[PATCH datacenter-manager v2 0/4] fix #7179: expose ACME commands inside admin CLI

[PATCH datacenter-manager v2 0/4] fix #7179: expose ACME commands inside admin CLI

[Shan Shaji]

Previously, ACME commands were not exposed through the admin CLI.
Added the necessary functionality to manage ACME settings directly
via the command line. The changes are done by taking reference from 
the proxmox-backup codebase. 

The `tasklog_pbs` function in the `proxmox-log` crate has been renamed 
in the following patch [1]. To test the changes introduced by 
this series, it must be applied.

**note**: The completions were not working in general. Investigating it
seperately. 

changes since v1: Thanks @Lukas
- fixed formating.
- refactor the input prompt into a seperate method - `read_input`. 
- defined a new struct ``AcmeRegistrationParams` and update the API
  method signature to accept only one parameter.
- used the API `register_account` method instead of using the
  `proxmox-acme-api::register_account` function. 
- added `tasklog` layer to capture worker task logs. 
- added `context` method to preserve the error messages. 

Testing 
=======

In general i have verified the following commands ie:
- account (deactivate, info, list, update)
- certificate (order, revoke)
- plugin (add, config, list, remove, set)
- Verified external account binding using google's ACME directory 
  url and public CA (GTS). 

### Certifcate Creation 

http-01 challenge:
-----------------

I have tested the http-01 challenge verification using a test
pebble server. 
    
Steps followed to test the changes:

1. Installed the changes inside a PDM VM. 
2. install Pebble from Let's Encrypt [2] on the same VM:

    cd
    apt update
    apt install -y golang git
    git clone https://github.com/letsencrypt/pebble
    cd pebble
    go build ./cmd/pebble

    then, download and trust the Pebble cert:

    wget https://raw.githubusercontent.com/letsencrypt/pebble/main/test/certs/pebble.minica.pem
    cp pebble.minica.pem /usr/local/share/ca-certificates/pebble.minica.crt
    update-ca-certificates

3. We want Pebble to perform HTTP-01 validation against port 80, because
   PDM's standalone plugin will bind port 80. Set httpPort to 80.

    nano ./test/config/pebble-config.json

4. Start the Pebble server in the background:

    ./pebble -config ./test/config/pebble-config.json &

5. Created a Pebble ACME account:

    proxmox-datacenter-manager-admin acme account register default admin@example.com --directory 'https://127.0.0.1:14000/dir'

6. Added a new ACME domain pdm.proxmox.com with HTTP challenge type. Then
   ran the following command.

   proxmox-datacenter-manager admin acme certificate order --force true

7. Checked if the certificate is validated by the pebble CA. 

Ran the revoke command and verified if the certificate is self-signed
after force refresh. 

---

DNS-01 challenge: 
----------------

I tested the changes with my domain using the cloudflare plugin. 

Steps followed to test the changes:

1. Created an ACME account using let's encrypt staging API. 
2. Add a new plugin using the following command

   proxmox-datacenter-manager-admin acme plugin add dns cloudflare --api cf --data ./cf_tokens 
   cf_tokens had the following credentials:

      - CF_Account_ID=""
      - CF_Token=""

3. Added my cloudflare managed domain under ACME Domains using the UI. 
4. Ordered the certificate using the following command. 

    proxmox-datacenter-manager-admin acme certificate order --force true

5. Force refreshed the browser and verified that the new certificate is
   verified by (STAGING) Let's Encrypt

6. Revoked the certificate using the following command. 

	proxmox-datacenter-manager-admin acme certificate revoke

7. Verified the new certificate is self-signed.

[1] - https://lore.proxmox.com/pdm-devel/20260128135457.245662-2-s.shaji@proxmox.com/
[2] - https://github.com/letsencrypt/pebble


Shan Shaji (4):
  cli: admin: make cli handling async
  api: acme: define API type for ACME registration parameters
  fix #7179: cli: admin: expose acme commands
  chore: update proxmox-acme version to 1

 Cargo.toml                    |   2 +-
 cli/admin/Cargo.toml          |   7 +-
 cli/admin/src/acme.rs         | 445 ++++++++++++++++++++++++++++++++++
 cli/admin/src/main.rs         |  57 +++--
 lib/pdm-api-types/src/acme.rs |  65 +++++
 lib/pdm-api-types/src/lib.rs  |   2 +
 server/src/api/config/acme.rs |  48 ++--
 7 files changed, 574 insertions(+), 52 deletions(-)
 create mode 100644 cli/admin/src/acme.rs
 create mode 100644 lib/pdm-api-types/src/acme.rs

-- 
2.47.3

[PATCH datacenter-manager v2 1/4] cli: admin: make cli handling async

[Shan Shaji]

The acme API methods internally create workers to process API requests.
An error was thrown if the methods invoked without initializing the
worker tasks.

Since `init_worker_tasks` needs to be called from an async runtime.
Moved the content of the main function to async `run` function and
wrapped using `proxmox_async::runtime::main`, which creates a Tokio
runtime.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 changes since v1:
 - use `tasklog` function to capture worker task logs to the tasklog
   file. 
 - add `context` method to preserve the error messages. 

 cli/admin/Cargo.toml  |  3 +++
 cli/admin/src/main.rs | 53 ++++++++++++++++++++++++++++---------------
 2 files changed, 38 insertions(+), 18 deletions(-)

diff --git a/cli/admin/Cargo.toml b/cli/admin/Cargo.toml
index 0dec423..e566b39 100644
--- a/cli/admin/Cargo.toml
+++ b/cli/admin/Cargo.toml
@@ -19,6 +19,9 @@ proxmox-product-config.workspace = true
 proxmox-router = { workspace = true, features = [ "cli" ], default-features = false }
 proxmox-schema = { workspace = true, features = [ "api-macro" ] }
 proxmox-access-control.workspace = true
+proxmox-rest-server.workspace = true
+proxmox-sys.workspace = true
+proxmox-daemon.workspace = true
 
 pdm-api-types.workspace = true
 pdm-config.workspace = true
diff --git a/cli/admin/src/main.rs b/cli/admin/src/main.rs
index f698fa2..02148e3 100644
--- a/cli/admin/src/main.rs
+++ b/cli/admin/src/main.rs
@@ -1,35 +1,33 @@
+use anyhow::{Context, Error};
 use serde_json::{json, Value};
 
 use proxmox_router::cli::{
-    default_table_format_options, format_and_print_result_full, get_output_format, run_cli_command,
-    CliCommand, CliCommandMap, CliEnvironment, ColumnConfig, OUTPUT_FORMAT,
+    default_table_format_options, format_and_print_result_full, get_output_format,
+    run_async_cli_command, CliCommand, CliCommandMap, CliEnvironment, ColumnConfig, OUTPUT_FORMAT,
 };
 use proxmox_router::RpcEnvironment;
-
 use proxmox_schema::api;
+use proxmox_sys::fs::CreateOptions;
 
 mod remotes;
 mod support_status;
 
-fn main() {
-    //pbs_tools::setup_libc_malloc_opts(); // TODO: move from PBS to proxmox-sys and uncomment
-
-    let api_user = pdm_config::api_user().expect("cannot get api user");
-    let priv_user = pdm_config::priv_user().expect("cannot get privileged user");
-    proxmox_product_config::init(api_user, priv_user);
+async fn run() -> Result<(), Error> {
+    let api_user = pdm_config::api_user().context("could not get api user")?;
+    let priv_user = pdm_config::priv_user().context("could not get privileged user")?;
 
+    proxmox_product_config::init(api_user.clone(), priv_user);
     proxmox_access_control::init::init(
         &pdm_api_types::AccessControlConfig,
         pdm_buildcfg::configdir!("/access"),
     )
-    .expect("failed to setup access control config");
-
+    .context("failed to setup access control config")?;
     proxmox_log::Logger::from_env("PDM_LOG", proxmox_log::LevelFilter::INFO)
         .stderr()
         .init()
-        .expect("failed to set up logger");
+        .context("failed to set-up logger")?;
 
-    server::context::init().expect("could not set up server context");
+    server::context::init().context("could not set-up server context")?;
 
     let cmd_def = CliCommandMap::new()
         .insert("remote", remotes::cli())
@@ -40,14 +38,33 @@ fn main() {
         .insert("support-status", support_status::cli())
         .insert("versions", CliCommand::new(&API_METHOD_GET_VERSIONS));
 
+    let args: Vec<String> = std::env::args().collect();
+    let avoid_init = args.len() >= 2 && (args[1] == "bashcomplete" || args[1] == "printdoc");
+
+    if !avoid_init {
+        let file_opts = CreateOptions::new().owner(api_user.uid).group(api_user.gid);
+        proxmox_rest_server::init_worker_tasks(pdm_buildcfg::PDM_LOG_DIR_M!().into(), file_opts)
+            .context("failed to initialize worker tasks")?;
+
+        let mut command_sock = proxmox_daemon::command_socket::CommandSocket::new(api_user.gid);
+        proxmox_rest_server::register_task_control_commands(&mut command_sock)
+            .context("failed to register task control commands")?;
+        command_sock
+            .spawn(proxmox_rest_server::last_worker_future())
+            .context("failed to activate the socket")?;
+    }
+
     let mut rpcenv = CliEnvironment::new();
     rpcenv.set_auth_id(Some("root@pam".into()));
 
-    run_cli_command(
-        cmd_def,
-        rpcenv,
-        Some(|future| proxmox_async::runtime::main(future)),
-    );
+    run_async_cli_command(cmd_def, rpcenv).await;
+
+    Ok(())
+}
+
+fn main() -> Result<(), Error> {
+    //pbs_tools::setup_libc_malloc_opts(); // TODO: move from PBS to proxmox-sys and uncomment
+    proxmox_async::runtime::main(run())
 }
 
 #[api(
-- 
2.47.3

[PATCH datacenter-manager v1 2/4] api: acme: define API type for ACME registration parameters

[Shan Shaji]

Earlier, the ACME CLI was using the proxmox-acme-api crate's register
function to register an ACME account. Since it did not create a worker
task internally, the logs were not being recorded in the task log file.

The API handler function accepts a Value type, inorder to pass the
parameters from the CLI it had to be converted into a Value type.
Defined a new struct to create the request parameters. This also makes
sure that even if additional parameters are added later, they
are not forgotten in the CLI tool.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---

 note: This is a new patch.

 lib/pdm-api-types/src/acme.rs | 65 +++++++++++++++++++++++++++++++++++
 lib/pdm-api-types/src/lib.rs  |  2 ++
 server/src/api/config/acme.rs | 48 ++++++++------------------
 3 files changed, 82 insertions(+), 33 deletions(-)
 create mode 100644 lib/pdm-api-types/src/acme.rs

diff --git a/lib/pdm-api-types/src/acme.rs b/lib/pdm-api-types/src/acme.rs
new file mode 100644
index 0000000..e5fc197
--- /dev/null
+++ b/lib/pdm-api-types/src/acme.rs
@@ -0,0 +1,65 @@
+use serde::{Deserialize, Serialize};
+
+use proxmox_acme_api::AcmeAccountName;
+use proxmox_schema::{api, ApiStringFormat, ArraySchema, Schema, StringSchema};
+
+use crate::EMAIL_SCHEMA;
+
+pub const ACME_CONTACT_LIST_SCHEMA: Schema =
+    StringSchema::new("List of email addresses, comma seperated.")
+        .format(&ApiStringFormat::PropertyString(
+            &ArraySchema::new("Contact list.", &EMAIL_SCHEMA).schema(),
+        ))
+        .schema();
+
+#[api(
+    properties: {
+        name: {
+            type: AcmeAccountName,
+            optional: true,
+        },
+        contact: {
+            schema: ACME_CONTACT_LIST_SCHEMA
+        },
+        tos_url: {
+            type: String,
+            description: "URL of CA TermsOfService - setting this indicates agreement.",
+            optional: true,
+        },
+        directory: {
+            type: String,
+            description: "The ACME Directory.",
+            optional: true,
+        },
+        eab_kid: {
+            type: String,
+            description: "Key Identifier for External Account Binding.",
+            optional: true,
+        },
+        eab_hmac_key: {
+            type: String,
+            description: "HMAC Key for External Account Binding.",
+            optional: true,
+        }
+    },
+)]
+#[derive(Serialize, Deserialize)]
+/// ACME account registration properties.
+pub struct AcmeRegistrationParams {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<AcmeAccountName>,
+
+    pub contact: String,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tos_url: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub directory: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub eab_kid: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub eab_hmac_key: Option<String>,
+}
diff --git a/lib/pdm-api-types/src/lib.rs b/lib/pdm-api-types/src/lib.rs
index 5daaa3f..b69e99f 100644
--- a/lib/pdm-api-types/src/lib.rs
+++ b/lib/pdm-api-types/src/lib.rs
@@ -116,6 +116,8 @@ pub mod sdn;
 
 pub mod views;
 
