Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/4] fix #6173: acme: use the configured HTTP proxy

[Samuel Rufinatscha <s.rufinatscha@proxmox.com>]

On 10/27/26 3:54 PM, Christian Ebner wrote:
> On 10/8/26 5:33 PM, Samuel Rufinatscha wrote:
>> ACME requests in PBS and PDM ignore the node's HTTP proxy setting and
>> fail when the CA is reachable only through a proxy [0].
>>
>> Add optional proxy support to the shared ACME client and pass the node
>> proxy configuration to each operation that contacts the CA.
>>
>> Testing:
>>
>> Reproduced the issue on PBS 4.2 using Pebble [1] as the ACME server
>> and Tinyproxy [2] as the HTTP proxy configured in PBS. Added a firewall
>> rule to block direct access to Pebble while allowing connections through
>> Tinyproxy. Operations succeeded through the configured proxy.
>>
>> Tested for:
>>
>> (1) HTTP-01 and DNS-01, including proxies requiring
>> authentication.
>> (2) Automatic renewal using a short-lived Pebble certificate.
>> (3) Changed the HTTP proxy setting to a second Tinyproxy instance
>> without restarting the PBS services. The next ACME operations used
>> the new proxy.
>> (4) PDM was built against the shared libraries (only).
>>
>> Maintainer notes:
>>
>> - proxmox-acme-api has breaking changes because of the extra
>> Option<ProxyConfig> argument.
>> - proxmox-acme-api adds the proxmox-http dependency to the impl feature
>>
>> [0] https://bugzilla.proxmox.com/show_bug.cgi?id=6173
>> [1] https://github.com/letsencrypt/pebble
>> [2] https://tinyproxy.github.io/
> 
> Thanks for the patches, changes look okay to me and work as stated.
> 
> But there are two things which are worth improving upon:
> - Allowing the user to opt-in or opt-out from using the proxy: How to 
> approach this best might however be discussed first to be in line with 
> PVE as well, where this is still an open issue AFAICS [0].
> - Log in the task log that the node's http proxy is being used for 
> connection: This might help users discover issues more easily. Ideally 
> this would also be shown as additional error context when connection to 
> the proxy fails, e.g. when adding an new ACME account, instead of the 
> rather limited `client error (Connect) (400)`
> 
> [0] https://lore.proxmox.com/pve-devel/20240228112412.3982-1- 
> h.laimer@proxmox.com/

Hi Christian, thanks for the review and testing!
Regarding (1), I will check on this and align this with PVE.
For (2), I also see that a task log entry would be very helpful,
will add this as part of the v2.