[pdm-devel] [PATCH datacenter-manager 0/3] fix #7179: expose ACME commands inside admin CLI

[Shan Shaji <s.shaji@proxmox.com>]

Previously, ACME commands were not exposed through the admin CLI.
Added the necessary functionality to manage ACME settings directly
via the command line. The changes are done by taking reference from 
the proxmox-backup codebase. 

Since i am using the completion handlers from the proxmox-acme-api
crate the following patch [1] needs to be applied before testing or merging
the changes of this patch series. 

**note**: Sending this series only for an initial review as the completions
are not working and also to know if i have missed anything :). 

Testing 
=======

In general i have verified the following commands ie,
- account (deactivate, info, list, update)
- certificate (order, revoke)
- plugin (add, config, list, remove, set)

### Certifcate Creation 

http-01 challenge:
-----------------

I have tested the http-01 challenge verification using a test
pebble server. 
    
Steps followed to test the changes:

1. Installed the changes inside a PDM VM. 
2. install Pebble from Let's Encrypt [2] on the same VM:

    cd
    apt update
    apt install -y golang git
    git clone https://github.com/letsencrypt/pebble
    cd pebble
    go build ./cmd/pebble

then, download and trust the Pebble cert:

    wget https://raw.githubusercontent.com/letsencrypt/pebble/main/test/certs/pebble.minica.pem
    cp pebble.minica.pem /usr/local/share/ca-certificates/pebble.minica.crt
    update-ca-certificates

We want Pebble to perform HTTP-01 validation against port 80, because
PDM's standalone plugin will bind port 80. Set httpPort to 80.

    nano ./test/config/pebble-config.json

Start the Pebble server in the background:

    ./pebble -config ./test/config/pebble-config.json &

Created a Pebble ACME account:

    proxmox-datacenter-manager-admin acme account register default admin@example.com --directory 'https://127.0.0.1:14000/dir'

Added a new ACME domain pdm.proxmox.com with HTTP challenge type. Then
ran the following command.  
   
   proxmox-datacenter-manager admin acme certificate order --force true

Checked if the certificate is validated by the pebble CA. 

Ran the revoke command and verified if the certificate is self-signed
after force refresh. 

---

DNS-01 challenge: 
----------------

I tested the changes with my domain using the cloudflare plugin. 

Steps followed to test the changes:

1. Created an ACME account using let's encrypt staging API. 
2. Add a new plugin using the following command

   proxmox-datacenter-manager-admin acme plugin add dns cloudflare --api cf --data ./cf_tokens 
   cf_tokens had the following credentials:
      - CF_Account_ID=""
	  - CF_Token=""
3. Added my cloudflare managed domain under ACME Domains using the UI. 
4. Ordered the certificate using the following command. 

    proxmox-datacenter-manager-admin acme certificate order --force true

5. Force refreshed the browser and verified that the new certificate is
   verified by (STAGING) Let's Encrypt

6. Revoked the certificate using the following command. 
    
	proxmox-datacenter-manager-admin acme certificate revoke

7. Verified the new certificate is self-signed.

[1] - https://lore.proxmox.com/pbs-devel/20260116112859.194016-2-s.rufinatscha@proxmox.com/
[2] - https://github.com/letsencrypt/pebble


Shan Shaji (3):
  cli: admin: make cli handling async
  fix #7179: cli: admin: expose acme commands
  chore: update proxmox-acme to version 1

 Cargo.toml            |   2 +-
 cli/admin/Cargo.toml  |   7 +-
 cli/admin/src/acme.rs | 442 ++++++++++++++++++++++++++++++++++++++++++
 cli/admin/src/main.rs |  54 ++++--
 4 files changed, 484 insertions(+), 21 deletions(-)
 create mode 100644 cli/admin/src/acme.rs

-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel