unable to progress beyond removing stale lock files

[yzpaul]

Updated the opnsense plugin with the new binary and confirmed the providers now include route53. Using AWS CloudTrail there is no indication it tried to update a DNS record for the challenge.

My old caddyfile (working)

# caddy_user=root

# Global Options
{
	log {
		output net unixgram//var/run/caddy/log.sock {
		}
		format json {
			time_format rfc3339
		}
	}

	servers {
		protocols h1 h2
	}

	email xxx@gmail.com
	grace_period 10s
	skip_install_trust
	import /usr/local/etc/caddy/caddy.d/*.global
}

# Reverse Proxy Configuration


fw.xxx.com {
	tls /usr/local/etc/caddy/certificates/6839bffac0bc3.pem /usr/local/etc/caddy/certificates/6839bffac0bc3.key {
	}

	handle {
		reverse_proxy 127.0.0.1:9999 {
		}
	}
}

New caddyfile:

# Global Options
{
	log {
		output net unixgram//var/run/caddy/log.sock
		format json {
			time_format rfc3339
		}
	}

	servers {
		protocols h1 h2
	}

	email xxx@gmail.com
	grace_period 10s
	skip_install_trust
}

# Reverse Proxy Configuration

fw.xxx.com {
	tls {
		dns route53{}
	}

	handle {
		reverse_proxy 127.0.0.1:9999
	}
}

I trimmed these to only include the first example domain.

when I restart caddy without the {} after dns route53 I get the removing lock messages, then nothing else after waiting 5 minutes and checking both the caddy logs and cloudtrail)

1.764789215147024e+09 info [FileStorage:/var/db/caddy/data/caddy] Lock for 'issue_cert_request.xxx.com' is stale (created: 2025-12-03 19:04:54.476742111 +0000 UTC, last update: 2025-12-03 19:09:46.132918055 +0000 UTC); removing then retrying: /var/db/caddy/data/caddy/locks/issue_cert_request.xxx.com.lock

When I restart it with the {} after dns route53 I get:

Error: adapting config using caddyfile: parsing caddyfile tokens for 'tls': getting module named 'dns.providers.route53{}': module not registered: dns.providers.route53{}, at /usr/local/etc/caddy/Caddyfile:25
Error: caddy process exited with error: exit status 1

However when I check the module is registered:

root@fw:~ # /usr/local/bin/caddy list-modules | grep route53
dns.providers.route53
root@fw:~ # /usr/local/bin/caddy version
v2.10.2 h1:g/gTYjGMD0dec+UgMw8SnfmJ3I9+M2TdvoRL/Ovu6U8=
# opnsense-version
OPNsense 25.7.8 (amd64)

I can confirm my AWS creds (passed through credentials file) are correct since ACME was successfully able to generate a cert using DNS challenge. I confirmed acme was disabled before starting this process

[ekoyle]

Are you running split DNS in youw AWS environment?

[AndrianBdn]

Sorry this has been open a while. If you (or anyone else still hitting this) want to try again — v1.6.1 just added an optional debug_logging true setting. Add it inside your dns route53 { ... } block, and set Caddy's log level to debug. The module will then write events to Caddy's log — loading AWS settings, looking up the zone, submitting the change. Since CloudTrail wasn't seeing any calls, those events should show where it gives up.