[PATCH proxmox{,-backup,-datacenter-manager} 0/4] fix #6173: acme: use the configured HTTP proxy

[Samuel Rufinatscha <s.rufinatscha@proxmox.com>]

ACME requests in PBS and PDM ignore the node's HTTP proxy setting and
fail when the CA is reachable only through a proxy [0].

Add optional proxy support to the shared ACME client and pass the node
proxy configuration to each operation that contacts the CA.

Testing:

Reproduced the issue on PBS 4.2 using Pebble [1] as the ACME server
and Tinyproxy [2] as the HTTP proxy configured in PBS. Added a firewall
rule to block direct access to Pebble while allowing connections through
Tinyproxy. Operations succeeded through the configured proxy.

Tested for:

(1) HTTP-01 and DNS-01, including proxies requiring
authentication.
(2) Automatic renewal using a short-lived Pebble certificate.
(3) Changed the HTTP proxy setting to a second Tinyproxy instance
without restarting the PBS services. The next ACME operations used
the new proxy.
(4) PDM was built against the shared libraries (only).

Maintainer notes:

- proxmox-acme-api has breaking changes because of the extra
Option<ProxyConfig> argument.
- proxmox-acme-api adds the proxmox-http dependency to the impl feature

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=6173
[1] https://github.com/letsencrypt/pebble
[2] https://tinyproxy.github.io/

proxmox:

Samuel Rufinatscha (2):
  acme: async_client: support HTTP proxies
  acme-api: support HTTP proxies

 proxmox-acme-api/Cargo.toml                 |  2 ++
 proxmox-acme-api/src/account_api_impl.rs    | 27 +++++++++++++++------
 proxmox-acme-api/src/account_config.rs      |  5 ++--
 proxmox-acme-api/src/certificate_helpers.rs | 12 ++++++---
 proxmox-acme/src/async_client.rs            |  9 +++++--
 5 files changed, 41 insertions(+), 14 deletions(-)


proxmox-backup:

Samuel Rufinatscha (1):
  fix #6173: acme: use the configured HTTP proxy

 src/api2/config/acme.rs                | 10 +++++++---
 src/api2/node/certificates.rs          |  8 ++++++--
 src/bin/proxmox_backup_manager/acme.rs |  4 +++-
 3 files changed, 16 insertions(+), 6 deletions(-)


proxmox-datacenter-manager:

Samuel Rufinatscha (1):
  fix #6173: acme: use the configured HTTP proxy

 cli/admin/src/acme.rs                |  4 +++-
 server/src/api/config/acme.rs        | 26 ++++++++++++++++++++------
 server/src/api/nodes/certificates.rs |  9 +++++++--
 3 files changed, 30 insertions(+), 9 deletions(-)


Summary over all repositories:
  11 files changed, 87 insertions(+), 29 deletions(-)

-- 
Generated by git-murpp 0.8.1