The acme-dns route

No recipe above needs it any more, but the DNS-01 API also speaks acme-dns, for a client that expects it. Mint a credential with a key carrying dns01:write; the password appears in this response and never again.

$ curl -X POST https://dnsmint.com/api/v1/hostnames/HOST_ID/acme-credential \
    -H "Authorization: Bearer $DNSMINT_KEY"

{
  "username": "2f1e6a9c-8b3d-4e5f-9a1b-6c7d8e9f0a1b",
  "password": "f3a9...",
  "fulldomain": "_acme-challenge.q7k4m2.a3f9c1-d4e7b8.dev",
  "subdomain": "2f1e6a9c-8b3d-4e5f-9a1b-6c7d8e9f0a1b",
  "server_url": "https://dnsmint.com/api/acme",
  "allowfrom": []
}

Clients store it keyed by the hostname, without any wildcard prefix; one entry covers the hostname and *.hostname.

{
  "q7k4m2.a3f9c1-d4e7b8.dev": {
    "username": "2f1e6a9c-8b3d-4e5f-9a1b-6c7d8e9f0a1b",
    "password": "f3a9...",
    "fulldomain": "_acme-challenge.q7k4m2.a3f9c1-d4e7b8.dev",
    "subdomain": "2f1e6a9c-8b3d-4e5f-9a1b-6c7d8e9f0a1b",
    "server_url": "https://dnsmint.com/api/acme"
  }
}

lego and Traefik auto-register against acme-dns when their storage is empty, which we do not support, so use httpreq there rather than this. The protocol is documented in the API reference.