* [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
@ 2024-03-07 10:26 Hannes Laimer
2024-07-01 9:09 ` Fabian Grünbichler
0 siblings, 1 reply; 3+ messages in thread
From: Hannes Laimer @ 2024-03-07 10:26 UTC (permalink / raw)
To: pbs-devel
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
came up in support, and I don't think there's a good reason to not also
use the proxy for ACME DNS challenges. tested with local proxy, curl
in `proxmox-acme` picked the env vars up correctly and used the proxy
docs/package-repositories.rst | 5 +++--
src/acme/plugin.rs | 9 +++++++++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
index b429b4b4..969cca3c 100644
--- a/docs/package-repositories.rst
+++ b/docs/package-repositories.rst
@@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
web-interface in the `Configuration -> Authentication` tab.
-Once configured this proxy will be used for apt network requests and for
-checking a Proxmox Backup Server support subscription.
+Once configured this proxy will be used for apt network requests, for
+checking a Proxmox Backup Server support subscription and for ACME DNS challenge
+requests.
Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
the `<host>` part may include an authorization, for example:
diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
index 200cf9cc..db464afe 100644
--- a/src/acme/plugin.rs
+++ b/src/acme/plugin.rs
@@ -113,6 +113,12 @@ impl DnsPlugin {
let mut command = Command::new("/usr/bin/setpriv");
+ let (node_config, _digest) = crate::config::node::config()?;
+ let proxy: Option<String> = node_config
+ .http_proxy()
+ .map(|p| p.to_proxy_string())
+ .and_then(Result::ok);
+
#[rustfmt::skip]
command.args([
"--reuid", "nobody",
@@ -120,6 +126,9 @@ impl DnsPlugin {
"--clear-groups",
"--reset-env",
"--",
+ "/bin/env",
+ &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
+ &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
"/bin/bash",
PROXMOX_ACME_SH_PATH,
action,
--
2.39.2
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
2024-03-07 10:26 [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges Hannes Laimer
@ 2024-07-01 9:09 ` Fabian Grünbichler
2024-07-01 9:26 ` Hannes Laimer
0 siblings, 1 reply; 3+ messages in thread
From: Fabian Grünbichler @ 2024-07-01 9:09 UTC (permalink / raw)
To: Proxmox Backup Server development discussion
On March 7, 2024 11:26 am, Hannes Laimer wrote:
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
> came up in support, and I don't think there's a good reason to not also
> use the proxy for ACME DNS challenges. tested with local proxy, curl
> in `proxmox-acme` picked the env vars up correctly and used the proxy
>
> docs/package-repositories.rst | 5 +++--
> src/acme/plugin.rs | 9 +++++++++
> 2 files changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
> index b429b4b4..969cca3c 100644
> --- a/docs/package-repositories.rst
> +++ b/docs/package-repositories.rst
> @@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
> central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
> web-interface in the `Configuration -> Authentication` tab.
>
> -Once configured this proxy will be used for apt network requests and for
> -checking a Proxmox Backup Server support subscription.
> +Once configured this proxy will be used for apt network requests, for
> +checking a Proxmox Backup Server support subscription and for ACME DNS challenge
> +requests.
what about PVE and PMG?
>
> Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
> the `<host>` part may include an authorization, for example:
> diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
> index 200cf9cc..db464afe 100644
> --- a/src/acme/plugin.rs
> +++ b/src/acme/plugin.rs
> @@ -113,6 +113,12 @@ impl DnsPlugin {
>
> let mut command = Command::new("/usr/bin/setpriv");
>
> + let (node_config, _digest) = crate::config::node::config()?;
> + let proxy: Option<String> = node_config
> + .http_proxy()
> + .map(|p| p.to_proxy_string())
> + .and_then(Result::ok);
> +
> #[rustfmt::skip]
> command.args([
> "--reuid", "nobody",
> @@ -120,6 +126,9 @@ impl DnsPlugin {
> "--clear-groups",
> "--reset-env",
> "--",
> + "/bin/env",
> + &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
> + &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
why not simply set "ALL_PROXY"?
> "/bin/bash",
> PROXMOX_ACME_SH_PATH,
> action,
> --
> 2.39.2
>
>
>
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
>
>
>
_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
2024-07-01 9:09 ` Fabian Grünbichler
@ 2024-07-01 9:26 ` Hannes Laimer
0 siblings, 0 replies; 3+ messages in thread
From: Hannes Laimer @ 2024-07-01 9:26 UTC (permalink / raw)
To: Proxmox Backup Server development discussion
On Mon Jul 1, 2024 at 11:09 AM CEST, Fabian Grünbichler wrote:
> On March 7, 2024 11:26 am, Hannes Laimer wrote:
> > Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> > ---
> > came up in support, and I don't think there's a good reason to not also
> > use the proxy for ACME DNS challenges. tested with local proxy, curl
> > in `proxmox-acme` picked the env vars up correctly and used the proxy
> >
> > docs/package-repositories.rst | 5 +++--
> > src/acme/plugin.rs | 9 +++++++++
> > 2 files changed, 12 insertions(+), 2 deletions(-)
> >
> > diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
> > index b429b4b4..969cca3c 100644
> > --- a/docs/package-repositories.rst
> > +++ b/docs/package-repositories.rst
> > @@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
> > central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
> > web-interface in the `Configuration -> Authentication` tab.
> >
> > -Once configured this proxy will be used for apt network requests and for
> > -checking a Proxmox Backup Server support subscription.
> > +Once configured this proxy will be used for apt network requests, for
> > +checking a Proxmox Backup Server support subscription and for ACME DNS challenge
> > +requests.
>
> what about PVE and PMG?
>
I've sent [1] a while ago, I think both PMG and PVE use acme-proxmox
IIRC
[1] https://lists.proxmox.com/pipermail/pve-devel/2024-February/062012.html
> >
> > Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
> > the `<host>` part may include an authorization, for example:
> > diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
> > index 200cf9cc..db464afe 100644
> > --- a/src/acme/plugin.rs
> > +++ b/src/acme/plugin.rs
> > @@ -113,6 +113,12 @@ impl DnsPlugin {
> >
> > let mut command = Command::new("/usr/bin/setpriv");
> >
> > + let (node_config, _digest) = crate::config::node::config()?;
> > + let proxy: Option<String> = node_config
> > + .http_proxy()
> > + .map(|p| p.to_proxy_string())
> > + .and_then(Result::ok);
> > +
> > #[rustfmt::skip]
> > command.args([
> > "--reuid", "nobody",
> > @@ -120,6 +126,9 @@ impl DnsPlugin {
> > "--clear-groups",
> > "--reset-env",
> > "--",
> > + "/bin/env",
> > + &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
> > + &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
>
> why not simply set "ALL_PROXY"?
>
sure, will also work
> > "/bin/bash",
> > PROXMOX_ACME_SH_PATH,
> > action,
> > --
> > 2.39.2
> >
> >
> >
> > _______________________________________________
> > pbs-devel mailing list
> > pbs-devel@lists.proxmox.com
> > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> >
> >
> >
>
>
> _______________________________________________
> pbs-devel mailing list
> pbs-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-07-01 9:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-03-07 10:26 [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges Hannes Laimer
2024-07-01 9:09 ` Fabian Grünbichler
2024-07-01 9:26 ` Hannes Laimer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox