[PATCH datacenter-manager v3 16/38] config: add auto-installer configuration module

Christoph Heiss
2026-04-03T16:56:23Z

Provides some primitives for the auto-installer integration to save
state about

- individual installations (as plain JSON, as these aren't
configurations files) and
- prepared answer file configurations, as section config

The new files (including lock files) are placed under
`/etc/proxmox-datacenter-manager/autoinst`.

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
Changes v2 -> v3:
* added answer authentication token interface
* added separate type from `PreparedInstallationConfig` api type for
use with configuration, mapping maps to propertystrings
* moved state files to /var/lib/proxmox-datacenter-manager

Changes v1 -> v2:
* no changes

lib/pdm-buildcfg/src/lib.rs | 10 +
lib/pdm-config/Cargo.toml | 3 +
lib/pdm-config/src/auto_install.rs | 559 +++++++++++++++++++++++++++++
lib/pdm-config/src/lib.rs | 1 +
lib/pdm-config/src/setup.rs | 7 +
5 files changed, 580 insertions(+)
create mode 100644 lib/pdm-config/src/auto_install.rs

diff --git a/lib/pdm-buildcfg/src/lib.rs b/lib/pdm-buildcfg/src/lib.rs
index 9380972..734e95d 100644
--- a/lib/pdm-buildcfg/src/lib.rs
+++ b/lib/pdm-buildcfg/src/lib.rs
@@ -106,3 +106,13 @@ macro_rules! rundir {
concat!($crate::PDM_RUN_DIR_M!(), $subdir)
};
}
+
+/// Prepend the state directory to a file name.
+///
+/// This is a simply way to get the full path for files in `/var/lib/`.
+#[macro_export]
+macro_rules! statedir {
+ ($subdir:expr) => {
+ concat!($crate::PDM_STATE_DIR_M!(), $subdir)
+ };
+}
diff --git a/lib/pdm-config/Cargo.toml b/lib/pdm-config/Cargo.toml
index d39c2ad..17ca27e 100644
--- a/lib/pdm-config/Cargo.toml
+++ b/lib/pdm-config/Cargo.toml
@@ -12,6 +12,7 @@ nix.workspace = true
once_cell.workspace = true
openssl.workspace = true
serde.workspace = true
+serde_json.workspace = true