+pub mod acme;
+
 const_regex! {
     // just a rough check - dummy acceptor is used before persisting
     pub OPENSSL_CIPHERS_REGEX = r"^[0-9A-Za-z_:, +!\-@=.]+$";
diff --git a/server/src/api/config/acme.rs b/server/src/api/config/acme.rs
index 0c583c4..3c40a27 100644
--- a/server/src/api/config/acme.rs
+++ b/server/src/api/config/acme.rs
@@ -1,5 +1,6 @@
 use anyhow::Error;
 
+use pdm_api_types::acme::AcmeRegistrationParams;
 use proxmox_router::list_subdirs_api_method;
 use proxmox_router::{Router, RpcEnvironment, SubdirMap};
 
@@ -79,31 +80,9 @@ pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
 #[api(
     input: {
         properties: {
-            name: {
-                type: AcmeAccountName,
-                optional: true,
-            },
-            contact: {
-                description: "List of email addresses.",
-            },
-            tos_url: {
-                description: "URL of CA TermsOfService - setting this indicates agreement.",
-                optional: true,
-            },
-            directory: {
-                type: String,
-                description: "The ACME Directory.",
-                optional: true,
-            },
-            eab_kid: {
-                type: String,
-                description: "Key Identifier for External Account Binding.",
-                optional: true,
-            },
-            eab_hmac_key: {
-                type: String,
-                description: "HMAC Key for External Account Binding.",
-                optional: true,
+            params: {
+                type: AcmeRegistrationParams,
+                flatten: true
             }
         },
     },
@@ -116,16 +95,19 @@ pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
     },
 )]
 /// Register an ACME account.
-fn register_account(
-    name: Option<AcmeAccountName>,
-    // Todo: email & email-list schema
-    contact: String,
-    tos_url: Option<String>,
-    directory: Option<String>,
-    eab_kid: Option<String>,
-    eab_hmac_key: Option<String>,
+pub fn register_account(
+    params: AcmeRegistrationParams,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<String, Error> {
+    let AcmeRegistrationParams {
+        name,
+        contact,
+        tos_url,
+        directory,
+        eab_kid,
+        eab_hmac_key,
+    } = params;
+
     let auth_id = rpcenv.get_auth_id().unwrap();
     let name = name.unwrap_or_else(|| unsafe {
         AcmeAccountName::from_string_unchecked("default".to_string())
-- 
2.47.3

[PATCH datacenter-manager v2 3/4] fix #7179: cli: admin: expose acme commands

[Shan Shaji]

Previously, ACME commands were not exposed through the admin CLI.
Added the necessary functionality to manage ACME settings directly
via the command line.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---

changes since v1:
 - Fix formatting. 
 - Use API register_account method instead of the proxmox-acme-api
   crate's register_account method to register ACME account. 
-  add `read_input` helper function. 

 cli/admin/Cargo.toml  |   4 +-
 cli/admin/src/acme.rs | 445 ++++++++++++++++++++++++++++++++++++++++++
 cli/admin/src/main.rs |   6 +
 3 files changed, 454 insertions(+), 1 deletion(-)
 create mode 100644 cli/admin/src/acme.rs

