go.sum.

If you wish to work on the provider, you'll first need Go installed on your machine.

To compile the provider, run make playground. This will build the provider and put the provider binary in the ./bin directory.

Have a look at the playground folder to see how to use this development build.

To generate or update documentation, run make generate.

By default, acceptance tests run against an in-memory fake deSEC API server. No real account or credentials are needed, and each test gets a fresh isolated server instance with no shared state:

make testacc

To run a specific test, use the RUN variable:

make testacc RUN=TestAccDomainResource

To run against the real deSEC API instead, set DESEC_REAL_API=1 and provide a valid API token via DESEC_API_TOKEN. An optional DESEC_API_URL override is also supported (defaults to https://desec.io/api/v1):

DESEC_REAL_API=1 DESEC_API_TOKEN=your-token make testacc

Note: Running against the real API will create and delete actual resources in your deSEC account and may trigger rate limits.