[pbs-devel] [PATCH proxmox-backup] config: check if acme domain with wildcard uses dns challenge

[Gabriel Goller]

On 18.09.2024 10:43, Christian Ebner wrote:
>Tried to generate a wildcard certificate using the cloudflare DNS 
>plugin with these patches applied.
>
>Unfortunately this fails with an error (domain obfuscated, but its the 
>domain without the "*." prefix):
>```
>TASK ERROR: no config for domain 'mydomain'
>```
>
>So it seem there still is an issue when retrieving the domain from the 
>config here:
>https://git.proxmox.com/?p=proxmox-backup.git;a=blob;f=src/api2/node/certificates.rs;h=61ef910e47a71a005064d2b1e99d3d97b0d43f51;hb=HEAD#l342

yep, noticed this as well, will hopefully be fixed in the next version!

>Also, nit inline.
>
>On 9/17/24 11:47, Gabriel Goller wrote:
>>As already mentioned in our docs [0], wildcard domains are only
>>supported when the dns-challenge is used. If the dns-challenge is not
>>used, throw an error.
>>
>>[0]: https://pbs.proxmox.com/docs/sysadmin.html#wildcard-certificates
>>
>>Signed-off-by: Gabriel Goller <g.goller at proxmox.com>
>>---
>>  src/config/node.rs | 10 ++++++++++
>>  1 file changed, 10 insertions(+)
>>
>>diff --git a/src/config/node.rs b/src/config/node.rs
>>index 937beb3a125c..80a503635344 100644
>>--- a/src/config/node.rs
>>+++ b/src/config/node.rs
>>@@ -272,6 +272,16 @@ impl NodeConfig {
>>              if !domains.insert(domain.domain.to_lowercase()) {
>>                  bail!("duplicate domain '{}' in ACME config", domain.domain);
>>              }
>>+            if domain.domain.contains('*')
>>+                && domain.plugin.map_or(true, |value| {
>>+                    value.as_str() == "" || value.as_str() == "standalone"
>>+                })
>>+            {
>>+                bail!(
>>+                    "wildcard domains like '{}' are only usable with the DNS challenge type",
>
>nit: Above checks for standalone HTTP challenge, so instead of stating 
>that the wildcard is only usable with DNS challenges, I think it would 
>be better to state that it is not usable with the HTTP challenge 
>instead.

Agree.

Thanks for the review! Will send a v2 soon!