* [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure
@ 2022-03-31 9:36 Stefan Sterz
2022-06-13 13:02 ` Stefan Sterz
2022-06-14 7:38 ` Wolfgang Bumiller
0 siblings, 2 replies; 3+ messages in thread
From: Stefan Sterz @ 2022-03-31 9:36 UTC (permalink / raw)
To: pbs-devel
the superuser's email will be used to notify them that certificate
renewal has failed.
Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
---
src/api2/node/certificates.rs | 22 +++++++++----
src/server/email_notifications.rs | 54 ++++++++++++++++++++++++++++++-
2 files changed, 69 insertions(+), 7 deletions(-)
diff --git a/src/api2/node/certificates.rs b/src/api2/node/certificates.rs
index 9508ea38..1fa1e6fc 100644
--- a/src/api2/node/certificates.rs
+++ b/src/api2/node/certificates.rs
@@ -13,13 +13,14 @@ use proxmox_router::list_subdirs_api_method;
use proxmox_schema::api;
use proxmox_sys::{task_log, task_warn};
-use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_MODIFY};
+use pbs_api_types::{Notify, NODE_SCHEMA, PRIV_SYS_MODIFY};
use pbs_buildcfg::configdir;
use pbs_tools::cert;
use crate::acme::AcmeClient;
use crate::api2::types::AcmeDomain;
use crate::config::node::NodeConfig;
+use crate::server::send_certificate_renewal_mail;
use proxmox_rest_server::WorkerTask;
pub const ROUTER: Router = Router::new()
@@ -536,11 +537,20 @@ fn spawn_certificate_worker(
let auth_id = rpcenv.get_auth_id().unwrap();
WorkerTask::spawn(name, None, auth_id, true, move |worker| async move {
- if let Some(cert) = order_certificate(worker, &node_config).await? {
- crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
- crate::server::reload_proxy_certificate().await?;
- }
- Ok(())
+ let work = || async {
+ if let Some(cert) = order_certificate(worker, &node_config).await? {
+ crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
+ crate::server::reload_proxy_certificate().await?;
+ }
+
+ Ok(())
+ };
+
+ let res = work().await;
+
+ send_certificate_renewal_mail(Notify::Error, &res)?;
+
+ res
})
}
diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
index 4d734368..6fffefd3 100644
--- a/src/server/email_notifications.rs
+++ b/src/server/email_notifications.rs
@@ -1,4 +1,4 @@
-use anyhow::Error;
+use anyhow::{bail, Error};
use serde_json::json;
use handlebars::{Handlebars, Helper, Context, RenderError, RenderContext, Output, HelperResult, TemplateError};
@@ -183,6 +183,18 @@ Please visit the web interface for further details:
"###;
+const ACME_CERTIFICATE_ERR_RENEWAL: &str = r###"
+
+Proxmox Backup Server was not able to renew a TLS certificate.
+
+Error: {{error}}
+
+Please visit the web interface for further details:
+
+<https://{{fqdn}}:{{port}}/#pbsCertificateConfiguration>
+
+"###;
+
lazy_static::lazy_static!{
static ref HANDLEBARS: Handlebars<'static> = {
@@ -209,6 +221,8 @@ lazy_static::lazy_static!{
hb.register_template_string("package_update_template", PACKAGE_UPDATES_TEMPLATE)?;
+ hb.register_template_string("certificate_renewal_err_template", ACME_CERTIFICATE_ERR_RENEWAL)?;
+
Ok(())
});
@@ -543,6 +557,42 @@ pub fn send_updates_available(
Ok(())
}
+/// send email on certificate renewal failure.
+/// `notify` currently only accepts `Notify::Error`.