diff --git a/cli/admin/Cargo.toml b/cli/admin/Cargo.toml
index e566b39..01afc88 100644
--- a/cli/admin/Cargo.toml
+++ b/cli/admin/Cargo.toml
@@ -22,7 +22,9 @@ proxmox-access-control.workspace = true
 proxmox-rest-server.workspace = true
 proxmox-sys.workspace = true
 proxmox-daemon.workspace = true
-
+proxmox-acme.workspace = true
+proxmox-acme-api.workspace = true
+proxmox-base64.workspace = true
 pdm-api-types.workspace = true
 pdm-config.workspace = true
 pdm-buildcfg.workspace = true
diff --git a/cli/admin/src/acme.rs b/cli/admin/src/acme.rs
new file mode 100644
index 0000000..be442cd
--- /dev/null
+++ b/cli/admin/src/acme.rs
@@ -0,0 +1,445 @@
+use std::io::Write;
+
+use anyhow::{bail, Error};
+use serde_json::Value;
+
+use pdm_api_types::acme::AcmeRegistrationParams;
+use proxmox_acme::async_client::AcmeClient;
+use proxmox_acme_api::{completion::*, AcmeAccountName, DnsPluginCore, KNOWN_ACME_DIRECTORIES};
+use proxmox_rest_server::wait_for_local_worker;
+use proxmox_router::{cli::*, ApiHandler, RpcEnvironment};
+use proxmox_schema::api;
+use proxmox_sys::fs::file_get_contents;
+
+use server::api as dc_api;
+
+pub fn acme_mgmt_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("account", account_cli())
+        .insert("plugin", plugin_cli())
+        .insert("certificate", cert_cli());
+
+    cmd_def.into()
+}
+
+#[api(
+    input: {
+        properties: {
+                "output-format": {
+                    schema: OUTPUT_FORMAT,
+                    optional: true,
+                }
+            }
+    }
+)]
+/// List ACME accounts.
+fn list_accounts(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+    let info = &dc_api::config::acme::API_METHOD_LIST_ACCOUNTS;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options();
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            name: { type:  AcmeAccountName },
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+        }
+    }
+)]
+/// Show ACME account information.
+async fn get_account(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+
+    let info = &dc_api::config::acme::API_METHOD_GET_ACCOUNT;
+    let mut data = match info.handler {
+        ApiHandler::Async(handler) => (handler)(param, info, rpcenv).await?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options()
+        .column(
+            ColumnConfig::new("account")
+                .renderer(|value, _record| Ok(serde_json::to_string_pretty(value)?)),
+        )
+        .column(ColumnConfig::new("directory"))
+        .column(ColumnConfig::new("location"))
+        .column(ColumnConfig::new("tos"));
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+fn read_input(prompt: &str) -> Result<String, Error> {
+    print!("{}: ", prompt);
+    std::io::stdout().flush()?;
+    let mut input = String::new();
+    std::io::stdin().read_line(&mut input)?;
+    Ok(input)
+}
+
+#[api(
+    input: {
+        properties: {
+            name: { type: AcmeAccountName },
+            contact: {
+                description: "List of email addresses.",
+                type: String,
+            },
+            directory: {
+                type: String,
+                description: "The ACME Directory.",
+                optional: true,
+            },
+        }
+    }
+)]
+///Register an ACME account.
+async fn register_account(
+    name: AcmeAccountName,
+    contact: String,
+    directory: Option<String>,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let (directory_url, custom_directory) = match directory {
+        Some(directory) => (directory, true),
+        None => {
+            println!("Directory endpoints:");
+            for (i, dir) in KNOWN_ACME_DIRECTORIES.iter().enumerate() {
+                println!("{}) {}", i, dir.url);
+            }
+
+            println!("{}) Custom", KNOWN_ACME_DIRECTORIES.len());
+            let mut attempt = 0;
+            loop {
+                let mut input = read_input("Enter selection")?;
+                match input.trim().parse::<usize>() {
+                    Ok(n) if n < KNOWN_ACME_DIRECTORIES.len() => {
+                        break (KNOWN_ACME_DIRECTORIES[n].url.to_string(), false);
+                    }
+                    Ok(n) if n == KNOWN_ACME_DIRECTORIES.len() => {
+                        input.clear();
+                        input = read_input("Enter custom directory URI")?;
+                        break (input.trim().to_owned(), true);
+                    }
+                    _ => eprintln!("Invalid selection."),
+                }
+
+                attempt += 1;
+                if attempt >= 3 {
+                    bail!("Aborting.");
+                }
+            }
+        }
+    };
+
+    println!("Attempting to fetch Terms of Service from {directory_url:?}");
+    let mut client = AcmeClient::new(directory_url.clone());
+    let directory = client.directory().await?;
+    let tos_agreed = if let Some(tos_url) = directory.terms_of_service_url() {
+        println!("Terms of Service: {tos_url}");
+        let input = read_input("Do you agree to the above terms? [y|N]")?;
+        input.trim().eq_ignore_ascii_case("y")
+    } else {
+        println!("No Terms of Service found, proceeding.");
+        true
+    };
+
+    let mut eab_enabled = directory.external_account_binding_required();
+    if !eab_enabled && custom_directory {
+        let input = read_input("Do you want to use external account binding? [y|N]")?;
+        eab_enabled = input.trim().eq_ignore_ascii_case("y");
+    } else if eab_enabled {
+        println!("The CA requires external account binding.");
+    }
+
+    let eab_creds = if eab_enabled {
+        println!("You should have received a key id and a key from your CA.");
+        let eab_kid = read_input("Enter EAB key id")?;
+        let eab_hmac_key = read_input("Enter EAB key")?;
+        Some((eab_kid.trim().to_owned(), eab_hmac_key.trim().to_owned()))
+    } else {
+        None
+    };
+
+    let tos_url = tos_agreed
+        .then(|| directory.terms_of_service_url().map(str::to_owned))
+        .flatten();
+
+    let (eab_kid, eab_hmac_key) = eab_creds.unzip();
+    let parameters = AcmeRegistrationParams {
+        name: Some(name),
+        contact: contact,
+        tos_url: tos_url,
+        directory: Some(directory_url),
+        eab_kid: eab_kid,
+        eab_hmac_key: eab_hmac_key,
+    };
+    let param = serde_json::to_value(parameters)?;
+
+    let info = &dc_api::config::acme::API_METHOD_REGISTER_ACCOUNT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+#[api(
+    input: {
+       properties: {
+           name: { type: AcmeAccountName },
+           contact:  {
+               description: "List of email addresses.",
+               type: String,
+               optional: true,
+           }
+       }
+    }
+)]
+/// Update an ACME Account.
+async fn update_account(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let info = &dc_api::config::acme::API_METHOD_UPDATE_ACCOUNT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            name: { type: AcmeAccountName },
+            force: {
+                description: "Delete account data even if the server refuses to deactivate the account.",
+                type: Boolean,
+                optional: true,
+                default: true,
+            }
+        }
+    }
+)]
+/// Deactivate an ACME account.
+async fn deactivate_account(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let info = &dc_api::config::acme::API_METHOD_DEACTIVATE_ACCOUNT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+fn account_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("list", CliCommand::new(&API_METHOD_LIST_ACCOUNTS))
+        .insert(
+            "register",
+            CliCommand::new(&API_METHOD_REGISTER_ACCOUNT).arg_param(&["name", "contact"]),
+        )
+        .insert(
+            "deactivate",
+            CliCommand::new(&API_METHOD_DEACTIVATE_ACCOUNT)
+                .arg_param(&["name"])
+                .completion_cb("name", complete_acme_account),
+        )
+        .insert(
+            "info",
+            CliCommand::new(&API_METHOD_GET_ACCOUNT)
+                .arg_param(&["name"])
+                .completion_cb("name", complete_acme_account),
+        )
+        .insert(
+            "update",
+            CliCommand::new(&API_METHOD_UPDATE_ACCOUNT)
+                .arg_param(&["name", "contact"])
+                .completion_cb("name", complete_acme_account),
+        );
+
+    cmd_def.into()
+}
+
+#[api(
+    input: {
+        properties: {
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+        }
+    }
+)]
+/// List ACME plugins.
+fn list_plugins(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+
+    let info = &dc_api::config::acme::API_METHOD_LIST_PLUGINS;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options();
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            id: {
+                type: String,
+                description: "Plugin ID",
+            },
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+        }
+    }
+)]
+/// Show ACME plugin information.
+fn get_plugin(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+
+    let info = &dc_api::config::acme::API_METHOD_GET_PLUGIN;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options();
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+#[api(input: {
+    properties: {
+        type: {
+            type: String,
+            description: "The ACME challenge plugin type."
+        },
+        core: {
+            type: DnsPluginCore,
+            flatten: true,
+        },
+        data: {
+            type: String,
+            description: "File containing the plugin data."
+        }
+    }
+})]
+/// Add ACME plugin configuration.
+fn add_plugin(r#type: String, core: DnsPluginCore, data: String) -> Result<(), Error> {
+    let data = proxmox_base64::encode(file_get_contents(data)?);
+    dc_api::config::acme::add_plugin(r#type, core, data)?;
+    Ok(())
+}
+
+pub fn plugin_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("list", CliCommand::new(&API_METHOD_LIST_PLUGINS))
+        .insert(
+            "config",
+            CliCommand::new(&API_METHOD_GET_PLUGIN)
+                .arg_param(&["id"])
+                .completion_cb("id", complete_acme_plugin),
+        )
+        .insert(
+            "add",
+            CliCommand::new(&API_METHOD_ADD_PLUGIN)
+                .arg_param(&["type", "id"])
+                .completion_cb("api", complete_acme_api_challenge_type)
+                .completion_cb("type", complete_acme_plugin_type),
+        )
+        .insert(
+            "remove",
+            CliCommand::new(&dc_api::config::acme::API_METHOD_DELETE_PLUGIN)
+                .arg_param(&["id"])
+                .completion_cb("id", complete_acme_plugin),
+        )
+        .insert(
+            "set",
+            CliCommand::new(&dc_api::config::acme::API_METHOD_UPDATE_PLUGIN)
+                .arg_param(&["id"])
+                .completion_cb("id", complete_acme_plugin),
+        );
+
+    cmd_def.into()
+}
+
+#[api(
+    input: {
+        properties: {
+            force: {
+                description: "Force renewal even if the certificate does not expire soon.",
+                type: Boolean,
+                optional: true,
+                default: false,
+            },
+        },
+    },
+)]
+/// Order a new ACME certificate.
+async fn order_acme_cert(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    if !param["force"].as_bool().unwrap_or(false)
+        && !dc_api::nodes::certificates::cert_expires_soon()?
+    {
+        println!("Certificate does not expire within the next 30 days, not renewing.");
+        return Ok(());
+    }
+
+    let info = &dc_api::nodes::certificates::API_METHOD_RENEW_ACME_CERT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+#[api]
+/// Revoke ACME certificate.
+async fn revoke_acme_cert(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let info = &dc_api::nodes::certificates::API_METHOD_REVOKE_ACME_CERT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+pub fn cert_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("order", CliCommand::new(&API_METHOD_ORDER_ACME_CERT))
+        .insert("revoke", CliCommand::new(&API_METHOD_REVOKE_ACME_CERT));
+
+    cmd_def.into()
+}
diff --git a/cli/admin/src/main.rs b/cli/admin/src/main.rs
index 02148e3..3fd3c2f 100644
--- a/cli/admin/src/main.rs
+++ b/cli/admin/src/main.rs
@@ -9,6 +9,7 @@ use proxmox_router::RpcEnvironment;
 use proxmox_schema::api;
 use proxmox_sys::fs::CreateOptions;
 
+mod acme;
 mod remotes;
 mod support_status;
 
@@ -22,7 +23,11 @@ async fn run() -> Result<(), Error> {
         pdm_buildcfg::configdir!("/access"),
     )
     .context("failed to setup access control config")?;
+    proxmox_acme_api::init(pdm_buildcfg::configdir!("/acme"), false)
+        .context("failed to initialize acme config")?;
+
     proxmox_log::Logger::from_env("PDM_LOG", proxmox_log::LevelFilter::INFO)
+        .tasklog()
         .stderr()
         .init()
         .context("failed to set-up logger")?;
@@ -30,6 +35,7 @@ async fn run() -> Result<(), Error> {
     server::context::init().context("could not set-up server context")?;
 
     let cmd_def = CliCommandMap::new()
+        .insert("acme", acme::acme_mgmt_cli())
         .insert("remote", remotes::cli())
         .insert(
             "report",
-- 
2.47.3

[PATCH datacenter-manager v2 4/4] chore: update proxmox-acme version to 1

[Shan Shaji]

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index ed9ce60..5c2de75 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ proxmox-upgrade-checks = "1"
 proxmox-uuid = "1"
 
 # other proxmox crates
-proxmox-acme = "0.5"
+proxmox-acme = "1.0"
 proxmox-openid = "1.0.2"
 
 # api implementation creates
-- 
2.47.3