Re: [PATCH pve-mamager v4 2/3] api: apt: move proxy config to pmxcfs and symlink to it

[Jonas Theisen <j.theisen@proxmox.com>]

On 10/12/26 18:33, Thomas Lamprecht wrote:
> Am 12.10.26 um 16:57 schrieb Jonas Theisen:
>> The APT proxy config was written to /etc/apt/apt.conf.d/76pveproxy
>> only if a database update was triggered through the PVE tooling.
> But your change here still needs such a refresh (or after the next
> patch a change in proyy value) at least once per node, this is not
> activated immediately automatically.

After this patch would be applied only one more update through
the PVE tooling would be necessary, since after that the symlink
would be in place on all nodes.
With the symlink the patched update call to the datacenter options
would be enough since this also triggers an update of trhe proxy
config in the pmxcfs.
> typo: s/existance/existence/
>
>
> typo: s/unncessarry/unnecessary/
> typo: s/Updateing/Updating/

Will fix the typos, thanks!
>> still works and only issues a warning.
> But not if pmxcfs fails to start, which can make disaster recovery
> harder. I mean, sure if pmxcfs fails to start completely it's gonna
> be annoying either way, but still not a good excuse to add more
> coupling to core system configs here.

Alright then i'll rework this without relying on pmxcfs.
>> Note that files in /etc/pve are not readable for users outside the
>> www-data group, so APT invoked by such users will fail to read the
>> proxy config.
> But that's breaking existing unprivileged apt use cases then. Also
> cases where some nodes use a different proxy than others, bit of an
> odd edge case, but not nice to break, at least not as normal update
> during a stable release series.

Afaik, we currently do not support different proxies on different nodes
as the http_proxy config is on the datacenter level and the daily
database update job rewrites this config every time.
If we want to do that we would need to move this option to the node level.
> I'd rather skip this approach, at least in current form. A hook for
> apt that checks configured and setup proxy and warns on mismatch
> might be nicer here? If we really want to auto-apply it - which can
> be probably OK, I just did not got around to think it fully through
> - that hook could also do that and print a nice visible log line for
> when something was changed, making the admin updating aware of it.

I have already looked into the appropriate hook and will try to rework
this to make use of that in v5.