Coolify, Dokploy and Dokku

None of the three has a DNS provider of its own. Coolify and Dokploy hand the name to Traefik, Dokku runs lego in a container, and all three arrive at lego's provider list. So the provider is httpreq and the credentials are the three variables from the lego section above.

Mint one hostname per app. The challenge name is _acme-challenge.<the app's domain>, so the app's domain has to be a hostname you hold. A subdomain of one is not: nothing is issued below a hostname, and the challenge would name something that does not exist.

In Coolify the proxy is a compose file you edit in place. Delete the two httpchallenge lines, add the two below, then Restart Proxy.

# Servers -> your server -> Proxy -> Configuration
services:
  traefik:
    environment:
      - HTTPREQ_ENDPOINT=https://dnsmint.com/api/httpreq
      - HTTPREQ_USERNAME=dnsmint
      - HTTPREQ_PASSWORD=<your DNSMint API key>
    command:
      # Delete the two httpchallenge lines, then add these two.
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=httpreq'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=0'

In Dokploy the same two halves live apart: the resolver in the Traefik file editor, the variables in Update Traefik Environment beside it. A domain then picks the resolver by name.

# Settings -> Web Server -> Traefik
certificatesResolvers:
  letsencrypt:
    acme:
      email: you@example.com
      storage: /etc/dokploy/traefik/dynamic/acme.json
      dnsChallenge:
        provider: httpreq

HTTPREQ_ENDPOINT=https://dnsmint.com/api/httpreq
HTTPREQ_USERNAME=dnsmint
HTTPREQ_PASSWORD=<your DNSMint API key>

Dokku calls lego directly, so it takes the provider and its variables as plugin properties. Set them once for every app:

$ dokku letsencrypt:set --global dns-provider httpreq
dokku letsencrypt:set --global dns-provider-HTTPREQ_ENDPOINT https://dnsmint.com/api/httpreq
dokku letsencrypt:set --global dns-provider-HTTPREQ_USERNAME dnsmint
dokku letsencrypt:set --global dns-provider-HTTPREQ_PASSWORD $DNSMINT_KEY

dokku domains:set myapp q7k4m2.a3f9c1-d4e7b8.dev
dokku letsencrypt:enable myapp

Worth doing on a public box, and the only option on a private one: HTTP-01 needs Let's Encrypt to reach the server, and behind NAT it cannot. None of the three has another way to answer DNS-01.