Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/4] fix #6173: acme: use the configured HTTP proxy

[Christian Ebner <c.ebner@proxmox.com>]

On 10/8/26 5:33 PM, Samuel Rufinatscha wrote:
> ACME requests in PBS and PDM ignore the node's HTTP proxy setting and
> fail when the CA is reachable only through a proxy [0].
> 
> Add optional proxy support to the shared ACME client and pass the node
> proxy configuration to each operation that contacts the CA.
> 
> Testing:
> 
> Reproduced the issue on PBS 4.2 using Pebble [1] as the ACME server
> and Tinyproxy [2] as the HTTP proxy configured in PBS. Added a firewall
> rule to block direct access to Pebble while allowing connections through
> Tinyproxy. Operations succeeded through the configured proxy.
> 
> Tested for:
> 
> (1) HTTP-01 and DNS-01, including proxies requiring
> authentication.
> (2) Automatic renewal using a short-lived Pebble certificate.
> (3) Changed the HTTP proxy setting to a second Tinyproxy instance
> without restarting the PBS services. The next ACME operations used
> the new proxy.
> (4) PDM was built against the shared libraries (only).
> 
> Maintainer notes:
> 
> - proxmox-acme-api has breaking changes because of the extra
> Option<ProxyConfig> argument.
> - proxmox-acme-api adds the proxmox-http dependency to the impl feature
> 
> [0] https://bugzilla.proxmox.com/show_bug.cgi?id=6173
> [1] https://github.com/letsencrypt/pebble
> [2] https://tinyproxy.github.io/

Thanks for the patches, changes look okay to me and work as stated.

But there are two things which are worth improving upon:
- Allowing the user to opt-in or opt-out from using the proxy: How to 
approach this best might however be discussed first to be in line with 
PVE as well, where this is still an open issue AFAICS [0].
- Log in the task log that the node's http proxy is being used for 
connection: This might help users discover issues more easily. Ideally 
this would also be shown as additional error context when connection to 
the proxy fails, e.g. when adding an new ACME account, instead of the 
rather limited `client error (Connect) (400)`

[0] 
https://lore.proxmox.com/pve-devel/20240228112412.3982-1-h.laimer@proxmox.com/