proxmox-config-digest = { workspace = true, features = [ "openssl" ] }
proxmox-http = { workspace = true, features = [ "http-helpers" ] }
@@ -23,5 +24,7 @@ proxmox-shared-memory.workspace = true
proxmox-simple-config.workspace = true
proxmox-sys = { workspace = true, features = [ "acl", "crypt", "timer" ] }
proxmox-acme-api.workspace = true
+proxmox-serde.workspace = true
+proxmox-network-types.workspace = true
pdm-api-types.workspace = true
pdm-buildcfg.workspace = true
diff --git a/lib/pdm-config/src/auto_install.rs b/lib/pdm-config/src/auto_install.rs
new file mode 100644
index 0000000..fe32d30
--- /dev/null
+++ b/lib/pdm-config/src/auto_install.rs
@@ -0,0 +1,559 @@
+//! Implements configuration for the auto-installer integration.
+
+use anyhow::{bail, Result};
+use std::collections::HashMap;
+
+use pdm_api_types::{
+ auto_installer::{AnswerAuthToken, Installation},
+ ConfigDigest,
+};
+use proxmox_product_config::{open_api_lockfile, replace_config, ApiLockGuard};
+use proxmox_section_config::typed::{ApiSectionDataEntry, SectionConfigData};
+
+use crate::auto_install::types::AnswerAuthTokenWrapper;
+
+pub const CONFIG_PATH: &str = pdm_buildcfg::configdir!("/autoinst");
+
+const PREPARED_CONF_FILE: &str = pdm_buildcfg::configdir!("/autoinst/prepared.cfg");
+const PREPARED_LOCK_FILE: &str = pdm_buildcfg::configdir!("/autoinst/.prepared.lock");
+
+const TOKENS_CONF_FILE: &str = pdm_buildcfg::configdir!("/autoinst/tokens.cfg");
+const TOKENS_SHADOW_FILE: &str = pdm_buildcfg::configdir!("/autoinst/tokens.shadow");
+const TOKENS_LOCK_FILE: &str = pdm_buildcfg::configdir!("/autoinst/.tokens.lock");
+
+const INSTALLATIONS_STATE_FILE: &str = pdm_buildcfg::statedir!("/automated-installations.json");
+const INSTALLATIONS_LOCK_FILE: &str = pdm_buildcfg::statedir!("/.automated-installations.lock");
+
+pub mod types {
+ use serde::{Deserialize, Serialize};
+ use std::{collections::BTreeMap, fmt::Debug};
+
+ use pdm_api_types::{
+ auto_installer::{
+ answer, AnswerAuthToken, DiskSelectionMode, PreparedInstallationConfig,
+ PREPARED_INSTALL_CONFIG_ID_SCHEMA,
+ },
+ CERT_FINGERPRINT_SHA256_SCHEMA, DISK_ARRAY_SCHEMA, HTTP_URL_SCHEMA,
+ PROXMOX_TOKEN_NAME_SCHEMA, SINGLE_LINE_COMMENT_FORMAT,
+ };
+ use proxmox_network_types::{api_types::IpAddr, Cidr};
+ use proxmox_schema::{api, ApiStringFormat, ApiType, PropertyString};
+
+ #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+ /// API wrapper for a [`BTreeMap`].
+ pub struct BTreeMapWrapper<T>(BTreeMap<String, T>);
+
+ impl<T> std::ops::Deref for BTreeMapWrapper<T> {
+ type Target = BTreeMap<String, T>;
+
+ fn deref(&self) -> &Self::Target {
+ &self.0
+ }
+ }
+
+ impl<T> std::ops::DerefMut for BTreeMapWrapper<T> {
+ fn deref_mut(&mut self) -> &mut Self::Target {
+ &mut self.0
+ }
+ }
+
+ impl<T: for<'de> Deserialize<'de> + Serialize> ApiType for BTreeMapWrapper<T> {
+ const API_SCHEMA: proxmox_schema::Schema =
+ proxmox_schema::ObjectSchema::new("Map of key-value pairs", &[])
+ .additional_properties(true)
+ .schema();
+ }
+
+ #[api(
+ "id-property": "id",
+ "id-schema": {
+ type: String,
+ description: "ID of prepared configuration for automated installations.",
+ min_length: 3,
+ max_length: 64
+ }
+ )]
+ #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
+ #[serde(rename_all = "kebab-case", tag = "type")]
+ /// Wrapper type for using [`PreparedInstallationConfig`] with
+ /// [`proxmox_schema::typed::SectionConfigData`].
+ pub enum PreparedInstallationSectionConfigWrapper {
+ PreparedConfig(PreparedInstallationSectionConfig),
+ }
+
+ #[api(
+ properties: {
+ id: {
+ schema: PREPARED_INSTALL_CONFIG_ID_SCHEMA,
+ },
+ "authorized-tokens": {
+ type: Array,
+ optional: true,
+ items: {
+ schema: PROXMOX_TOKEN_NAME_SCHEMA,
+ },
+ },
+ "is-default": {
+ optional: true,
+ },
+ "target-filter": {
+ type: String,
+ optional: true,
+ },
+ country: {
+ format: &ApiStringFormat::Pattern(&answer::COUNTRY_CODE_REGEX),