+pub fn send_certificate_renewal_mail(
+ notify: Notify,
+ result: &Result<(), Error>,
+) -> Result<(), Error> {
+ match notify {
+ Notify::Error => (),
+ _ => bail!("error: renewal notifications currently only supported for 'Notify::Error'!"),
+ }
+
+ let error: String = match result {
+ Err(e) => e.to_string().into(),
+ _ => return Ok(()),
+ };
+
+ if let Some(email) = lookup_user_email(Userid::root_userid()) {
+ let (fqdn, port) = get_server_url();
+
+ let text = HANDLEBARS.render(
+ "certificate_renewal_err_template",
+ &json!({
+ "fqdn": fqdn,
+ "port": port,
+ "error": error,
+ }),
+ )?;
+
+ let subject = "Could not renew certificate";
+
+ send_job_status_mail(&email, subject, &text)?;
+ }
+
+ Ok(())
+}
+
/// Lookup users email address
pub fn lookup_user_email(userid: &Userid) -> Option<String> {
@@ -648,4 +698,6 @@ fn test_template_register() {
assert!(HANDLEBARS.has_template("tape_backup_err_template"));
assert!(HANDLEBARS.has_template("package_update_template"));
+
+ assert!(HANDLEBARS.has_template("certificate_renewal_err_template"));
}
--
2.30.2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure
2022-03-31 9:36 [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure Stefan Sterz
@ 2022-06-13 13:02 ` Stefan Sterz
2022-06-14 7:38 ` Wolfgang Bumiller
1 sibling, 0 replies; 3+ messages in thread
From: Stefan Sterz @ 2022-06-13 13:02 UTC (permalink / raw)
To: pbs-devel
On 3/31/22 11:36, Stefan Sterz wrote:
> the superuser's email will be used to notify them that certificate
> renewal has failed.
>
> Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
> ---
> src/api2/node/certificates.rs | 22 +++++++++----
> src/server/email_notifications.rs | 54 ++++++++++++++++++++++++++++++-
> 2 files changed, 69 insertions(+), 7 deletions(-)
>
> diff --git a/src/api2/node/certificates.rs b/src/api2/node/certificates.rs
> index 9508ea38..1fa1e6fc 100644
> --- a/src/api2/node/certificates.rs
> +++ b/src/api2/node/certificates.rs
> @@ -13,13 +13,14 @@ use proxmox_router::list_subdirs_api_method;
> use proxmox_schema::api;
> use proxmox_sys::{task_log, task_warn};
>
> -use pbs_api_types::{NODE_SCHEMA, PRIV_SYS_MODIFY};
> +use pbs_api_types::{Notify, NODE_SCHEMA, PRIV_SYS_MODIFY};
> use pbs_buildcfg::configdir;
> use pbs_tools::cert;
>
> use crate::acme::AcmeClient;
> use crate::api2::types::AcmeDomain;
> use crate::config::node::NodeConfig;
> +use crate::server::send_certificate_renewal_mail;
> use proxmox_rest_server::WorkerTask;
>
> pub const ROUTER: Router = Router::new()
> @@ -536,11 +537,20 @@ fn spawn_certificate_worker(
> let auth_id = rpcenv.get_auth_id().unwrap();
>
> WorkerTask::spawn(name, None, auth_id, true, move |worker| async move {
> - if let Some(cert) = order_certificate(worker, &node_config).await? {
> - crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
> - crate::server::reload_proxy_certificate().await?;
> - }
> - Ok(())
> + let work = || async {
> + if let Some(cert) = order_certificate(worker, &node_config).await? {
> + crate::config::set_proxy_certificate(&cert.certificate, &cert.private_key_pem)?;
> + crate::server::reload_proxy_certificate().await?;
> + }
> +
> + Ok(())
> + };
> +
> + let res = work().await;
> +
> + send_certificate_renewal_mail(Notify::Error, &res)?;
> +
> + res
> })
> }
>
> diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
> index 4d734368..6fffefd3 100644
> --- a/src/server/email_notifications.rs
> +++ b/src/server/email_notifications.rs
> @@ -1,4 +1,4 @@
> -use anyhow::Error;
> +use anyhow::{bail, Error};
> use serde_json::json;
>
> use handlebars::{Handlebars, Helper, Context, RenderError, RenderContext, Output, HelperResult, TemplateError};
> @@ -183,6 +183,18 @@ Please visit the web interface for further details:
>
> "###;
>
> +const ACME_CERTIFICATE_ERR_RENEWAL: &str = r###"
> +
> +Proxmox Backup Server was not able to renew a TLS certificate.
> +
> +Error: {{error}}
> +
> +Please visit the web interface for further details:
> +
> +<https://{{fqdn}}:{{port}}/#pbsCertificateConfiguration>
> +
> +"###;
> +
> lazy_static::lazy_static!{
>
> static ref HANDLEBARS: Handlebars<'static> = {
> @@ -209,6 +221,8 @@ lazy_static::lazy_static!{
>
> hb.register_template_string("package_update_template", PACKAGE_UPDATES_TEMPLATE)?;
>
> + hb.register_template_string("certificate_renewal_err_template", ACME_CERTIFICATE_ERR_RENEWAL)?;
> +
> Ok(())
> });
>
> @@ -543,6 +557,42 @@ pub fn send_updates_available(
> Ok(())
> }
>
> +/// send email on certificate renewal failure.
> +/// `notify` currently only accepts `Notify::Error`.
> +pub fn send_certificate_renewal_mail(
> + notify: Notify,
> + result: &Result<(), Error>,
> +) -> Result<(), Error> {
> + match notify {
> + Notify::Error => (),
> + _ => bail!("error: renewal notifications currently only supported for 'Notify::Error'!"),
> + }
> +
> + let error: String = match result {
> + Err(e) => e.to_string().into(),
> + _ => return Ok(()),
> + };
> +
> + if let Some(email) = lookup_user_email(Userid::root_userid()) {
> + let (fqdn, port) = get_server_url();
> +
> + let text = HANDLEBARS.render(
> + "certificate_renewal_err_template",
> + &json!({
> + "fqdn": fqdn,
> + "port": port,
> + "error": error,
> + }),
> + )?;
> +
> + let subject = "Could not renew certificate";
> +
> + send_job_status_mail(&email, subject, &text)?;
> + }
> +
> + Ok(())
> +}
> +
> /// Lookup users email address
> pub fn lookup_user_email(userid: &Userid) -> Option<String> {
>
> @@ -648,4 +698,6 @@ fn test_template_register() {
> assert!(HANDLEBARS.has_template("tape_backup_err_template"));
>
> assert!(HANDLEBARS.has_template("package_update_template"));
> +
> + assert!(HANDLEBARS.has_template("certificate_renewal_err_template"));
> }
ping?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure
2022-03-31 9:36 [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure Stefan Sterz
2022-06-13 13:02 ` Stefan Sterz
@ 2022-06-14 7:38 ` Wolfgang Bumiller
1 sibling, 0 replies; 3+ messages in thread
From: Wolfgang Bumiller @ 2022-06-14 7:38 UTC (permalink / raw)
To: Stefan Sterz; +Cc: pbs-devel
needs a rebase
also a note inline...
On Thu, Mar 31, 2022 at 11:36:55AM +0200, Stefan Sterz wrote:
> the superuser's email will be used to notify them that certificate
> renewal has failed.
>
> Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
> ---
> src/api2/node/certificates.rs | 22 +++++++++----
> src/server/email_notifications.rs | 54 ++++++++++++++++++++++++++++++-
> 2 files changed, 69 insertions(+), 7 deletions(-)
>
(...)
> diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
> index 4d734368..6fffefd3 100644
> --- a/src/server/email_notifications.rs
> +++ b/src/server/email_notifications.rs
> @@ -543,6 +557,42 @@ pub fn send_updates_available(
> Ok(())
> }
>
> +/// send email on certificate renewal failure.
> +/// `notify` currently only accepts `Notify::Error`.
> +pub fn send_certificate_renewal_mail(
> + notify: Notify,
I think it's better to actually just drop the `notify` parameter rather
than hardcoding an unchangable value.
That way if we add support for it you'll automatically get errors at all
the call-sites from the compiler.
> + result: &Result<(), Error>,
> +) -> Result<(), Error> {
(...)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-06-14 7:38 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-31 9:36 [pbs-devel] [PATCH proxmox-backup v2] fix #3867: server/api: send emails on certificate renewal failure Stefan Sterz
2022-06-13 13:02 ` Stefan Sterz
2022-06-14 7:38 ` Wolfgang Bumiller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox