From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id AAF171FF0B0 for ; Tue, 27 Oct 2026 15:54:44 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 3ACBF211FA; Tue, 27 Oct 2026 15:54:44 +0100 (CET) Message-ID: <16406423-0b43-4ddc-b0e6-8403980a05f8@proxmox.com> Date: Tue, 27 Oct 2026 15:54:34 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/4] fix #6173: acme: use the configured HTTP proxy To: Samuel Rufinatscha , pbs-devel@lists.proxmox.com References: <20261008153323.293158-1-s.rufinatscha@proxmox.com> Content-Language: en-US, de-DE From: Christian Ebner In-Reply-To: <20261008153323.293158-1-s.rufinatscha@proxmox.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793112875091 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.493 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 66CCKBN2YNRF56BOMENFVKK3PCR5DLAW X-Message-ID-Hash: 66CCKBN2YNRF56BOMENFVKK3PCR5DLAW X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 10/8/26 5:33 PM, Samuel Rufinatscha wrote: > ACME requests in PBS and PDM ignore the node's HTTP proxy setting and > fail when the CA is reachable only through a proxy [0]. > > Add optional proxy support to the shared ACME client and pass the node > proxy configuration to each operation that contacts the CA. > > Testing: > > Reproduced the issue on PBS 4.2 using Pebble [1] as the ACME server > and Tinyproxy [2] as the HTTP proxy configured in PBS. Added a firewall > rule to block direct access to Pebble while allowing connections through > Tinyproxy. Operations succeeded through the configured proxy. > > Tested for: > > (1) HTTP-01 and DNS-01, including proxies requiring > authentication. > (2) Automatic renewal using a short-lived Pebble certificate. > (3) Changed the HTTP proxy setting to a second Tinyproxy instance > without restarting the PBS services. The next ACME operations used > the new proxy. > (4) PDM was built against the shared libraries (only). > > Maintainer notes: > > - proxmox-acme-api has breaking changes because of the extra > Option argument. > - proxmox-acme-api adds the proxmox-http dependency to the impl feature > > [0] https://bugzilla.proxmox.com/show_bug.cgi?id=6173 > [1] https://github.com/letsencrypt/pebble > [2] https://tinyproxy.github.io/ Thanks for the patches, changes look okay to me and work as stated. But there are two things which are worth improving upon: - Allowing the user to opt-in or opt-out from using the proxy: How to approach this best might however be discussed first to be in line with PVE as well, where this is still an open issue AFAICS [0]. - Log in the task log that the node's http proxy is being used for connection: This might help users discover issues more easily. Ideally this would also be shown as additional error context when connection to the proxy fails, e.g. when adding an new ACME account, instead of the rather limited `client error (Connect) (400)` [0] https://lore.proxmox.com/pve-devel/20240228112412.3982-1-h.laimer@proxmox.com/