Re: [PATCH installer v3 28/38] assistant: support adding an authorization token for HTTP-based answers

Lukas Wagner
2026-04-14T12:13:03Z

On Fri Apr 3, 2026 at 6:54 PM CEST, Christoph Heiss wrote:
> If '--answer-auth-token <token-name>:<token-secret>' is passed, the
> token will be saved to the internal auto-installer HTTP settings.
>
> The `HttpOptions` is not marked with `deny_unknown_fields`, so adding an
> additional field is also backwards-compatible.
>
> Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
> ---
> Changes v2 -> v3:
> * new patch
>
> proxmox-auto-install-assistant/src/main.rs | 18 ++++++++++++++++++
> proxmox-auto-installer/src/utils.rs | 2 ++
> proxmox-fetch-answer/src/main.rs | 1 +
> 3 files changed, 21 insertions(+)
>
> diff --git a/proxmox-auto-install-assistant/src/main.rs b/proxmox-auto-install-assistant/src/main.rs
> index 22a8e39..901ab81 100644
> --- a/proxmox-auto-install-assistant/src/main.rs
> +++ b/proxmox-auto-install-assistant/src/main.rs
> @@ -271,6 +271,13 @@ struct CommandPrepareISOArgs {
> ///
> /// Implies '--pxe'.
> pxe_loader: Option<PxeLoader>,
> +
> + /// Only useful in combination with '--fetch-from http'. Token the automated installer should
> + /// use for retrieving an answer file.
> + ///
> + /// If set, the automated installer will include an 'Authorization' header in the HTTP POST
> + /// for retrieving the answer, in the format 'Authorization: ProxmoxInstallerToken <TOKEN>'.
> + answer_auth_token: Option<String>,
> }

As briefly discussed off-list, I wonder if we should just use `Bearer`
here?

It originated from OAuth 2.0 in RFC 6750, but from my understanding it
has also become quite well established outside of OAuth contexts for any
kind of opaque authentication token.

No hard feelings though, can be kept as it is right now, if you prefer
that.

>
> impl cli::Subcommand for CommandPrepareISOArgs {
> @@ -290,6 +297,7 @@ impl cli::Subcommand for CommandPrepareISOArgs {
> on_first_boot: args.opt_value_from_str("--on-first-boot")?,
> pxe: args.contains("--pxe") || pxe_loader.is_some(),
> pxe_loader,
> + answer_auth_token: args.opt_value_from_str("--answer-auth-token")?,
> // Needs to be last
> input: args.free_from_str()?,
> })
> @@ -382,6 +390,15 @@ OPTIONS:
>
> Implies '--pxe'.
>
> + --answer-auth-token <TOKEN>
> + Only useful in combination with '--fetch-from http'. Token the automated installer should
> + use for retrieving an answer file.
> +
> + <TOKEN> must be of format '<name>:<secret>'.
> +
> + If set, the automated installer will include an 'Authorization' header in the HTTP POST
> + for retrieving the answer, in the format 'Authorization: ProxmoxInstallerToken <TOKEN>'.
> +
> -h, --help Print this help
> -V, --version Print version
> "#,
> @@ -744,6 +761,7 @@ fn prepare_iso(args: &CommandPrepareISOArgs) -> Result<()> {
> http: HttpOptions {
> url: args.url.clone(),
> cert_fingerprint: args.cert_fingerprint.clone(),
> + token: args.answer_auth_token.clone(),
> },
> };
> let mut instmode_file_tmp = tmp_base.clone();
> diff --git a/proxmox-auto-installer/src/utils.rs b/proxmox-auto-installer/src/utils.rs
> index 884a08e..09b3408 100644
> --- a/proxmox-auto-installer/src/utils.rs
> +++ b/proxmox-auto-installer/src/utils.rs
> @@ -131,6 +131,8 @@ pub struct HttpOptions {
> pub url: Option<String>,
> #[serde(default, skip_serializing_if = "Option::is_none")]
> pub cert_fingerprint: Option<String>,
> + #[serde(default, skip_serializing_if = "Option::is_none")]
> + pub token: Option<String>,
> }
>
> #[derive(Deserialize, Serialize, Debug)]
> diff --git a/proxmox-fetch-answer/src/main.rs b/proxmox-fetch-answer/src/main.rs
> index c599bef..18b27e7 100644
> --- a/proxmox-fetch-answer/src/main.rs
> +++ b/proxmox-fetch-answer/src/main.rs
> @@ -98,6 +98,7 @@ fn settings_from_cli_args(args: &[String]) -> Result<AutoInstSettings> {
> http: HttpOptions {
> url: args.get(2).cloned(),
> cert_fingerprint: args.get(3).cloned(),
> + token: None,
> },
> })
> }