+ min_length: 2,
+ max_length: 2,
+ },
+ mailto: {
+ min_length: 2,
+ max_length: 256,
+ format: &SINGLE_LINE_COMMENT_FORMAT,
+ },
+ "root-ssh-keys": {
+ type: Array,
+ optional: true,
+ items: {
+ type: String,
+ description: "SSH public key.",
+ },
+ },
+ "netdev-filter": {
+ type: String,
+ optional: true,
+ },
+ filesystem: {
+ type: String,
+ },
+ "disk-mode": {
+ type: String,
+ },
+ "disk-list": {
+ schema: DISK_ARRAY_SCHEMA,
+ optional: true,
+ },
+ "disk-filter": {
+ type: String,
+ optional: true,
+ },
+ "post-hook-base-url": {
+ schema: HTTP_URL_SCHEMA,
+ optional: true,
+ },
+ "post-hook-cert-fp": {
+ schema: CERT_FINGERPRINT_SHA256_SCHEMA,
+ optional: true,
+ },
+ "template-counters": {
+ type: String,
+ optional: true,
+ },
+ },
+ )]
+ #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
+ #[serde(rename_all = "kebab-case")]
+ /// Configuration describing an automated installation.
+ ///
+ /// Certain fields support simple templating via [Handlebars]. Currently, following fields will
+ /// resolve handlebars expression upon instantiation of an answer:
+ ///
+ /// * `fqdn`
+ /// * `mailto`
+ /// * `cidr`
+ /// * `gateway`
+ /// * `dns
+ ///
+ /// [Handlebars]: https://handlebarsjs.com/guide/
+ pub struct PreparedInstallationSectionConfig {
+ pub id: String,
+
+ #[serde(default, skip_serializing_if = "Vec::is_empty")]
+ /// List of token IDs that are authoried to retrieve this answer.
+ pub authorized_tokens: Vec<String>,
+
+ /// Whether this is the default answer. There can only ever be one default answer.
+ /// `target_filter` below is ignored if this is `true`.
+ pub is_default: bool,
+
+ // Target filters
+ /// Map of filters for matching against a property in [`answer::fetch::AnswerFetchData`].
+ /// The keys are JSON Pointers as per [RFC6901], the values globs as accepted
+ /// by the [glob] crate.
+ ///
+ /// Used to check this configuration against incoming automated installation requests. If this
+ /// is unset, it will match any installation not matched "narrower" by other prepared
+ /// configurations, thus being the default.
+ ///
+ /// [RFC6901] https://datatracker.ietf.org/doc/html/rfc6901
+ /// [glob crate] https://docs.rs/glob/
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ pub target_filter: PropertyString<BTreeMapWrapper<String>>,
+
+ // Keys from [`answer::GlobalOptions`], adapted to better fit the API and model of the UI.
+ /// Country to use for apt mirrors.
+ pub country: String,
+ /// FQDN to set for the installed system. Only used if `use_dhcp_fqdn` is true.
+ ///
+ /// Supports templating via Handlebars.
+ /// The [`proxmox_network_types::fqdn::Fqdn`] type cannot be used here
+ /// because of that, as curly brackets are not valid in hostnames.
+ pub fqdn: String,
+ /// Whether to use the FQDN from the DHCP lease or the user-provided one.
+ pub use_dhcp_fqdn: bool,
+ /// Keyboard layout to set.
+ pub keyboard: answer::KeyboardLayout,
+ /// Mail address for `root@pam`.
+ ///
+ /// Supports templating via Handlebars.
+ pub mailto: String,
+ /// Timezone to set on the new system.
+ pub timezone: String,
+ /// Pre-hashed password to set for the `root` PAM account.
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub root_password_hashed: Option<String>,
+ /// Whether to reboot the machine if an error occurred during the
+ /// installation.
+ pub reboot_on_error: bool,
+ /// Action to take after the installation completed successfully.
+ pub reboot_mode: answer::RebootMode,
+ /// Newline-separated list of public SSH keys to set up for the `root` PAM account.
+ #[serde(default, skip_serializing_if = "Vec::is_empty")]
+ pub root_ssh_keys: Vec<String>,
+
+ // Keys from [`answer::NetworkConfig`], adapted to better fit the API and model of the UI.
+ /// Whether to use the network configuration from the DHCP lease or not.
+ pub use_dhcp_network: bool,
+ /// IP address and netmask if not using DHCP.
+ ///
+ /// Supports templating via Handlebars.
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub cidr: Option<Cidr>,
+ /// Gateway if not using DHCP.
+ ///
+ /// Supports templating via Handlebars.
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub gateway: Option<IpAddr>,
+ /// DNS server address if not using DHCP.
+ ///
+ /// Supports templating via Handlebars.
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub dns: Option<IpAddr>,
+ /// Filter for network devices, to select a specific management interface.
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ pub netdev_filter: PropertyString<BTreeMapWrapper<String>>,
+ /// Whether to enable network interface name pinning.
+ pub netif_name_pinning_enabled: bool,
+
+ /// Root filesystem options.
+ pub filesystem: PropertyString<answer::FilesystemOptions>,
+
+ /// Whether to use the fixed disk list or select disks dynamically by udev filters.
+ pub disk_mode: DiskSelectionMode,
+ /// List of raw disk identifiers to use for the root filesystem.
+ #[serde(default, skip_serializing_if = "Vec::is_empty")]
+ pub disk_list: Vec<String>,
+ /// Filter against udev properties to select the disks for the installation,
+ /// to allow dynamic selection of disks.
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ pub disk_filter: PropertyString<BTreeMapWrapper<String>>,
+ /// Whether it is enough that any filter matches on a disk or all given
+ /// filters must match to select a disk. Only used if `disk_list` is unset.
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub disk_filter_match: Option<answer::FilterMatch>,
+
+ /// Post installations hook base URL, i.e. host PDM is reachable as from
+ /// the target machine.
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub post_hook_base_url: Option<String>,
+ /// Post hook certificate fingerprint, if needed.
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub post_hook_cert_fp: Option<String>,
+
+ /// Key-value pairs of (auto-incrementing) counters.
+ #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+ pub template_counters: PropertyString<BTreeMapWrapper<i32>>,
+ }
+
+ impl TryFrom<PreparedInstallationConfig> for PreparedInstallationSectionConfig {
+ type Error = anyhow::Error;
+
+ fn try_from(conf: PreparedInstallationConfig) -> Result<Self, Self::Error> {
+ Ok(Self {
+ id: conf.id,
+ authorized_tokens: conf.authorized_tokens,
+ // target filter
+ is_default: conf.is_default,
+ target_filter: PropertyString::new(BTreeMapWrapper(conf.target_filter)),
+ // global options
+ country: conf.country,
+ fqdn: conf.fqdn,
+ use_dhcp_fqdn: conf.use_dhcp_fqdn,
+ keyboard: conf.keyboard,
+ mailto: conf.mailto,
+ timezone: conf.timezone,
+ root_password_hashed: conf.root_password_hashed,
+ reboot_on_error: conf.reboot_on_error,
+ reboot_mode: conf.reboot_mode,
+ root_ssh_keys: conf.root_ssh_keys,
+ // network options
+ use_dhcp_network: conf.use_dhcp_network,
+ cidr: conf.cidr,
+ gateway: conf.gateway,
+ dns: conf.dns,
+ netdev_filter: PropertyString::new(BTreeMapWrapper(conf.netdev_filter)),
+ netif_name_pinning_enabled: conf.netif_name_pinning_enabled,
+ // disk options
+ filesystem: PropertyString::new(conf.filesystem),
+ disk_mode: conf.disk_mode,
+ disk_list: conf.disk_list,
+ disk_filter: PropertyString::new(BTreeMapWrapper(conf.disk_filter)),
+ disk_filter_match: conf.disk_filter_match,
+ // post hook
+ post_hook_base_url: conf.post_hook_base_url,
+ post_hook_cert_fp: conf.post_hook_cert_fp,
+ // templating
+ template_counters: PropertyString::new(BTreeMapWrapper(conf.template_counters)),
+ })
+ }
+ }
+
+ impl TryFrom<PreparedInstallationConfig> for PreparedInstallationSectionConfigWrapper {
+ type Error = anyhow::Error;
+
+ fn try_from(conf: PreparedInstallationConfig) -> Result<Self, Self::Error> {
+ Ok(Self::PreparedConfig(conf.try_into()?))
+ }
+ }
+
