[pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure

[pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure

[Stefan Sterz]

the superuser's email will be used to notify them that certificate
renewal has failed.

Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
---
 src/api2/node/certificates.rs     | 22 +++++++++----
 src/server/email_notifications.rs | 54 ++++++++++++++++++++++++++++++-
 2 files changed, 69 insertions(+), 7 deletions(-)

diff --git a/src/api2/node/certificates.rs b/src/api2/node/certificates.rs
index 9508ea38..1fa1e6fc 100644
--- a/src/api2/node/certificates.rs
+++ b/src/api2/node/certificates.rs
@@ -13,13 +13,14 @@ use proxmox_router::list_subdirs_api_method;
 use proxmox_schema::api;
 use proxmox_sys::{task_log, task_warn};
 
-use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_MODIFY};
+use pbs_api_types::{Notify, NODE_SCHEMA, PRIV_SYS_MODIFY};
 use pbs_buildcfg::configdir;
 use pbs_tools::cert;
 
 use crate::acme::AcmeClient;
 use crate::api2::types::AcmeDomain;
 use crate::config::node::NodeConfig;
+use crate::server::send_certificate_renewal_mail;
 use proxmox_rest_server::WorkerTask;
 
 pub const ROUTER: Router = Router::new()
@@ -536,11 +537,20 @@ fn spawn_certificate_worker(
     let auth_id = rpcenv.get_auth_id().unwrap();
 
     WorkerTask::spawn(name, None, auth_id, true, move |worker| async move {
-        if let Some(cert) = order_certificate(worker, &node_config).await? {
-            crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
-            crate::server::reload_proxy_certificate().await?;
-        }
-        Ok(())
+        let work = || async {
+            if let Some(cert) = order_certificate(worker, &node_config).await? {
+                crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
+                crate::server::reload_proxy_certificate().await?;
+            }
+
+            Ok(())
+        };
+
+        let res = work().await;
+
+        send_certificate_renewal_mail(Notify::Error, &res)?;
+
+        res
     })
 }
 
diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
index 4d734368..6fffefd3 100644
--- a/src/server/email_notifications.rs
+++ b/src/server/email_notifications.rs
@@ -1,4 +1,4 @@
-use anyhow::Error;
+use anyhow::{bail, Error};
 use serde_json::json;
 
 use handlebars::{Handlebars, Helper, Context, RenderError, RenderContext, Output, HelperResult, TemplateError};
@@ -183,6 +183,18 @@ Please visit the web interface for further details:
 
 "###;
 
+const ACME_CERTIFICATE_ERR_RENEWAL: &str = r###"
+
+Proxmox Backup Server was not able to renew a TLS certificate.
+
+Error: {{error}}
+
+Please visit the web interface for further details:
+
+<https://{{fqdn}}:{{port}}/#pbsCertificateConfiguration>
+
+"###;
+
 lazy_static::lazy_static!{
 
     static ref HANDLEBARS: Handlebars<'static> = {
@@ -209,6 +221,8 @@ lazy_static::lazy_static!{
 
             hb.register_template_string("package_update_template", PACKAGE_UPDATES_TEMPLATE)?;
 
+            hb.register_template_string("certificate_renewal_err_template", ACME_CERTIFICATE_ERR_RENEWAL)?;
+
             Ok(())
         });
 
@@ -543,6 +557,42 @@ pub fn send_updates_available(
     Ok(())
 }
 
+/// send email on certificate renewal failure.
+/// `notify` currently only accepts `Notify::Error`.
+pub fn send_certificate_renewal_mail(
+    notify: Notify,
+    result: &Result<(), Error>,
+) -> Result<(), Error> {
+    match notify {
+        Notify::Error => (),
+        _ => bail!("error: renewal notifications currently only supported for 'Notify::Error'!"),
+    }
+
+    let error: String = match result {
+        Err(e) => e.to_string().into(),
+        _ => return Ok(()),
+    };
+
+    if let Some(email) = lookup_user_email(Userid::root_userid()) {
+        let (fqdn, port) = get_server_url();
+
+        let text = HANDLEBARS.render(
+            "certificate_renewal_err_template",
+            &json!({
+                "fqdn": fqdn,
+                "port": port,
+                "error": error,
+            }),
+        )?;
+
+        let subject = "Could not renew certificate";
+
+        send_job_status_mail(&email, subject, &text)?;
+    }
+
+    Ok(())
+}
+
 /// Lookup users email address
 pub fn lookup_user_email(userid: &Userid) -> Option<String> {
 
@@ -648,4 +698,6 @@ fn test_template_register() {
     assert!(HANDLEBARS.has_template("tape_backup_err_template"));
 
     assert!(HANDLEBARS.has_template("package_update_template"));
+
+    assert!(HANDLEBARS.has_template("certificate_renewal_err_template"));
 }
-- 
2.30.2

Re: [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure

[Stefan Sterz]

On 3/31/22 11:36, Stefan Sterz wrote:
> the superuser's email will be used to notify them that certificate
> renewal has failed.
> 
> Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
> ---
>  src/api2/node/certificates.rs     | 22 +++++++++----
>  src/server/email_notifications.rs | 54 ++++++++++++++++++++++++++++++-
>  2 files changed, 69 insertions(+), 7 deletions(-)
> 
> diff --git a/src/api2/node/certificates.rs b/src/api2/node/certificates.rs
> index 9508ea38..1fa1e6fc 100644
> --- a/src/api2/node/certificates.rs
> +++ b/src/api2/node/certificates.rs
> @@ -13,13 +13,14 @@ use proxmox_router::list_subdirs_api_method;
>  use proxmox_schema::api;
>  use proxmox_sys::{task_log, task_warn};
>  
> -use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_MODIFY};
> +use pbs_api_types::{Notify, NODE_SCHEMA, PRIV_SYS_MODIFY};
>  use pbs_buildcfg::configdir;
>  use pbs_tools::cert;
>  
>  use crate::acme::AcmeClient;
>  use crate::api2::types::AcmeDomain;
>  use crate::config::node::NodeConfig;
> +use crate::server::send_certificate_renewal_mail;
>  use proxmox_rest_server::WorkerTask;
>  
>  pub const ROUTER: Router = Router::new()
> @@ -536,11 +537,20 @@ fn spawn_certificate_worker(
>      let auth_id = rpcenv.get_auth_id().unwrap();
>  
>      WorkerTask::spawn(name, None, auth_id, true, move |worker| async move {
> -        if let Some(cert) = order_certificate(worker, &node_config).await? {
> -            crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
> -            crate::server::reload_proxy_certificate().await?;
> -        }
> -        Ok(())
> +        let work = || async {
> +            if let Some(cert) = order_certificate(worker, &node_config).await? {
> +                crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
> +                crate::server::reload_proxy_certificate().await?;
> +            }
> +
> +            Ok(())
> +        };
> +
> +        let res = work().await;
> +
> +        send_certificate_renewal_mail(Notify::Error, &res)?;
> +
> +        res
>      })
>  }
>  
> diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
> index 4d734368..6fffefd3 100644
> --- a/src/server/email_notifications.rs
> +++ b/src/server/email_notifications.rs
> @@ -1,4 +1,4 @@
> -use anyhow::Error;
> +use anyhow::{bail, Error};
>  use serde_json::json;
>  
>  use handlebars::{Handlebars, Helper, Context, RenderError, RenderContext, Output, HelperResult, TemplateError};
> @@ -183,6 +183,18 @@ Please visit the web interface for further details:
>  
>  "###;
>  
> +const ACME_CERTIFICATE_ERR_RENEWAL: &str = r###"
> +
> +Proxmox Backup Server was not able to renew a TLS certificate.
> +
> +Error: {{error}}
> +
> +Please visit the web interface for further details:
> +
> +<https://{{fqdn}}:{{port}}/#pbsCertificateConfiguration>
> +
> +"###;
> +
>  lazy_static::lazy_static!{
>  
>      static ref HANDLEBARS: Handlebars<'static> = {
> @@ -209,6 +221,8 @@ lazy_static::lazy_static!{
>  
>              hb.register_template_string("package_update_template", PACKAGE_UPDATES_TEMPLATE)?;
>  
> +            hb.register_template_string("certificate_renewal_err_template", ACME_CERTIFICATE_ERR_RENEWAL)?;
> +
>              Ok(())
>          });
>  
> @@ -543,6 +557,42 @@ pub fn send_updates_available(
>      Ok(())
>  }
>  
> +/// send email on certificate renewal failure.
> +/// `notify` currently only accepts `Notify::Error`.
> +pub fn send_certificate_renewal_mail(
> +    notify: Notify,
> +    result: &Result<(), Error>,
> +) -> Result<(), Error> {
> +    match notify {
> +        Notify::Error => (),
> +        _ => bail!("error: renewal notifications currently only supported for 'Notify::Error'!"),
> +    }
> +
> +    let error: String = match result {
> +        Err(e) => e.to_string().into(),
> +        _ => return Ok(()),
> +    };
> +
> +    if let Some(email) = lookup_user_email(Userid::root_userid()) {
> +        let (fqdn, port) = get_server_url();
> +
> +        let text = HANDLEBARS.render(
> +            "certificate_renewal_err_template",
> +            &json!({
> +                "fqdn": fqdn,
> +                "port": port,
> +                "error": error,
> +            }),
> +        )?;
> +
> +        let subject = "Could not renew certificate";
> +
> +        send_job_status_mail(&email, subject, &text)?;
> +    }
> +
> +    Ok(())
> +}
> +
>  /// Lookup users email address
>  pub fn lookup_user_email(userid: &Userid) -> Option<String> {
>  
> @@ -648,4 +698,6 @@ fn test_template_register() {
>      assert!(HANDLEBARS.has_template("tape_backup_err_template"));
>  
>      assert!(HANDLEBARS.has_template("package_update_template"));
> +
> +    assert!(HANDLEBARS.has_template("certificate_renewal_err_template"));
>  }

ping?

Re: [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure

[Wolfgang Bumiller]

needs a rebase
also a note inline...

On Thu, Mar 31, 2022 at 11:36:55AM +0200, Stefan Sterz wrote:
> the superuser's email will be used to notify them that certificate
> renewal has failed.
> 
> Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
> ---
>  src/api2/node/certificates.rs     | 22 +++++++++----
>  src/server/email_notifications.rs | 54 ++++++++++++++++++++++++++++++-
>  2 files changed, 69 insertions(+), 7 deletions(-)
> 
(...)
> diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
> index 4d734368..6fffefd3 100644
> --- a/src/server/email_notifications.rs
> +++ b/src/server/email_notifications.rs
> @@ -543,6 +557,42 @@ pub fn send_updates_available(
>      Ok(())
>  }
>  
> +/// send email on certificate renewal failure.
> +/// `notify` currently only accepts `Notify::Error`.
> +pub fn send_certificate_renewal_mail(
> +    notify: Notify,

I think it's better to actually just drop the `notify` parameter rather
than hardcoding an unchangable value.
That way if we add support for it you'll automatically get errors at all
the call-sites from the compiler.

> +    result: &Result<(), Error>,
> +) -> Result<(), Error> {
(...)