[PATCH installer v3 28/38] assistant: support adding an authorization token for HTTP-based answers

Christoph Heiss
2026-04-03T16:56:47Z

If '--answer-auth-token <token-name>:<token-secret>' is passed, the
token will be saved to the internal auto-installer HTTP settings.

The `HttpOptions` is not marked with `deny_unknown_fields`, so adding an
additional field is also backwards-compatible.

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
Changes v2 -> v3:
* new patch

proxmox-auto-install-assistant/src/main.rs | 18 ++++++++++++++++++
proxmox-auto-installer/src/utils.rs | 2 ++
proxmox-fetch-answer/src/main.rs | 1 +
3 files changed, 21 insertions(+)

diff --git a/proxmox-auto-install-assistant/src/main.rs b/proxmox-auto-install-assistant/src/main.rs
index 22a8e39..901ab81 100644
--- a/proxmox-auto-install-assistant/src/main.rs
+++ b/proxmox-auto-install-assistant/src/main.rs
@@ -271,6 +271,13 @@ struct CommandPrepareISOArgs {
///
/// Implies '--pxe'.
pxe_loader: Option<PxeLoader>,
+
+ /// Only useful in combination with '--fetch-from http'. Token the automated installer should
+ /// use for retrieving an answer file.
+ ///
+ /// If set, the automated installer will include an 'Authorization' header in the HTTP POST
+ /// for retrieving the answer, in the format 'Authorization: ProxmoxInstallerToken <TOKEN>'.
+ answer_auth_token: Option<String>,
}

impl cli::Subcommand for CommandPrepareISOArgs {
@@ -290,6 +297,7 @@ impl cli::Subcommand for CommandPrepareISOArgs {
on_first_boot: args.opt_value_from_str("--on-first-boot")?,
pxe: args.contains("--pxe") || pxe_loader.is_some(),
pxe_loader,
+ answer_auth_token: args.opt_value_from_str("--answer-auth-token")?,
// Needs to be last
input: args.free_from_str()?,
})
@@ -382,6 +390,15 @@ OPTIONS:

Implies '--pxe'.

+ --answer-auth-token <TOKEN>
+ Only useful in combination with '--fetch-from http'. Token the automated installer should
+ use for retrieving an answer file.
+
+ <TOKEN> must be of format '<name>:<secret>'.
+
+ If set, the automated installer will include an 'Authorization' header in the HTTP POST
+ for retrieving the answer, in the format 'Authorization: ProxmoxInstallerToken <TOKEN>'.
+
-h, --help Print this help
-V, --version Print version
"#,
@@ -744,6 +761,7 @@ fn prepare_iso(args: &CommandPrepareISOArgs) -> Result<()> {
http: HttpOptions {
url: args.url.clone(),
cert_fingerprint: args.cert_fingerprint.clone(),
+ token: args.answer_auth_token.clone(),
},
};
let mut instmode_file_tmp = tmp_base.clone();
diff --git a/proxmox-auto-installer/src/utils.rs b/proxmox-auto-installer/src/utils.rs
index 884a08e..09b3408 100644
--- a/proxmox-auto-installer/src/utils.rs
+++ b/proxmox-auto-installer/src/utils.rs
@@ -131,6 +131,8 @@ pub struct HttpOptions {
pub url: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub cert_fingerprint: Option<String>,
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub token: Option<String>,
}

#[derive(Deserialize, Serialize, Debug)]
diff --git a/proxmox-fetch-answer/src/main.rs b/proxmox-fetch-answer/src/main.rs
index c599bef..18b27e7 100644
--- a/proxmox-fetch-answer/src/main.rs
+++ b/proxmox-fetch-answer/src/main.rs
@@ -98,6 +98,7 @@ fn settings_from_cli_args(args: &[String]) -> Result<AutoInstSettings> {
http: HttpOptions {
url: args.get(2).cloned(),
cert_fingerprint: args.get(3).cloned(),
+ token: None,
},
})
}
--
2.53.0