From 72e0ba8cce912a9cdb00654cb69e54f621181159 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sat, 14 Mar 2026 21:37:12 +0100
Subject: [PATCH] Update python script dns

---
 dns/cronjob.yaml |  2 +-
 dns/sync.py      | 30 +++++++++++++++---------------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/dns/cronjob.yaml b/dns/cronjob.yaml
index c3c43ab..e7973fc 100644
--- a/dns/cronjob.yaml
+++ b/dns/cronjob.yaml
@@ -21,7 +21,7 @@ spec:
                 - sh
                 - -c
                 - |
-                  pip install --quiet PyJWT cryptography requests pyyaml &&
+                  pip install --quiet cryptography requests pyyaml &&
                   python /config/sync.py
               env:
                 - name: TRANSIP_ACCOUNT_NAME
diff --git a/dns/sync.py b/dns/sync.py
index 3ea8f64..a908b2c 100644
--- a/dns/sync.py
+++ b/dns/sync.py
@@ -5,14 +5,14 @@ import base64
 import json
 import os
 import sys
-import time
 import uuid
 from glob import glob
 from pathlib import Path
 
-import jwt
 import requests
 import yaml
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
 
 TRANSIP_API = "https://api.transip.nl/v6"
 DOMAINS_DIR = "/config/domains"
@@ -20,24 +20,24 @@ DOMAINS_DIR = "/config/domains"
 
 def get_access_token(account_name: str, private_key: str) -> str:
     """Authenticate with TransIP API and return a bearer token."""
-    now = int(time.time())
-    payload = {
-        "iss": account_name,
-        "sub": account_name,
-        "aud": "api.transip.nl",
-        "jti": str(uuid.uuid4()),
-        "iat": now,
-        "nbf": now,
-        "exp": now + 300,
+    body = json.dumps({
+        "login": account_name,
+        "nonce": uuid.uuid4().hex,
+        "read_only": False,
+        "expiration_time": "5 minutes",
         "global_key": True,
-    }
-    token = jwt.encode(payload, private_key, algorithm="RS512")
+    })
+
+    key = serialization.load_pem_private_key(private_key.encode(), password=None)
+    signature = key.sign(body.encode(), padding.PKCS1v15(), hashes.SHA512())
+    signature_b64 = base64.b64encode(signature).decode()
+
     resp = requests.post(
         f"{TRANSIP_API}/auth",
-        json={"login": account_name, "nonce": payload["jti"], "global_key": True},
+        data=body,
         headers={
             "Content-Type": "application/json",
-            "Authorization": f"Bearer {token}",
+            "Signature": signature_b64,
         },
         timeout=30,
     )