* [pmg-devel] [PATCH api 0/4] ACME updates
@ 2021-03-17 10:02 Wolfgang Bumiller
2021-03-17 10:02 ` [pmg-devel] [PATCH api 1/4] add missing use statement Wolfgang Bumiller
` (4 more replies)
0 siblings, 5 replies; 7+ messages in thread
From: Wolfgang Bumiller @ 2021-03-17 10:02 UTC (permalink / raw)
To: pmg-devel
This series contains a fixup and adds acme certificate renewal in
pmg-daily. The pmg-daily code is based on the code in pveupdate.
Wolfgang Bumiller (4):
add missing use statement
support forced account deactivation
add PMG::NodeConfig::filter_domains_by_type helper
check acme cert expiration in pmg-daily
src/PMG/API2/ACME.pm | 27 ++++++++++++++++++++++-----
src/PMG/API2/Certificates.pm | 13 +++++--------
src/PMG/NodeConfig.pm | 19 +++++++++++++++++++
src/bin/pmg-daily | 36 ++++++++++++++++++++++++++++++++++++
4 files changed, 82 insertions(+), 13 deletions(-)
--
2.20.1
^ permalink raw reply [flat|nested] 7+ messages in thread* [pmg-devel] [PATCH api 1/4] add missing use statement 2021-03-17 10:02 [pmg-devel] [PATCH api 0/4] ACME updates Wolfgang Bumiller @ 2021-03-17 10:02 ` Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 2/4] support forced account deactivation Wolfgang Bumiller ` (3 subsequent siblings) 4 siblings, 0 replies; 7+ messages in thread From: Wolfgang Bumiller @ 2021-03-17 10:02 UTC (permalink / raw) To: pmg-devel Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> --- src/PMG/API2/Certificates.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/src/PMG/API2/Certificates.pm b/src/PMG/API2/Certificates.pm index fc1025e..775d575 100644 --- a/src/PMG/API2/Certificates.pm +++ b/src/PMG/API2/Certificates.pm @@ -10,6 +10,7 @@ use PVE::Tools qw(extract_param file_get_contents file_set_contents); use PMG::CertHelpers; use PMG::NodeConfig; +use PMG::RS::Acme; use PMG::RS::CSR; use PMG::API2::ACMEPlugin; -- 2.20.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [pmg-devel] [PATCH api 2/4] support forced account deactivation 2021-03-17 10:02 [pmg-devel] [PATCH api 0/4] ACME updates Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 1/4] add missing use statement Wolfgang Bumiller @ 2021-03-17 10:02 ` Wolfgang Bumiller 2021-03-17 10:33 ` Thomas Lamprecht 2021-03-17 10:02 ` [pmg-devel] [PATCH api 3/4] add PMG::NodeConfig::filter_domains_by_type helper Wolfgang Bumiller ` (2 subsequent siblings) 4 siblings, 1 reply; 7+ messages in thread From: Wolfgang Bumiller @ 2021-03-17 10:02 UTC (permalink / raw) To: pmg-devel Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> --- src/PMG/API2/ACME.pm | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/src/PMG/API2/ACME.pm b/src/PMG/API2/ACME.pm index 60b5986..d6dbf2f 100644 --- a/src/PMG/API2/ACME.pm +++ b/src/PMG/API2/ACME.pm @@ -173,7 +173,7 @@ __PACKAGE__->register_method ({ }}); my $update_account = sub { - my ($param, $msg, %info) = @_; + my ($param, $msg, $force_deactivate, %info) = @_; my ($account_name, $account_file) = extract_account_name($param); @@ -190,7 +190,15 @@ my $update_account = sub { if ! -e $account_file; my $acme = PMG::RS::Acme->load($account_file); - $acme->update_account(\%info); + eval { + $acme->update_account(\%info); + }; + my $err = $@; + if ($force_deactivate) { + warn $err if $err; + } else { + die $2; + } if ($info{status} && $info{status} eq 'deactivated') { my $deactivated_name; for my $i (0..100) { @@ -239,9 +247,9 @@ __PACKAGE__->register_method ({ my $contact = $account_contact_from_param->($param); if (scalar @$contact) { - return $update_account->($param, 'update', contact => $contact); + return $update_account->($param, 'update', 0, contact => $contact); } else { - return $update_account->($param, 'refresh'); + return $update_account->($param, 'refresh', 0); } }}); @@ -311,6 +319,13 @@ __PACKAGE__->register_method ({ additionalProperties => 0, properties => { name => get_standard_option('pmg-acme-account-name'), + force => { + type => 'boolean', + description => + 'Delete account data even if the server refuses to deactivate the account.', + optional => 1, + default => 0, + }, }, }, returns => { @@ -319,7 +334,9 @@ __PACKAGE__->register_method ({ code => sub { my ($param) = @_; - return $update_account->($param, 'deactivate', status => 'deactivated'); + my $force_deactivate = extract_param($param, 'force'); + + return $update_account->($param, 'deactivate', $force_deactivate, status => 'deactivated'); }}); __PACKAGE__->register_method ({ -- 2.20.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [pmg-devel] [PATCH api 2/4] support forced account deactivation 2021-03-17 10:02 ` [pmg-devel] [PATCH api 2/4] support forced account deactivation Wolfgang Bumiller @ 2021-03-17 10:33 ` Thomas Lamprecht 0 siblings, 0 replies; 7+ messages in thread From: Thomas Lamprecht @ 2021-03-17 10:33 UTC (permalink / raw) To: Wolfgang Bumiller, pmg-devel On 17.03.21 11:02, Wolfgang Bumiller wrote: > Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> > --- > src/PMG/API2/ACME.pm | 27 ++++++++++++++++++++++----- > 1 file changed, 22 insertions(+), 5 deletions(-) > applied, thanks - squashed one change into it though. > diff --git a/src/PMG/API2/ACME.pm b/src/PMG/API2/ACME.pm > index 60b5986..d6dbf2f 100644 > --- a/src/PMG/API2/ACME.pm > +++ b/src/PMG/API2/ACME.pm > @@ -173,7 +173,7 @@ __PACKAGE__->register_method ({ > }}); > > my $update_account = sub { > - my ($param, $msg, %info) = @_; > + my ($param, $msg, $force_deactivate, %info) = @_; > > my ($account_name, $account_file) = extract_account_name($param); > > @@ -190,7 +190,15 @@ my $update_account = sub { > if ! -e $account_file; > > my $acme = PMG::RS::Acme->load($account_file); > - $acme->update_account(\%info); > + eval { > + $acme->update_account(\%info); > + }; > + my $err = $@; > + if ($force_deactivate) { > + warn $err if $err; > + } else { > + die $2; fixed up above typo and logic > + } > if ($info{status} && $info{status} eq 'deactivated') { > my $deactivated_name; > for my $i (0..100) { > @@ -239,9 +247,9 @@ __PACKAGE__->register_method ({ > > my $contact = $account_contact_from_param->($param); > if (scalar @$contact) { > - return $update_account->($param, 'update', contact => $contact); > + return $update_account->($param, 'update', 0, contact => $contact); > } else { > - return $update_account->($param, 'refresh'); > + return $update_account->($param, 'refresh', 0); > } > }}); > > @@ -311,6 +319,13 @@ __PACKAGE__->register_method ({ > additionalProperties => 0, > properties => { > name => get_standard_option('pmg-acme-account-name'), > + force => { > + type => 'boolean', > + description => > + 'Delete account data even if the server refuses to deactivate the account.', > + optional => 1, > + default => 0, > + }, > }, > }, > returns => { > @@ -319,7 +334,9 @@ __PACKAGE__->register_method ({ > code => sub { > my ($param) = @_; > > - return $update_account->($param, 'deactivate', status => 'deactivated'); > + my $force_deactivate = extract_param($param, 'force'); > + > + return $update_account->($param, 'deactivate', $force_deactivate, status => 'deactivated'); > }}); > > __PACKAGE__->register_method ({ > ^ permalink raw reply [flat|nested] 7+ messages in thread
