* [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
@ 2024-03-07 10:26 Hannes Laimer
2024-07-01 9:09 ` Fabian Grünbichler
0 siblings, 1 reply; 3+ messages in thread
From: Hannes Laimer @ 2024-03-07 10:26 UTC (permalink / raw)
To: pbs-devel
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
came up in support, and I don't think there's a good reason to not also
use the proxy for ACME DNS challenges. tested with local proxy, curl
in `proxmox-acme` picked the env vars up correctly and used the proxy
docs/package-repositories.rst | 5 +++--
src/acme/plugin.rs | 9 +++++++++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
index b429b4b4..969cca3c 100644
--- a/docs/package-repositories.rst
+++ b/docs/package-repositories.rst
@@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
web-interface in the `Configuration -> Authentication` tab.
-Once configured this proxy will be used for apt network requests and for
-checking a Proxmox Backup Server support subscription.
+Once configured this proxy will be used for apt network requests, for
+checking a Proxmox Backup Server support subscription and for ACME DNS challenge
+requests.
Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
the `<host>` part may include an authorization, for example:
diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
index 200cf9cc..db464afe 100644
--- a/src/acme/plugin.rs
+++ b/src/acme/plugin.rs
@@ -113,6 +113,12 @@ impl DnsPlugin {
let mut command = Command::new("/usr/bin/setpriv");
+ let (node_config, _digest) = crate::config::node::config()?;
+ let proxy: Option<String> = node_config
+ .http_proxy()
+ .map(|p| p.to_proxy_string())
+ .and_then(Result::ok);
+
#[rustfmt::skip]
command.args([
"--reuid", "nobody",
@@ -120,6 +126,9 @@ impl DnsPlugin {
"--clear-groups",
"--reset-env",
"--",
+ "/bin/env",
+ &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
+ &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
"/bin/bash",
PROXMOX_ACME_SH_PATH,
action,
--
2.39.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
2024-03-07 10:26 [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges Hannes Laimer
@ 2024-07-01 9:09 ` Fabian Grünbichler
2024-07-01 9:26 ` Hannes Laimer
0 siblings, 1 reply; 3+ messages in thread
From: Fabian Grünbichler @ 2024-07-01 9:09 UTC (permalink / raw)
To: Proxmox Backup Server development discussion
On March 7, 2024 11:26 am, Hannes Laimer wrote:
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
> came up in support, and I don't think there's a good reason to not also
> use the proxy for ACME DNS challenges. tested with local proxy, curl
> in `proxmox-acme` picked the env vars up correctly and used the proxy
>
> docs/package-repositories.rst | 5 +++--
> src/acme/plugin.rs | 9 +++++++++
> 2 files changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
> index b429b4b4..969cca3c 100644
> --- a/docs/package-repositories.rst
> +++ b/docs/package-repositories.rst
> @@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
> central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
> web-interface in the `Configuration -> Authentication` tab.
>
> -Once configured this proxy will be used for apt network requests and for
> -checking a Proxmox Backup Server support subscription.
> +Once configured this proxy will be used for apt network requests, for
> +checking a Proxmox Backup Server support subscription and for ACME DNS challenge
> +requests.
what about PVE and PMG?
>
> Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
> the `<host>` part may include an authorization, for example:
> diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
> index 200cf9cc..db464afe 100644
> --- a/src/acme/plugin.rs
> +++ b/src/acme/plugin.rs
> @@ -113,6 +113,12 @@ impl DnsPlugin {
>
> let mut command = Command::new("/usr/bin/setpriv");
>
> + let (node_config, _digest) = crate::config::node::config()?;
> + let proxy: Option<String> = node_config
> + .http_proxy()
> + .map(|p| p.to_proxy_string())
> + .and_then(Result::ok);
> +
> #[rustfmt::skip]
> command.args([
> "--reuid", "nobody",
> @@ -120,6 +126,9 @@ impl DnsPlugin {
> "--clear-groups",
> "--reset-env",
> "--",
> + "/bin/env",
> + &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
> + &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
why not simply set "ALL_PROXY"?
> "/bin/bash",
> PROXMOX_ACME_SH_PATH,
> action,
> --
> 2.39.2
>
>
>
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
>
>
>
_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
2024-07-01 9:09 ` Fabian Grünbichler
@ 2024-07-01 9:26 ` Hannes Laimer
0 siblings, 0 replies; 3+ messages in thread
From: Hannes Laimer @ 2024-07-01 9:26 UTC (permalink / raw)
To: Proxmox Backup Server development discussion
On Mon Jul 1, 2024 at 11:09 AM CEST, Fabian Grünbichler wrote:
> On March 7, 2024 11:26 am, Hannes Laimer wrote:
> > Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> > ---
> > came up in support, and I don't think there's a good reason to not also
> > use the proxy for ACME DNS challenges. tested with local proxy, curl
> > in `proxmox-acme` picked the env vars up correctly and used the proxy
> >
> > docs/package-repositories.rst | 5 +++--
> > src/acme/plugin.rs | 9 +++++++++
> > 2 files changed, 12 insertions(+), 2 deletions(-)
> >
> > diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
> > index b429b4b4..969cca3c 100644
> > --- a/docs/package-repositories.rst
> > +++ b/docs/package-repositories.rst
> > @@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
> > central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
> > web-interface in the `Configuration -> Authentication` tab.
> >
> > -Once configured this proxy will be used for apt network requests and for
> > -checking a Proxmox Backup Server support subscription.
> > +Once configured this proxy will be used for apt network requests, for
> > +checking a Proxmox Backup Server support subscription and for ACME DNS challenge
> > +requests.
>
> what about PVE and PMG?
>
I've sent [1] a while ago, I think both PMG and PVE use acme-proxmox
IIRC
[1] https://lists.proxmox.com/pipermail/pve-devel/2024-February/062012.html
> >
> > Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
> > the `<host>` part may include an authorization, for example:
> > diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
> > index 200cf9cc..db464afe 100644
> > --- a/src/acme/plugin.rs
> > +++ b/src/acme/plugin.rs
> > @@ -113,6 +113,12 @@ impl DnsPlugin {
> >
> > let mut command = Command::new("/usr/bin/setpriv");
> >
> > + let (node_config, _digest) = crate::config::node::config()?;
> > + let proxy: Option<String> = node_config
> > + .http_proxy()
> > + .map(|p| p.to_proxy_string())
> > + .and_then(Result::ok);
> > +
> > #[rustfmt::skip]
> > command.args([
> > "--reuid", "nobody",
> > @@ -120,6 +126,9 @@ impl DnsPlugin {
> > "--clear-groups",
> > "--reset-env",
> > "--",
> > + "/bin/env",
> > + &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
> > + &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
>
> why not simply set "ALL_PROXY"?
>
sure, will also work
> > "/bin/bash",
> > PROXMOX_ACME_SH_PATH,
> > action,
> > --
> > 2.39.2
> >
> >
> >
> > _______________________________________________
> > pbs-devel mailing list
> > pbs-devel@lists.proxmox.com
> > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> >
> >
> >
>
>
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-07-01 9:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-03-07 10:26 [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges Hannes Laimer
2024-07-01 9:09 ` Fabian Grünbichler
2024-07-01 9:26 ` Hannes Laimer
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal