[pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges

[Fabian Grünbichler]

On March 7, 2024 11:26 am, Hannes Laimer wrote:
> Signed-off-by: Hannes Laimer <h.laimer at proxmox.com>
> ---
> came up in support, and I don't think there's a good reason to not also
> use the proxy for ACME DNS challenges. tested with local proxy, curl
> in `proxmox-acme` picked the env vars up correctly and used the proxy
> 
>  docs/package-repositories.rst | 5 +++--
>  src/acme/plugin.rs            | 9 +++++++++
>  2 files changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
> index b429b4b4..969cca3c 100644
> --- a/docs/package-repositories.rst
> +++ b/docs/package-repositories.rst
> @@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
>  central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
>  web-interface in the `Configuration -> Authentication` tab.
>  
> -Once configured this proxy will be used for apt network requests and for
> -checking a Proxmox Backup Server support subscription.
> +Once configured this proxy will be used for apt network requests, for
> +checking a Proxmox Backup Server support subscription and for ACME DNS challenge
> +requests.

what about PVE and PMG?

>  
>  Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
>  the `<host>` part may include an authorization, for example:
> diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
> index 200cf9cc..db464afe 100644
> --- a/src/acme/plugin.rs
> +++ b/src/acme/plugin.rs
> @@ -113,6 +113,12 @@ impl DnsPlugin {
>  
>          let mut command = Command::new("/usr/bin/setpriv");
>  
> +        let (node_config, _digest) = crate::config::node::config()?;
> +        let proxy: Option<String> = node_config
> +            .http_proxy()
> +            .map(|p| p.to_proxy_string())
> +            .and_then(Result::ok);
> +
>          #[rustfmt::skip]
>          command.args([
>              "--reuid", "nobody",
> @@ -120,6 +126,9 @@ impl DnsPlugin {
>              "--clear-groups",
>              "--reset-env",
>              "--",
> +            "/bin/env",
> +            &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
> +            &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),

why not simply set "ALL_PROXY"?

>              "/bin/bash",
>                  PROXMOX_ACME_SH_PATH,
>                  action,
> -- 
> 2.39.2
> 
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
>