+ impl TryInto<PreparedInstallationConfig> for PreparedInstallationSectionConfig {
+ type Error = anyhow::Error;
+
+ fn try_into(self) -> Result<PreparedInstallationConfig, Self::Error> {
+ Ok(PreparedInstallationConfig {
+ id: self.id,
+ authorized_tokens: self.authorized_tokens,
+ // target filter
+ is_default: self.is_default,
+ target_filter: self.target_filter.into_inner().0,
+ // global options
+ country: self.country,
+ fqdn: self.fqdn,
+ use_dhcp_fqdn: self.use_dhcp_fqdn,
+ keyboard: self.keyboard,
+ mailto: self.mailto,
+ timezone: self.timezone,
+ root_password_hashed: self.root_password_hashed,
+ reboot_on_error: self.reboot_on_error,
+ reboot_mode: self.reboot_mode,
+ root_ssh_keys: self.root_ssh_keys,
+ // network options
+ use_dhcp_network: self.use_dhcp_network,
+ cidr: self.cidr,
+ gateway: self.gateway,
+ dns: self.dns,
+ netdev_filter: self.netdev_filter.into_inner().0,
+ netif_name_pinning_enabled: self.netif_name_pinning_enabled,
+ // disk options
+ filesystem: self.filesystem.into_inner(),
+ disk_mode: self.disk_mode,
+ disk_list: self.disk_list,
+ disk_filter: self.disk_filter.into_inner().0,
+ disk_filter_match: self.disk_filter_match,
+ // post hook
+ post_hook_base_url: self.post_hook_base_url,
+ post_hook_cert_fp: self.post_hook_cert_fp,
+ // templating
+ template_counters: self.template_counters.into_inner().0,
+ })
+ }
+ }
+
+ impl TryInto<PreparedInstallationConfig> for PreparedInstallationSectionConfigWrapper {
+ type Error = anyhow::Error;
+
+ fn try_into(self) -> Result<PreparedInstallationConfig, Self::Error> {
+ let PreparedInstallationSectionConfigWrapper::PreparedConfig(conf) = self;
+ conf.try_into()
+ }
+ }
+
+ #[api(
+ "id-property": "id",
+ "id-schema": {
+ type: String,
+ description: "Access token name.",
+ min_length: 3,
+ max_length: 64,
+ },
+ )]
+ #[derive(Clone, Debug, PartialEq, Deserialize, Serialize)]
+ #[serde(rename_all = "kebab-case", tag = "type")]
+ /// Access token for authenticating against the /answer endpoint.
+ pub enum AnswerAuthTokenWrapper {
+ /// API-token (like).
+ AccessToken(AnswerAuthToken),
+ }
+
+ impl From<AnswerAuthTokenWrapper> for AnswerAuthToken {
+ fn from(value: AnswerAuthTokenWrapper) -> Self {
+ let AnswerAuthTokenWrapper::AccessToken(token) = value;
+ token
+ }
+ }
+
+ impl From<AnswerAuthToken> for AnswerAuthTokenWrapper {
+ fn from(value: AnswerAuthToken) -> Self {
+ AnswerAuthTokenWrapper::AccessToken(value)
+ }
+ }
+}
+
+pub fn installations_read_lock() -> Result<ApiLockGuard> {
+ open_api_lockfile(INSTALLATIONS_LOCK_FILE, None, false)
+}
+
+pub fn installations_write_lock() -> Result<ApiLockGuard> {
+ open_api_lockfile(INSTALLATIONS_LOCK_FILE, None, true)
+}
+
+pub fn read_installations() -> Result<(Vec<Installation>, ConfigDigest)> {
+ let content: serde_json::Value = serde_json::from_str(
+ &proxmox_sys::fs::file_read_optional_string(INSTALLATIONS_STATE_FILE)?
+ .unwrap_or_else(|| "[]".to_owned()),
+ )?;
+
+ let digest = proxmox_serde::json::to_canonical_json(&content).map(ConfigDigest::from_slice)?;
+ let data = serde_json::from_value(content)?;
+
+ Ok((data, digest))
+}
+
+/// Write lock must be already held.
+pub fn save_installations(config: &[Installation]) -> Result<()> {
+ let raw = serde_json::to_string(&config)?;
+ replace_config(INSTALLATIONS_STATE_FILE, raw.as_bytes())
+}
+
+pub fn prepared_answers_read_lock() -> Result<ApiLockGuard> {
+ open_api_lockfile(PREPARED_LOCK_FILE, None, false)
+}
+
+pub fn prepared_answers_write_lock() -> Result<ApiLockGuard> {
+ open_api_lockfile(PREPARED_LOCK_FILE, None, true)
+}
+
+pub fn read_prepared_answers() -> Result<(
+ SectionConfigData<types::PreparedInstallationSectionConfigWrapper>,
+ ConfigDigest,
+)> {
+ let content =
+ proxmox_sys::fs::file_read_optional_string(PREPARED_CONF_FILE)?.unwrap_or_default();
+
+ let digest = ConfigDigest::from_slice(content.as_bytes());
+ let data = types::PreparedInstallationSectionConfigWrapper::parse_section_config(
+ PREPARED_CONF_FILE,
+ &content,
+ )?;
+
+ Ok((data, digest))
+}
+
+/// Write lock must be already held.
+pub fn save_prepared_answers(
+ config: &SectionConfigData<types::PreparedInstallationSectionConfigWrapper>,
+) -> Result<()> {
+ let raw = types::PreparedInstallationSectionConfigWrapper::write_section_config(
+ PREPARED_CONF_FILE,
+ config,
+ )?;
+ replace_config(PREPARED_CONF_FILE, raw.as_bytes())
+}
+
+pub fn token_read_lock() -> Result<ApiLockGuard> {
+ open_api_lockfile(TOKENS_LOCK_FILE, None, false)
+}
+
+pub fn token_write_lock() -> Result<ApiLockGuard> {
+ open_api_lockfile(TOKENS_LOCK_FILE, None, true)
+}
+
+pub fn read_tokens() -> Result<(
+ SectionConfigData<types::AnswerAuthTokenWrapper>,
+ ConfigDigest,
+)> {
+ let content = proxmox_sys::fs::file_read_optional_string(TOKENS_CONF_FILE)?.unwrap_or_default();
+
+ let digest = ConfigDigest::from_slice(content.as_bytes());
+ let data = types::AnswerAuthTokenWrapper::parse_section_config(TOKENS_CONF_FILE, &content)?;
+
+ Ok((data, digest))
+}
+
+/// Write lock must be already held.
+pub fn add_token(token: &AnswerAuthToken, secret: &str) -> Result<()> {
+ let (mut auths, _) = read_tokens()?;
+
+ if auths.contains_key(&token.id.to_string()) {
+ bail!("token already exists");
+ }
+
+ let auth: AnswerAuthTokenWrapper = token.clone().into();
+ auths.insert(token.id.to_string(), auth);
+
+ let mut shadow = read_tokens_shadow()?;
+ let hashed = proxmox_sys::crypt::encrypt_pw(secret)?;
+ shadow.insert(token.id.clone(), hashed);
+ write_tokens_shadow(shadow)?;
+
+ write_tokens(auths)
+}
+
+/// Write lock must be already held.
+pub fn update_token(token: &AnswerAuthToken) -> Result<()> {
+ let (mut auths, _) = read_tokens()?;
+
+ let auth: AnswerAuthTokenWrapper = token.clone().into();
+ auths.insert(token.id.to_string(), auth);
+
+ write_tokens(auths)
+}
+
+/// Write lock must be already held.
+pub fn delete_token(id: &str) -> Result<()> {
+ let (mut tokens, _) = read_tokens()?;
+ tokens.remove(&id.to_string());
+
+ let mut shadow = read_tokens_shadow()?;
+ shadow.remove(id);
+ write_tokens_shadow(shadow)?;
+
+ write_tokens(tokens)
+}
+
+/// Write lock must be already held.
+fn write_tokens(data: SectionConfigData<types::AnswerAuthTokenWrapper>) -> Result<()> {
+ let raw = types::AnswerAuthTokenWrapper::write_section_config(TOKENS_CONF_FILE, &data)?;
+ replace_config(TOKENS_CONF_FILE, raw.as_bytes())
+}
+
+/// At least read lock must be held.
+pub fn verify_token_secret(id: &str, secret: &str) -> Result<()> {
+ let data = read_tokens_shadow()?;
+ match data.get(id) {
+ Some(hashed) => proxmox_sys::crypt::verify_crypt_pw(secret, hashed),
+ None => bail!("invalid access token"),
+ }
+}
+
+fn read_tokens_shadow() -> Result<HashMap<String, String>> {
+ Ok(serde_json::from_str(
+ &proxmox_sys::fs::file_read_optional_string(TOKENS_SHADOW_FILE)?
+ .unwrap_or_else(|| "{}".to_owned()),
+ )?)
+}
+
+/// Write lock must be already held.
+fn write_tokens_shadow(data: HashMap<String, String>) -> Result<()> {
+ let raw = serde_json::to_string(&data)?;
+ replace_config(TOKENS_SHADOW_FILE, raw.as_bytes())
+}
diff --git a/lib/pdm-config/src/lib.rs b/lib/pdm-config/src/lib.rs
index 4c49054..5b9bcca 100644
--- a/lib/pdm-config/src/lib.rs
+++ b/lib/pdm-config/src/lib.rs
@@ -2,6 +2,7 @@ use anyhow::{format_err, Error};
use nix::unistd::{Gid, Group, Uid, User};
pub use pdm_buildcfg::{BACKUP_GROUP_NAME, BACKUP_USER_NAME};

+pub mod auto_install;
pub mod certificate_config;
pub mod domains;
pub mod node;
diff --git a/lib/pdm-config/src/setup.rs b/lib/pdm-config/src/setup.rs
index 5f920c8..5adb05f 100644
--- a/lib/pdm-config/src/setup.rs
+++ b/lib/pdm-config/src/setup.rs
@@ -24,6 +24,13 @@ pub fn create_configdir() -> Result<(), Error> {
0o750,
)?;

+ mkdir_perms(
+ crate::auto_install::CONFIG_PATH,
+ api_user.uid,
+ api_user.gid,
+ 0o750,
+ )?;
+
Ok(())
}

--
2.53.0