[PATCH datacenter-manager/proxmox{,-backup} v3 00/16] TLS Certificate Rotation

[Shannon Sterz <s.sterz@proxmox.com>]

this series adds certificate rotation to Proxmox Backup Server and Proxmox
Datacenter Manager. currently, both products issue a certificate that is valid
for almost 1000 years (365000 days). no cryptographic key can reasonably be
considered secure for this amount of time. this series:

- allows specifying the lifetime of the certificate when creating one via
  proxmox-acme-api and reduces the default to 3650 days (almost ten years).
- sends and logs reminders 30 days before a certificate expires (pdm currently
  does not support the notification framework yet, so adding notifications is
  left as future work here).
- refreshes a certificate at the earliest 15 days before it expires, logs
  and notifies when that happens.
- warns on certificates with excessive lifetimes (>3650 days) and documents
  how to manually update them.
- for pdm: exposes cert handling cli methods in proxmox-datacenter-manager-admin.
- fixes up some inconsistencies in the ui and docs regarding pdm's certificate
  location.
- adjusts the severity of acme renewal error notifications for pbs

Testing
-------

the easiest way to test this is to manipulate the date of the host with `date
--set` and then manually trigger the daily update binary for each product:

* PBS: `/usr/lib/x86_64-linux-gnu/proxmox-backup/proxmox-daily-update`
* PDM: `/usr/libexec/proxmox/proxmox-datacenter-manager-daily-update`

you can then check the logs and the certificate itself to see what happened.
specifying the `PBS_LOG` environment variable with the parameter `trace` or
`debug` will also enable debug logging here.

## Open Questions

+ 10 years is still a long time and i'd rather reduce that further down if
  possible. see the patch 02 for proxmox-tls-certificates for more info.
+ should we remove pre-existing long lasting certificates by ourselves? imo
  that is too risky at the moment given that an unplanned certificate rotation
  could cause backups to fail.
+ notifying every day for 15 days before the renewal might be excessive, see
  the second commit for pbs.

Future Work
-----------

- pve and pdm should be extended to allow automatically updating allowed
  fingerprints before a new self-signed certificate goes into action. a series
  demonstrating this for pve<->pdm has already been sent [1]. if this series gets
  approved, i'll happily adapt the mechanism for pbs<->pve and pbs<->pdm.
- pdm should send notifications similar to pbs once support for notifications
  is added.

Changelog
---------

* v2: https://lore.proxmox.com/all/DKBY8O2ZM9OD.68MQZGLR3IGF@proxmox.com/

    changes since v2:

    + fixed a typo that broke notification rendering (timstamp ->
      timestamp) (forgot to add that to the proper commit after local
      testing...)
    + fixed a transient issue that broke getting the certificate info
      for pdm between patches of the last series
    + dropped unnecessary `const_format` dependency
    + log an error when a self-signed certificate cannot be renewed
    + fix docs for pdm
    + adjusted named regex pattern to be more compatible with older
      regex versions
    + don't re-use the AcmeErrTemplateData struct for self-signed renewal
      errors
    + spelling and other clean ups

* v1: https://lore.proxmox.com/pbs-devel/20260422124022.17952-1-s.sterz@proxmox.com/

    changes since v1 (thanks @ Lukas Wagner):

    + dropped a patch for proxmox-yew-comp that got applied already
    + rebased on current master for all three repos
    + created new `proxmox-tls-certificates` crate and moved several helpers
      there. reexposing functions in proxmox-acme-api to avoid breakage.
    + added unit tests and more documentation to tls helpers
    + adjusted the severity of error and renewal notifications
    + adapted the upcoming renewal template for pbs to inform about the
      earliest date a renewal could happen

* rfc: https://lore.proxmox.com/pbs-devel/20260407135714.490747-1-s.sterz@proxmox.com/

    changes since rfc:

    + add patches that avoid hard-coding the certificate file name in yew-comp
      and use the proper filename in pdm
    + update pdm renewal docs patch to avoid confusion
    + re-base on current master

[1]: https://lore.proxmox.com/pdm-devel/20260611120327.257523-1-s.sterz@proxmox.com/


proxmox:

Shannon Sterz (4):
  acme-api/tls-certificates: add new crate collecting tls related
    helpers
  tls-certificates: add days_valid parameter to create_self_signed_cert
  tls-certificates: add self_signed_cert_expires_in to check
    certificates
  acme-api: stop re-exporting create_self_signed_cert

