From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id C258F1FF0BC for ; Thu, 29 Oct 2026 09:41:09 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 6683B20961; Thu, 29 Oct 2026 09:41:09 +0100 (CET) Message-ID: <05e0426b-00b8-4901-bae3-dae6580bebe9@proxmox.com> Date: Thu, 29 Oct 2026 09:41:00 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/4] fix #6173: acme: use the configured HTTP proxy To: Christian Ebner , pbs-devel@lists.proxmox.com References: <20261008153323.293158-1-s.rufinatscha@proxmox.com> <16406423-0b43-4ddc-b0e6-8403980a05f8@proxmox.com> Content-Language: en-US From: Samuel Rufinatscha In-Reply-To: <16406423-0b43-4ddc-b0e6-8403980a05f8@proxmox.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.182 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: L4ZQYDSF7V6XGYDDLL5LYYWTZQN47CLQ X-Message-ID-Hash: L4ZQYDSF7V6XGYDDLL5LYYWTZQN47CLQ X-MailFrom: s.rufinatscha@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 10/27/26 3:54 PM, Christian Ebner wrote: > On 10/8/26 5:33 PM, Samuel Rufinatscha wrote: >> ACME requests in PBS and PDM ignore the node's HTTP proxy setting and >> fail when the CA is reachable only through a proxy [0]. >> >> Add optional proxy support to the shared ACME client and pass the node >> proxy configuration to each operation that contacts the CA. >> >> Testing: >> >> Reproduced the issue on PBS 4.2 using Pebble [1] as the ACME server >> and Tinyproxy [2] as the HTTP proxy configured in PBS. Added a firewall >> rule to block direct access to Pebble while allowing connections through >> Tinyproxy. Operations succeeded through the configured proxy. >> >> Tested for: >> >> (1) HTTP-01 and DNS-01, including proxies requiring >> authentication. >> (2) Automatic renewal using a short-lived Pebble certificate. >> (3) Changed the HTTP proxy setting to a second Tinyproxy instance >> without restarting the PBS services. The next ACME operations used >> the new proxy. >> (4) PDM was built against the shared libraries (only). >> >> Maintainer notes: >> >> - proxmox-acme-api has breaking changes because of the extra >> Option argument. >> - proxmox-acme-api adds the proxmox-http dependency to the impl feature >> >> [0] https://bugzilla.proxmox.com/show_bug.cgi?id=6173 >> [1] https://github.com/letsencrypt/pebble >> [2] https://tinyproxy.github.io/ > > Thanks for the patches, changes look okay to me and work as stated. > > But there are two things which are worth improving upon: > - Allowing the user to opt-in or opt-out from using the proxy: How to > approach this best might however be discussed first to be in line with > PVE as well, where this is still an open issue AFAICS [0]. > - Log in the task log that the node's http proxy is being used for > connection: This might help users discover issues more easily. Ideally > this would also be shown as additional error context when connection to > the proxy fails, e.g. when adding an new ACME account, instead of the > rather limited `client error (Connect) (400)` > > [0] https://lore.proxmox.com/pve-devel/20240228112412.3982-1- > h.laimer@proxmox.com/ Hi Christian, thanks for the review and testing! Regarding (1), I will check on this and align this with PVE. For (2), I also see that a task log entry would be very helpful, will add this as part of the v2.