[pmg-devel] [RFC api/gui/wtk/acme 0/many] Certificates & ACME

[Dominik Csapak]

so i tested this a bit, and mostly works as advertised
(will look a bit deeper into the code today/tomorrow)

i tested with a local 'pebble' instance and for dns i
used a local powerdns instance

a few small problems (some we already discussed off-list):
* proxmox-acme-rs/client could use a 'Content-Length' header
   (necessary for pebble acme server, seems other acme endpoints are not
   as strict)
* the 'Add ACME Account' Button in the cert panel does not work
* cannot delete accounts that do not exist on the ACME server anymore
   (triggered this by restarting the pebble instance, it does not
   save anything persistent)
* for the selection of API/SMTP i would have rather expected
   checkboxes, it was not immediately clear that it is a multi-
   select combobox (though i think thomas nudged you in that
   direction?), but it's not too bad
* the dns plugin window behaves strangely:
   when editing a field on a plugin where we have the schema,
   the form does not get dirty, only when changing another field
   though it is entirely possible that this behaviour
   was already there

otherwise LGTM

On 3/9/21 3:13 PM, Wolfgang Bumiller wrote:
> These are the pmg-api, pmg-gui and proxmox-widget-toolkit and
> proxmox-acme parts of the ACME series for PMG.
> 
> This requires `pmg-rs` package, which replaces the ACME client from
> `proxmox-acme` and provides the CSR generation and is written in rust.
> Note that the DNS challenge handling still uses proxmox-acme for now.
> 
> proxmox-acme:
>    * Just a `use` statement fixup
>    * Still used for the DNS challenge
> 
> pmg-gui:
>    Just adds the "certificate view", but the real dirt lives in the
>    widget-toolkit.
> 
> proxmox-widget-toolkits:
>    Gets the Certificate, ACME Account, ACME Plugin and ACME Domain view
>    from PVE adapted to be usable for PMG.
>    Changes to PVE are mainly:
>      * API URLs need to be provided since they differ a bit between PVE
>        and PMG.
>      * some additional buttons/fields specific to pmg generated if the
>        parameters for them are present
> 
> pmg-api:
>    Simply gets API entry points for the above. These too are mostly
>    copied from PVE and adapted (also the ACME client API from pmg-rs is slightly
>    different/cleaned up, so that's a minor incompatiblity in some
>    otherwise common code, but a `pve-rs` may fix that). But some things
>    could definitely already go to pve-common (especially schema stuff).
> 
> Note that while I did add the corresponding files to the cluster sync,
> this still needs testing *and* issuing an API certificate may break
> cluster functionality currently. (Stoiko is working on that)
> 
> 
> _______________________________________________
> pmg-devel mailing list
> pmg-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel
> 
>