* [pmg-devel] [PATCH api 3/4] add PMG::NodeConfig::filter_domains_by_type helper 2021-03-17 10:02 [pmg-devel] [PATCH api 0/4] ACME updates Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 1/4] add missing use statement Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 2/4] support forced account deactivation Wolfgang Bumiller @ 2021-03-17 10:02 ` Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 4/4] check acme cert expiration in pmg-daily Wolfgang Bumiller 2021-03-17 10:34 ` [pmg-devel] applied-series: [PATCH api 0/4] ACME updates Thomas Lamprecht 4 siblings, 0 replies; 7+ messages in thread From: Wolfgang Bumiller @ 2021-03-17 10:02 UTC (permalink / raw) To: pmg-devel for reuse The private $filter_domains is still there to do the in-place modification it did before. Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> --- src/PMG/API2/Certificates.pm | 12 ++++-------- src/PMG/NodeConfig.pm | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+), 8 deletions(-) diff --git a/src/PMG/API2/Certificates.pm b/src/PMG/API2/Certificates.pm index 775d575..b50addd 100644 --- a/src/PMG/API2/Certificates.pm +++ b/src/PMG/API2/Certificates.pm @@ -468,17 +468,13 @@ my $order_certificate = sub { my $filter_domains = sub { my ($acme_config, $type) = @_; - my $domains = $acme_config->{domains}; - foreach my $domain (sort keys %$domains) { - my $entry = $domains->{$domain}; - if (!(grep { $_ eq $type } PVE::Tools::split_list($entry->{usage}))) { - delete $domains->{$domain}; - } - } + my $domains = PMG::NodeConfig::filter_domains_by_type($acme_config->{domains}, $type); - if (!%$domains) { + if (!$domains) { raise("No domains configured for type '$type'\n", 400); } + + $acme_config->{domains} = $domains; }; __PACKAGE__->register_method ({ diff --git a/src/PMG/NodeConfig.pm b/src/PMG/NodeConfig.pm index 84c2141..19d23c3 100644 --- a/src/PMG/NodeConfig.pm +++ b/src/PMG/NodeConfig.pm @@ -222,4 +222,23 @@ sub get_acme_conf { return $res; } +# Helper to filter the domains hash. Returns `undef` if the list is empty. +sub filter_domains_by_type : prototype($$) { + my ($domains, $type) = @_; + + return undef if !$domains || !%$domains; + + my $out = {}; + + foreach my $domain (keys %$domains) { + my $entry = $domains->{$domain}; + if (grep { $_ eq $type } PVE::Tools::split_list($entry->{usage})) { + $out->{$domain} = $entry; + } + } + + return undef if !%$out; + return $out; +} + 1; -- 2.20.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [pmg-devel] [PATCH api 4/4] check acme cert expiration in pmg-daily 2021-03-17 10:02 [pmg-devel] [PATCH api 0/4] ACME updates Wolfgang Bumiller ` (2 preceding siblings ...) 2021-03-17 10:02 ` [pmg-devel] [PATCH api 3/4] add PMG::NodeConfig::filter_domains_by_type helper Wolfgang Bumiller @ 2021-03-17 10:02 ` Wolfgang Bumiller 2021-03-17 10:34 ` [pmg-devel] applied-series: [PATCH api 0/4] ACME updates Thomas Lamprecht 4 siblings, 0 replies; 7+ messages in thread From: Wolfgang Bumiller @ 2021-03-17 10:02 UTC (permalink / raw) To: pmg-devel Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> --- src/bin/pmg-daily | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/src/bin/pmg-daily b/src/bin/pmg-daily index 8865c94..d454c62 100755 --- a/src/bin/pmg-daily +++ b/src/bin/pmg-daily @@ -8,6 +8,7 @@ use strict; use warnings; use Time::Local; +use PVE::Certificate; use PVE::SafeSyslog; use PVE::INotify; use PVE::RESTEnvironment; @@ -18,6 +19,9 @@ use PMG::ClusterConfig; use PMG::DBTools; use PMG::API2::Subscription; use PMG::API2::APT; +use PMG::API2::Certificates; +use PMG::CertHelpers; +use PMG::NodeConfig; $SIG{'__WARN__'} = sub { my $err = $@; @@ -89,5 +93,37 @@ PMG::Utils::service_cmd('pmg-smtp-filter', 'restart') if $restart_filter; # run bayes database maintainance system('sa-learn --force-expire >/dev/null 2>&1'); +eval { + my $node_config = PMG::NodeConfig::load_config(); + my $acme_node_config = PMG::NodeConfig::get_acme_conf($node_config); + my $acme_domains = $acme_node_config && $acme_node_config->{domains}; + if ($acme_domains) { + my %typed_domains = map { + $_ => PMG::NodeConfig::filter_domains_by_type($acme_domains, $_) + } qw(api smtp); + + foreach my $type (qw(api smtp)) { + next if !$typed_domains{$type}; + + # Guard both certificates separately. + eval { + my $cert = PMG::CertHelpers::cert_path($type); + if (!-e $cert) { + syslog ('info', "ACME config found for '$type' certificate, but no custom certificate exists. Skipping ACME renewal until initial certificate has been deployed."); + next; + } + + if (PVE::Certificate::check_expiry($cert, time() + 30*24*60*60)) { + PMG::API2::Certificates->renew_acme_cert({ node => $nodename, type => $type }); + } else { + syslog ('info', "Custom '$type' certificate does not expire soon, skipping ACME renewal."); + } + }; + syslog ('err', "Renewing '$type' ACME certificate failed: $@") if $@; + } + } +}; +syslog ('err', "Renewing ACME certificate failed: $@") if $@; + exit (0); -- 2.20.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [pmg-devel] applied-series: [PATCH api 0/4] ACME updates 2021-03-17 10:02 [pmg-devel] [PATCH api 0/4] ACME updates Wolfgang Bumiller ` (3 preceding siblings ...) 2021-03-17 10:02 ` [pmg-devel] [PATCH api 4/4] check acme cert expiration in pmg-daily Wolfgang Bumiller @ 2021-03-17 10:34 ` Thomas Lamprecht 4 siblings, 0 replies; 7+ messages in thread From: Thomas Lamprecht @ 2021-03-17 10:34 UTC (permalink / raw) To: Wolfgang Bumiller, pmg-devel On 17.03.21 11:02, Wolfgang Bumiller wrote: > This series contains a fixup and adds acme certificate renewal in > pmg-daily. The pmg-daily code is based on the code in pveupdate. > > Wolfgang Bumiller (4): > add missing use statement > support forced account deactivation > add PMG::NodeConfig::filter_domains_by_type helper > check acme cert expiration in pmg-daily > > src/PMG/API2/ACME.pm | 27 ++++++++++++++++++++++----- > src/PMG/API2/Certificates.pm | 13 +++++-------- > src/PMG/NodeConfig.pm | 19 +++++++++++++++++++ > src/bin/pmg-daily | 36 ++++++++++++++++++++++++++++++++++++ > 4 files changed, 82 insertions(+), 13 deletions(-) > applied series, thanks! ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-03-17 10:34 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-03-17 10:02 [pmg-devel] [PATCH api 0/4] ACME updates Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 1/4] add missing use statement Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 2/4] support forced account deactivation Wolfgang Bumiller 2021-03-17 10:33 ` Thomas Lamprecht 2021-03-17 10:02 ` [pmg-devel] [PATCH api 3/4] add PMG::NodeConfig::filter_domains_by_type helper Wolfgang Bumiller 2021-03-17 10:02 ` [pmg-devel] [PATCH api 4/4] check acme cert expiration in pmg-daily Wolfgang Bumiller 2021-03-17 10:34 ` [pmg-devel] applied-series: [PATCH api 0/4] ACME updates Thomas Lamprecht
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.