 Cargo.toml                                  |   2 +
 proxmox-acme-api/Cargo.toml                 |   2 +
 proxmox-acme-api/src/certificate_helpers.rs | 195 ----------
 proxmox-acme-api/src/lib.rs                 |   2 +-
 proxmox-acme-api/src/types.rs               |  51 +--
 proxmox-tls-certificates/Cargo.toml         |  37 ++
 proxmox-tls-certificates/src/lib.rs         |   7 +
 proxmox-tls-certificates/src/types.rs       |  54 +++
 proxmox-tls-certificates/src/util.rs        | 394 ++++++++++++++++++++
 9 files changed, 498 insertions(+), 246 deletions(-)
 create mode 100644 proxmox-tls-certificates/Cargo.toml
 create mode 100644 proxmox-tls-certificates/src/lib.rs
 create mode 100644 proxmox-tls-certificates/src/types.rs
 create mode 100644 proxmox-tls-certificates/src/util.rs


backup:

Shannon Sterz (6):
  config: use proxmox_tls_certificates for generating self-signed
    certificates
  config/server/api: add certificate renewal logic including
    notifications
  daily update: warn about excessive self-signed certificate lifetime
  docs: document force refreshing long-lived certificates
  backup-manager cli: `cert update` can create auth and csrf key
  notifications: use `Severity::Error` for acme renewal failures

 Cargo.toml                                    |  3 +
 debian/control                                |  2 +
 debian/proxmox-backup-server.install          |  6 ++
 docs/certificate-management.rst               | 31 ++++++
 src/api2/node/certificates.rs                 |  9 +-
 src/bin/proxmox-daily-update.rs               | 48 +++++++++-
 src/bin/proxmox_backup_manager/cert.rs        |  2 +
 src/config/mod.rs                             | 96 ++-----------------
 src/server/notifications/mod.rs               | 66 ++++++++++++-
 src/server/notifications/template_data.rs     | 22 +++++
 templates/Makefile                            | 68 +++++++------
 templates/default/cert-err-body.txt.hbs       |  7 ++
 templates/default/cert-err-subject.txt.hbs    |  1 +
 templates/default/cert-refresh-body.txt.hbs   |  8 ++
 .../default/cert-refresh-subject.txt.hbs      |  1 +
 .../cert-upcoming-refresh-body.txt.hbs        | 10 ++
 .../cert-upcoming-refresh-subject.txt.hbs     |  1 +
 17 files changed, 257 insertions(+), 124 deletions(-)
 create mode 100644 templates/default/cert-err-body.txt.hbs
 create mode 100644 templates/default/cert-err-subject.txt.hbs
 create mode 100644 templates/default/cert-refresh-body.txt.hbs
 create mode 100644 templates/default/cert-refresh-subject.txt.hbs
 create mode 100644 templates/default/cert-upcoming-refresh-body.txt.hbs
 create mode 100644 templates/default/cert-upcoming-refresh-subject.txt.hbs


datacenter-manager:

Shannon Sterz (6):
  certs: use proxmox-tls-certificates directly, add days_valid parameter
  api/auth/bin: add certificate renewal logic
  cli: expose certificate management endpoints via the cli
  daily-update: warn about certificates with excessive lifetimes
  docs: add section on forcing a new self-signed certificate
  docs/certificates: use correct certificate file name

 Cargo.toml                                    |  2 +
 cli/admin/Cargo.toml                          |  1 +
 cli/admin/src/cert.rs                         | 86 +++++++++++++++++++
 cli/admin/src/main.rs                         |  2 +
 debian/control                                |  2 +
 docs/certificate-management.rst               | 31 +++++++
 server/Cargo.toml                             |  1 +
 server/src/api/nodes/certificates.rs          | 19 ++--
 server/src/auth/certs.rs                      | 19 +++-
 ...proxmox-datacenter-manager-daily-update.rs | 43 ++++++++++
 10 files changed, 193 insertions(+), 13 deletions(-)
 create mode 100644 cli/admin/src/cert.rs


Summary over all repositories:
  36 files changed, 948 insertions(+), 383 deletions(-)

-- 
Generated by murpp 0.12.0