[pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges

* [pbs-devel] [PATCH proxmox-backup] node: acme: use configured proxy for acme dns challenges
@ 2024-03-07 10:26 Hannes Laimer
  2024-07-01  9:09 ` Fabian Grünbichler
  0 siblings, 1 reply; 3+ messages in thread
From: Hannes Laimer @ 2024-03-07 10:26 UTC (permalink / raw)
  To: pbs-devel

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
came up in support, and I don't think there's a good reason to not also
use the proxy for ACME DNS challenges. tested with local proxy, curl
in `proxmox-acme` picked the env vars up correctly and used the proxy

 docs/package-repositories.rst | 5 +++--
 src/acme/plugin.rs            | 9 +++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/docs/package-repositories.rst b/docs/package-repositories.rst
index b429b4b4..969cca3c 100644
--- a/docs/package-repositories.rst
+++ b/docs/package-repositories.rst
@@ -212,8 +212,9 @@ Some setups have restricted access to the internet, sometimes only through a
 central proxy. You can setup a HTTP proxy through the Proxmox Backup Server's
 web-interface in the `Configuration -> Authentication` tab.
 
-Once configured this proxy will be used for apt network requests and for
-checking a Proxmox Backup Server support subscription.
+Once configured this proxy will be used for apt network requests, for
+checking a Proxmox Backup Server support subscription and for ACME DNS challenge
+requests.
 
 Standard HTTP proxy configurations are accepted, `[http://]<host>[:port]` where
 the `<host>` part may include an authorization, for example:
diff --git a/src/acme/plugin.rs b/src/acme/plugin.rs
index 200cf9cc..db464afe 100644
--- a/src/acme/plugin.rs
+++ b/src/acme/plugin.rs
@@ -113,6 +113,12 @@ impl DnsPlugin {
 
         let mut command = Command::new("/usr/bin/setpriv");
 
+        let (node_config, _digest) = crate::config::node::config()?;
+        let proxy: Option<String> = node_config
+            .http_proxy()
+            .map(|p| p.to_proxy_string())
+            .and_then(Result::ok);
+
         #[rustfmt::skip]
         command.args([
             "--reuid", "nobody",
@@ -120,6 +126,9 @@ impl DnsPlugin {
             "--clear-groups",
             "--reset-env",
             "--",
+            "/bin/env",
+            &proxy.as_ref().map_or("".to_string(), |p| format!("http_proxy={}", p)),
+            &proxy.as_ref().map_or("".to_string(), |p| format!("https_proxy={}", p)),
             "/bin/bash",
                 PROXMOX_ACME_SH_PATH,
                 action,
-- 
2.39.2





^ permalink raw reply	[flat|nested] 3+ messages in thread