[PATCH datacenter-manager v4 0/5] fix #7179: expose ACME commands inside admin CLI

[PATCH datacenter-manager v4 0/5] fix #7179: expose ACME commands inside admin CLI

[Shan Shaji]

Previously, ACME commands were not exposed through the admin CLI.
Added the necessary functionality to manage ACME settings directly
via the command line. The changes are done by taking reference from
the proxmox-backup codebase.

changes since v3:
- Rebase with master.
- rephrase commit messages.
- retested the changes again.
 
changes since v2: Thanks @Lukas
- revert the use of `tasklog` function to tasklog_pbs.
- revert string from "set-up" to "set up".
- use `matches!` macro instead `&&` operator.
- add seperate patch that uses the `ACME_CONTACT_LIST_SCHEMA` on ACME account
  update endpoint.
- add doc comments for the AcmeRegistrationParams public fields.
- use 1-based indexing to choose the directory endpoints.

changes since v1: Thanks @Lukas
- fixed formating.
- refactor the input prompt into a seperate method - `read_input`.
- defined a new struct ``AcmeRegistrationParams` and update the API
  method signature to accept only one parameter.
- used the API `register_account` method instead of using the
  `proxmox-acme-api::register_account` function.
- added `tasklog` layer to capture worker task logs.
- added `context` method to preserve the error messages.

Testing 
=======

I have verified the following:
- account (deactivate, info, list, update)
- certificate (order, revoke)
- plugin (add, config, list, remove, set)
- Verified external account binding using google's ACME directory 
  url and public CA (GTS). 

### Certifcate Creation 

http-01 challenge:
-----------------

I have tested the http-01 challenge verification using a test
pebble server. 
    
Steps followed to test the changes:

1. Installed the changes inside a PDM VM. 
2. install Pebble from Let's Encrypt [1] on the same VM:

    cd
    apt update
    apt install -y golang git
    git clone https://github.com/letsencrypt/pebble
    cd pebble
    go build ./cmd/pebble

    then, download and trust the Pebble cert:

    wget https://raw.githubusercontent.com/letsencrypt/pebble/main/test/certs/pebble.minica.pem
    cp pebble.minica.pem /usr/local/share/ca-certificates/pebble.minica.crt
    update-ca-certificates

3. We want Pebble to perform HTTP-01 validation against port 80, because
   PDM's standalone plugin will bind port 80. Set httpPort to 80.

    nano ./test/config/pebble-config.json

4. Start the Pebble server in the background:

    ./pebble -config ./test/config/pebble-config.json &

5. Created a Pebble ACME account:

    proxmox-datacenter-manager-admin acme account register default admin@example.com --directory 'https://127.0.0.1:14000/dir'

6. Added a new ACME domain pdm.proxmox.com with HTTP challenge type. Then
   ran the following command.

   proxmox-datacenter-manager admin acme certificate order --force true

7. Checked if the certificate is validated by the pebble CA. 

Ran the revoke command and verified if the certificate is self-signed
after force refresh. 

---

DNS-01 challenge: 
----------------

I tested the changes with my domain using the cloudflare plugin. 

Steps followed to test the changes:

1. Created an ACME account using let's encrypt staging API. 
2. Add a new plugin using the following command

   proxmox-datacenter-manager-admin acme plugin add dns cloudflare --api cf --data ./cf_tokens 
   cf_tokens had the following credentials:

      - CF_Account_ID=""
      - CF_Token=""

3. Added my cloudflare managed domain under ACME Domains using the UI. 
4. Ordered the certificate using the following command. 

    proxmox-datacenter-manager-admin acme certificate order --force true

5. Force refreshed the browser and verified that the new certificate is
   verified by (STAGING) Let's Encrypt

6. Revoked the certificate using the following command. 

	proxmox-datacenter-manager-admin acme certificate revoke

7. Verified the new certificate is self-signed.

[1] - https://github.com/letsencrypt/pebble


Shan Shaji (5):
  cli: admin: initialize worker tasks before calling acme API methods
  api: acme: define API type for ACME registration parameters
  server: api: add contact schema for ACME account update endpoint
  fix #7179: cli: admin: add commands to manage ACME settings
  chore: update proxmox-acme version to 1

 Cargo.toml                    |   2 +-
 cli/admin/Cargo.toml          |   7 +-
 cli/admin/src/acme.rs         | 446 ++++++++++++++++++++++++++++++++++
 cli/admin/src/main.rs         |  62 +++--
 lib/pdm-api-types/src/acme.rs |  65 +++++
 lib/pdm-api-types/src/lib.rs  |   2 +
 server/src/api/config/acme.rs |  51 ++--
 7 files changed, 581 insertions(+), 54 deletions(-)
 create mode 100644 cli/admin/src/acme.rs
 create mode 100644 lib/pdm-api-types/src/acme.rs

-- 
2.47.3

[PATCH datacenter-manager v4 1/5] cli: admin: initialize worker tasks before calling acme API methods

[Shan Shaji]

The acme API methods internally create workers to process API requests.
An error was thrown if the methods are invoked without initializing the
worker tasks.

Since `init_worker_tasks` needs to be called from an async runtime.
Moved the content of the main function to an async `run` function and
wrapped the same using `proxmox_async::runtime::main`, which creates a
Tokio runtime.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
Reviewed-by: Lukas Wagner <l.wagner@proxmox.com>
Tested-by: Lukas Wagner <l.wagner@proxmox.com>
---
 changes since v3:
  - rephrase the commit message. 
 changes since v2: Thanks @Lukas
 - change string from "set-up" to "set up".
 - use matches! macro instead of && operator.

 cli/admin/Cargo.toml  |  3 +++
 cli/admin/src/main.rs | 58 +++++++++++++++++++++++++++++--------------
 2 files changed, 43 insertions(+), 18 deletions(-)

diff --git a/cli/admin/Cargo.toml b/cli/admin/Cargo.toml
index 0dec423..e566b39 100644
--- a/cli/admin/Cargo.toml
+++ b/cli/admin/Cargo.toml
@@ -19,6 +19,9 @@ proxmox-product-config.workspace = true
 proxmox-router = { workspace = true, features = [ "cli" ], default-features = false }
 proxmox-schema = { workspace = true, features = [ "api-macro" ] }
 proxmox-access-control.workspace = true
+proxmox-rest-server.workspace = true
+proxmox-sys.workspace = true
+proxmox-daemon.workspace = true
 
 pdm-api-types.workspace = true
 pdm-config.workspace = true
diff --git a/cli/admin/src/main.rs b/cli/admin/src/main.rs
index f698fa2..befa594 100644
--- a/cli/admin/src/main.rs
+++ b/cli/admin/src/main.rs
@@ -1,35 +1,35 @@
+use core::matches;
+
+use anyhow::{Context, Error};
 use serde_json::{json, Value};
 
 use proxmox_router::cli::{
-    default_table_format_options, format_and_print_result_full, get_output_format, run_cli_command,
-    CliCommand, CliCommandMap, CliEnvironment, ColumnConfig, OUTPUT_FORMAT,
+    default_table_format_options, format_and_print_result_full, get_output_format,
+    run_async_cli_command, CliCommand, CliCommandMap, CliEnvironment, ColumnConfig, OUTPUT_FORMAT,
 };
 use proxmox_router::RpcEnvironment;
-
 use proxmox_schema::api;
+use proxmox_sys::fs::CreateOptions;
 
 mod remotes;
 mod support_status;
 
-fn main() {
-    //pbs_tools::setup_libc_malloc_opts(); // TODO: move from PBS to proxmox-sys and uncomment
-
-    let api_user = pdm_config::api_user().expect("cannot get api user");
-    let priv_user = pdm_config::priv_user().expect("cannot get privileged user");
-    proxmox_product_config::init(api_user, priv_user);
+async fn run() -> Result<(), Error> {
+    let api_user = pdm_config::api_user().context("could not get api user")?;
+    let priv_user = pdm_config::priv_user().context("could not get privileged user")?;
 
+    proxmox_product_config::init(api_user.clone(), priv_user);
     proxmox_access_control::init::init(
         &pdm_api_types::AccessControlConfig,
         pdm_buildcfg::configdir!("/access"),
     )
-    .expect("failed to setup access control config");
-
+    .context("failed to setup access control config")?;
     proxmox_log::Logger::from_env("PDM_LOG", proxmox_log::LevelFilter::INFO)
         .stderr()
         .init()
-        .expect("failed to set up logger");
+        .context("failed to set up logger")?;
 
-    server::context::init().expect("could not set up server context");
+    server::context::init().context("could not set up server context")?;
 
     let cmd_def = CliCommandMap::new()
         .insert("remote", remotes::cli())
@@ -40,14 +40,36 @@ fn main() {
         .insert("support-status", support_status::cli())
         .insert("versions", CliCommand::new(&API_METHOD_GET_VERSIONS));
 
+    let args: Vec<String> = std::env::args().collect();
+    let avoid_init = matches!(
+        args.get(1).map(String::as_str),
+        Some("bashcomplete") | Some("printdoc")
+    );
+
+    if !avoid_init {
+        let file_opts = CreateOptions::new().owner(api_user.uid).group(api_user.gid);
+        proxmox_rest_server::init_worker_tasks(pdm_buildcfg::PDM_LOG_DIR_M!().into(), file_opts)
+            .context("failed to initialize worker tasks")?;
+
+        let mut command_sock = proxmox_daemon::command_socket::CommandSocket::new(api_user.gid);
+        proxmox_rest_server::register_task_control_commands(&mut command_sock)
+            .context("failed to register task control commands")?;
+        command_sock
+            .spawn(proxmox_rest_server::last_worker_future())
+            .context("failed to activate the socket")?;
+    }
+
     let mut rpcenv = CliEnvironment::new();
     rpcenv.set_auth_id(Some("root@pam".into()));
 
-    run_cli_command(
-        cmd_def,
-        rpcenv,
-        Some(|future| proxmox_async::runtime::main(future)),
-    );
+    run_async_cli_command(cmd_def, rpcenv).await;
+
+    Ok(())
+}
+
+fn main() -> Result<(), Error> {
+    //pbs_tools::setup_libc_malloc_opts(); // TODO: move from PBS to proxmox-sys and uncomment
+    proxmox_async::runtime::main(run())
 }
 
 #[api(
-- 
2.47.3

[PATCH datacenter-manager v4 2/5] api: acme: define API type for ACME registration parameters

[Shan Shaji]

Earlier, the ACME CLI was using the proxmox-acme-api crate's register
function to register an ACME account. Since it did not create a worker
task internally, the logs were not being recorded in the task log file.

The API handler function accepts a `Value` type, inorder to pass the
parameters from the CLI, it had to be converted into a `Value` type. To
support this defined a new struct to create the request parameters. This
also makes sure that even if additional parameters are added later, they
are not forgotten in the CLI tool.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 changes since v3:
 - fix merge conflicts inside the register_account function. 
 changes since v2: Thanks @Lukas
 - add doc comments for AcmeRegistrationParams fields.
 
 lib/pdm-api-types/src/acme.rs | 65 +++++++++++++++++++++++++++++++++++
 lib/pdm-api-types/src/lib.rs  |  2 ++
 server/src/api/config/acme.rs | 48 ++++++++------------------
 3 files changed, 82 insertions(+), 33 deletions(-)
 create mode 100644 lib/pdm-api-types/src/acme.rs

diff --git a/lib/pdm-api-types/src/acme.rs b/lib/pdm-api-types/src/acme.rs
new file mode 100644
index 0000000..8684eac
--- /dev/null
+++ b/lib/pdm-api-types/src/acme.rs
@@ -0,0 +1,65 @@
+use serde::{Deserialize, Serialize};
+
+use proxmox_acme_api::AcmeAccountName;
+use proxmox_schema::{api, ApiStringFormat, ArraySchema, Schema, StringSchema};
+
+use crate::EMAIL_SCHEMA;
+
+pub const ACME_CONTACT_LIST_SCHEMA: Schema =
+    StringSchema::new("List of email addresses, comma seperated.")
+        .format(&ApiStringFormat::PropertyString(
+            &ArraySchema::new("Contact list.", &EMAIL_SCHEMA).schema(),
+        ))
+        .schema();
+
+#[api(
+    properties: {
+        name: {
+            type: AcmeAccountName,
+            optional: true,
+        },
+        contact: {
+            schema: ACME_CONTACT_LIST_SCHEMA
+        },
+        tos_url: {
+            type: String,
+            optional: true,
+        },
+        directory: {
+            type: String,
+            optional: true,
+        },
+        eab_kid: {
+            type: String,
+            optional: true,
+        },
+        eab_hmac_key: {
+            type: String,
+            optional: true,
+        }
+    },
+)]
+#[derive(Serialize, Deserialize)]
+/// ACME account registration properties.
+pub struct AcmeRegistrationParams {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<AcmeAccountName>,
+
+    pub contact: String,
+
+    /// URL of CA TermsOfService - setting this indicates agreement.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tos_url: Option<String>,
+
+    /// The ACME Directory.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub directory: Option<String>,
+
+    /// Key Identifier for External Account Binding.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub eab_kid: Option<String>,
+
+    /// HMAC key for External Account Binding.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub eab_hmac_key: Option<String>,
+}
diff --git a/lib/pdm-api-types/src/lib.rs b/lib/pdm-api-types/src/lib.rs
index d4cc7ef..fec3c8f 100644
--- a/lib/pdm-api-types/src/lib.rs
+++ b/lib/pdm-api-types/src/lib.rs
@@ -116,6 +116,8 @@ pub mod sdn;
 
 pub mod views;
 
+pub mod acme;
+
 const_regex! {
     // just a rough check - dummy acceptor is used before persisting
     pub OPENSSL_CIPHERS_REGEX = r"^[0-9A-Za-z_:, +!\-@=.]+$";
diff --git a/server/src/api/config/acme.rs b/server/src/api/config/acme.rs
index e18975a..cd85ef4 100644
--- a/server/src/api/config/acme.rs
+++ b/server/src/api/config/acme.rs
@@ -1,5 +1,6 @@
 use anyhow::{Context, Error};
 
+use pdm_api_types::acme::AcmeRegistrationParams;
 use proxmox_router::list_subdirs_api_method;
 use proxmox_router::{Router, RpcEnvironment, SubdirMap};
 
@@ -79,31 +80,9 @@ pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
 #[api(
     input: {
         properties: {
-            name: {
-                type: AcmeAccountName,
-                optional: true,
-            },
-            contact: {
-                description: "List of email addresses.",
-            },
-            tos_url: {
-                description: "URL of CA TermsOfService - setting this indicates agreement.",
-                optional: true,
-            },
-            directory: {
-                type: String,
-                description: "The ACME Directory.",
-                optional: true,
-            },
-            eab_kid: {
-                type: String,
-                description: "Key Identifier for External Account Binding.",
-                optional: true,
-            },
-            eab_hmac_key: {
-                type: String,
-                description: "HMAC Key for External Account Binding.",
-                optional: true,
+            params: {
+                type: AcmeRegistrationParams,
+                flatten: true
             }
         },
     },
@@ -116,16 +95,19 @@ pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
     },
 )]
 /// Register an ACME account.
-fn register_account(
-    name: Option<AcmeAccountName>,
-    // Todo: email & email-list schema
-    contact: String,
-    tos_url: Option<String>,
-    directory: Option<String>,
-    eab_kid: Option<String>,
-    eab_hmac_key: Option<String>,
+pub fn register_account(
+    params: AcmeRegistrationParams,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<String, Error> {
+    let AcmeRegistrationParams {
+        name,
+        contact,
+        tos_url,
+        directory,
+        eab_kid,
+        eab_hmac_key,
+    } = params;
+
     let auth_id = rpcenv.get_auth_id().context("no authid available")?;
     let name = name.unwrap_or_else(|| unsafe {
         AcmeAccountName::from_string_unchecked("default".to_string())
-- 
2.47.3

[PATCH datacenter-manager v4 3/5] server: api: add contact schema for ACME account update endpoint

[Shan Shaji]

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 changes since v3: No changes

 server/src/api/config/acme.rs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/server/src/api/config/acme.rs b/server/src/api/config/acme.rs
index cd85ef4..6055ff8 100644
--- a/server/src/api/config/acme.rs
+++ b/server/src/api/config/acme.rs
@@ -1,6 +1,6 @@
 use anyhow::{Context, Error};
 
-use pdm_api_types::acme::AcmeRegistrationParams;
+use pdm_api_types::acme::{AcmeRegistrationParams, ACME_CONTACT_LIST_SCHEMA};
 use proxmox_router::list_subdirs_api_method;
 use proxmox_router::{Router, RpcEnvironment, SubdirMap};
 
@@ -169,7 +169,7 @@ pub async fn get_account(name: AcmeAccountName) -> Result<AccountInfo, Error> {
         properties: {
             name: { type: AcmeAccountName },
             contact: {
-                description: "List of email addresses.",
+                schema: ACME_CONTACT_LIST_SCHEMA,
                 optional: true,
             },
         },
@@ -185,7 +185,6 @@ pub async fn get_account(name: AcmeAccountName) -> Result<AccountInfo, Error> {
 /// Update an ACME account.
 pub fn update_account(
     name: AcmeAccountName,
-    // Todo: email & email-list schema
     contact: Option<String>,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<String, Error> {
-- 
2.47.3

[PATCH datacenter-manager v4 4/5] fix #7179: cli: admin: add commands to manage ACME settings

[Shan Shaji]

Previously, ACME commands were not exposed through the admin CLI.
Added the necessary functionality to manage ACME settings directly
via the command line.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---

 changes since v3:
 - rephrase commit message.
  
 changes since v2: Thanks @Lukas
 - use 1-based indexing inside the register account wizard.
 - use old `tasklog_pbs` instead of tasklog.

 cli/admin/Cargo.toml  |   4 +-
 cli/admin/src/acme.rs | 446 ++++++++++++++++++++++++++++++++++++++++++
 cli/admin/src/main.rs |   6 +
 3 files changed, 455 insertions(+), 1 deletion(-)
 create mode 100644 cli/admin/src/acme.rs

diff --git a/cli/admin/Cargo.toml b/cli/admin/Cargo.toml
index e566b39..01afc88 100644
--- a/cli/admin/Cargo.toml
+++ b/cli/admin/Cargo.toml
@@ -22,7 +22,9 @@ proxmox-access-control.workspace = true
 proxmox-rest-server.workspace = true
 proxmox-sys.workspace = true
 proxmox-daemon.workspace = true
-
+proxmox-acme.workspace = true
+proxmox-acme-api.workspace = true
+proxmox-base64.workspace = true
 pdm-api-types.workspace = true
 pdm-config.workspace = true
 pdm-buildcfg.workspace = true
diff --git a/cli/admin/src/acme.rs b/cli/admin/src/acme.rs
new file mode 100644
index 0000000..6bda844
--- /dev/null
+++ b/cli/admin/src/acme.rs
@@ -0,0 +1,446 @@
+use std::io::Write;
+
+use anyhow::{bail, Error};
+use serde_json::Value;
+
+use pdm_api_types::acme::AcmeRegistrationParams;
+use proxmox_acme::async_client::AcmeClient;
+use proxmox_acme_api::{completion::*, AcmeAccountName, DnsPluginCore, KNOWN_ACME_DIRECTORIES};
+use proxmox_rest_server::wait_for_local_worker;
+use proxmox_router::{cli::*, ApiHandler, RpcEnvironment};
+use proxmox_schema::api;
+use proxmox_sys::fs::file_get_contents;
+
+use server::api as dc_api;
+
+pub fn acme_mgmt_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("account", account_cli())
+        .insert("plugin", plugin_cli())
+        .insert("certificate", cert_cli());
+
+    cmd_def.into()
+}
+
+#[api(
+    input: {
+        properties: {
+                "output-format": {
+                    schema: OUTPUT_FORMAT,
+                    optional: true,
+                }
+            }
+    }
+)]
+/// List ACME accounts.
+fn list_accounts(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+    let info = &dc_api::config::acme::API_METHOD_LIST_ACCOUNTS;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options();
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            name: { type:  AcmeAccountName },
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+        }
+    }
+)]
+/// Show ACME account information.
+async fn get_account(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+
+    let info = &dc_api::config::acme::API_METHOD_GET_ACCOUNT;
+    let mut data = match info.handler {
+        ApiHandler::Async(handler) => (handler)(param, info, rpcenv).await?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options()
+        .column(
+            ColumnConfig::new("account")
+                .renderer(|value, _record| Ok(serde_json::to_string_pretty(value)?)),
+        )
+        .column(ColumnConfig::new("directory"))
+        .column(ColumnConfig::new("location"))
+        .column(ColumnConfig::new("tos"));
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+fn read_input(prompt: &str) -> Result<String, Error> {
+    print!("{}: ", prompt);
+    std::io::stdout().flush()?;
+    let mut input = String::new();
+    std::io::stdin().read_line(&mut input)?;
+    Ok(input)
+}
+
+#[api(
+    input: {
+        properties: {
+            name: { type: AcmeAccountName },
+            contact: {
+                description: "List of email addresses.",
+                type: String,
+            },
+            directory: {
+                type: String,
+                description: "The ACME Directory.",
+                optional: true,
+            },
+        }
+    }
+)]
+///Register an ACME account.
+async fn register_account(
+    name: AcmeAccountName,
+    contact: String,
+    directory: Option<String>,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let (directory_url, custom_directory) = match directory {
+        Some(directory) => (directory, true),
+        None => {
+            println!("Directory endpoints:");
+            for (i, dir) in KNOWN_ACME_DIRECTORIES.iter().enumerate() {
+                println!("{}) {}", i + 1, dir.url);
+            }
+
+            let known_acme_dir_len = KNOWN_ACME_DIRECTORIES.len();
+            println!("{}) Custom", known_acme_dir_len + 1);
+            let mut attempt = 0;
+            loop {
+                let mut input = read_input("Enter selection")?;
+                match input.trim().parse::<usize>() {
+                    Ok(n) if (1..=known_acme_dir_len).contains(&n) => {
+                        break (KNOWN_ACME_DIRECTORIES[n - 1].url.to_string(), false);
+                    }
+                    Ok(n) if n == known_acme_dir_len + 1 => {
+                        input.clear();
+                        input = read_input("Enter custom directory URI")?;
+                        break (input.trim().to_owned(), true);
+                    }
+                    _ => eprintln!("Invalid selection."),
+                }
+
+                attempt += 1;
+                if attempt >= 3 {
+                    bail!("Aborting.");
+                }
+            }
+        }
+    };
+
+    println!("Attempting to fetch Terms of Service from {directory_url:?}");
+    let mut client = AcmeClient::new(directory_url.clone());
+    let directory = client.directory().await?;
+    let tos_agreed = if let Some(tos_url) = directory.terms_of_service_url() {
+        println!("Terms of Service: {tos_url}");
+        let input = read_input("Do you agree to the above terms? [y|N]")?;
+        input.trim().eq_ignore_ascii_case("y")
+    } else {
+        println!("No Terms of Service found, proceeding.");
+        true
+    };
+
+    let mut eab_enabled = directory.external_account_binding_required();
+    if !eab_enabled && custom_directory {
+        let input = read_input("Do you want to use external account binding? [y|N]")?;
+        eab_enabled = input.trim().eq_ignore_ascii_case("y");
+    } else if eab_enabled {
+        println!("The CA requires external account binding.");
+    }
+
+    let eab_creds = if eab_enabled {
+        println!("You should have received a key id and a key from your CA.");
+        let eab_kid = read_input("Enter EAB key id")?;
+        let eab_hmac_key = read_input("Enter EAB key")?;
+        Some((eab_kid.trim().to_owned(), eab_hmac_key.trim().to_owned()))
+    } else {
+        None
+    };
+
+    let tos_url = tos_agreed
+        .then(|| directory.terms_of_service_url().map(str::to_owned))
+        .flatten();
+
+    let (eab_kid, eab_hmac_key) = eab_creds.unzip();
+    let parameters = AcmeRegistrationParams {
+        name: Some(name),
+        contact: contact,
+        tos_url: tos_url,
+        directory: Some(directory_url),
+        eab_kid: eab_kid,
+        eab_hmac_key: eab_hmac_key,
+    };
+    let param = serde_json::to_value(parameters)?;
+
+    let info = &dc_api::config::acme::API_METHOD_REGISTER_ACCOUNT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+#[api(
+    input: {
+       properties: {
+           name: { type: AcmeAccountName },
+           contact:  {
+               description: "List of email addresses.",
+               type: String,
+               optional: true,
+           }
+       }
+    }
+)]
+/// Update an ACME Account.
+async fn update_account(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let info = &dc_api::config::acme::API_METHOD_UPDATE_ACCOUNT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            name: { type: AcmeAccountName },
+            force: {
+                description: "Delete account data even if the server refuses to deactivate the account.",
+                type: Boolean,
+                optional: true,
+                default: true,
+            }
+        }
+    }
+)]
+/// Deactivate an ACME account.
+async fn deactivate_account(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let info = &dc_api::config::acme::API_METHOD_DEACTIVATE_ACCOUNT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+fn account_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("list", CliCommand::new(&API_METHOD_LIST_ACCOUNTS))
+        .insert(
+            "register",
+            CliCommand::new(&API_METHOD_REGISTER_ACCOUNT).arg_param(&["name", "contact"]),
+        )
+        .insert(
+            "deactivate",
+            CliCommand::new(&API_METHOD_DEACTIVATE_ACCOUNT)
+                .arg_param(&["name"])
+                .completion_cb("name", complete_acme_account),
+        )
+        .insert(
+            "info",
+            CliCommand::new(&API_METHOD_GET_ACCOUNT)
+                .arg_param(&["name"])
+                .completion_cb("name", complete_acme_account),
+        )
+        .insert(
+            "update",
+            CliCommand::new(&API_METHOD_UPDATE_ACCOUNT)
+                .arg_param(&["name", "contact"])
+                .completion_cb("name", complete_acme_account),
+        );
+
+    cmd_def.into()
+}
+
+#[api(
+    input: {
+        properties: {
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+        }
+    }
+)]
+/// List ACME plugins.
+fn list_plugins(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+
+    let info = &dc_api::config::acme::API_METHOD_LIST_PLUGINS;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options();
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+#[api(
+    input: {
+        properties: {
+            id: {
+                type: String,
+                description: "Plugin ID",
+            },
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+        }
+    }
+)]
+/// Show ACME plugin information.
+fn get_plugin(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let output_format = get_output_format(&param);
+
+    let info = &dc_api::config::acme::API_METHOD_GET_PLUGIN;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options();
+    format_and_print_result_full(&mut data, &info.returns, &output_format, &options);
+
+    Ok(())
+}
+
+#[api(input: {
+    properties: {
+        type: {
+            type: String,
+            description: "The ACME challenge plugin type."
+        },
+        core: {
+            type: DnsPluginCore,
+            flatten: true,
+        },
+        data: {
+            type: String,
+            description: "File containing the plugin data."
+        }
+    }
+})]
+/// Add ACME plugin configuration.
+fn add_plugin(r#type: String, core: DnsPluginCore, data: String) -> Result<(), Error> {
+    let data = proxmox_base64::encode(file_get_contents(data)?);
+    dc_api::config::acme::add_plugin(r#type, core, data)?;
+    Ok(())
+}
+
+pub fn plugin_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("list", CliCommand::new(&API_METHOD_LIST_PLUGINS))
+        .insert(
+            "config",
+            CliCommand::new(&API_METHOD_GET_PLUGIN)
+                .arg_param(&["id"])
+                .completion_cb("id", complete_acme_plugin),
+        )
+        .insert(
+            "add",
+            CliCommand::new(&API_METHOD_ADD_PLUGIN)
+                .arg_param(&["type", "id"])
+                .completion_cb("api", complete_acme_api_challenge_type)
+                .completion_cb("type", complete_acme_plugin_type),
+        )
+        .insert(
+            "remove",
+            CliCommand::new(&dc_api::config::acme::API_METHOD_DELETE_PLUGIN)
+                .arg_param(&["id"])
+                .completion_cb("id", complete_acme_plugin),
+        )
+        .insert(
+            "set",
+            CliCommand::new(&dc_api::config::acme::API_METHOD_UPDATE_PLUGIN)
+                .arg_param(&["id"])
+                .completion_cb("id", complete_acme_plugin),
+        );
+
+    cmd_def.into()
+}
+
+#[api(
+    input: {
+        properties: {
+            force: {
+                description: "Force renewal even if the certificate does not expire soon.",
+                type: Boolean,
+                optional: true,
+                default: false,
+            },
+        },
+    },
+)]
+/// Order a new ACME certificate.
+async fn order_acme_cert(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    if !param["force"].as_bool().unwrap_or(false)
+        && !dc_api::nodes::certificates::cert_expires_soon()?
+    {
+        println!("Certificate does not expire within the next 30 days, not renewing.");
+        return Ok(());
+    }
+
+    let info = &dc_api::nodes::certificates::API_METHOD_RENEW_ACME_CERT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+#[api]
+/// Revoke ACME certificate.
+async fn revoke_acme_cert(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> {
+    let info = &dc_api::nodes::certificates::API_METHOD_REVOKE_ACME_CERT;
+    let result = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    wait_for_local_worker(result.as_str().unwrap()).await?;
+
+    Ok(())
+}
+
+pub fn cert_cli() -> CommandLineInterface {
+    let cmd_def = CliCommandMap::new()
+        .insert("order", CliCommand::new(&API_METHOD_ORDER_ACME_CERT))
+        .insert("revoke", CliCommand::new(&API_METHOD_REVOKE_ACME_CERT));
+
+    cmd_def.into()
+}
diff --git a/cli/admin/src/main.rs b/cli/admin/src/main.rs
index befa594..7f0b339 100644
--- a/cli/admin/src/main.rs
+++ b/cli/admin/src/main.rs
@@ -11,6 +11,7 @@ use proxmox_router::RpcEnvironment;
 use proxmox_schema::api;
 use proxmox_sys::fs::CreateOptions;
 
+mod acme;
 mod remotes;
 mod support_status;
 
@@ -24,7 +25,11 @@ async fn run() -> Result<(), Error> {
         pdm_buildcfg::configdir!("/access"),
     )
     .context("failed to setup access control config")?;
+    proxmox_acme_api::init(pdm_buildcfg::configdir!("/acme"), false)
+        .context("failed to initialize acme config")?;
+
     proxmox_log::Logger::from_env("PDM_LOG", proxmox_log::LevelFilter::INFO)
+        .tasklog_pbs()
         .stderr()
         .init()
         .context("failed to set up logger")?;
@@ -32,6 +37,7 @@ async fn run() -> Result<(), Error> {
     server::context::init().context("could not set up server context")?;
 
     let cmd_def = CliCommandMap::new()
+        .insert("acme", acme::acme_mgmt_cli())
         .insert("remote", remotes::cli())
         .insert(
             "report",
-- 
2.47.3

[PATCH datacenter-manager v4 5/5] chore: update proxmox-acme version to 1

[Shan Shaji]

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 1adb8a0..ec2aa3d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ proxmox-upgrade-checks = "1"
 proxmox-uuid = "1"
 
 # other proxmox crates
-proxmox-acme = "0.5"
+proxmox-acme = "1.0"
 proxmox-openid = "1.0.2"
 
 # api implementation creates
-- 
2.47.3

applied: [PATCH datacenter-manager v4 0/5] fix #7179: expose ACME commands inside admin CLI

[Lukas Wagner]

On Wed, 01 Apr 2026 16:21:38 +0200, Shan Shaji wrote:
> Previously, ACME commands were not exposed through the admin CLI.
> Added the necessary functionality to manage ACME settings directly
> via the command line. The changes are done by taking reference from
> the proxmox-backup codebase.
> 
> changes since v3:
> - Rebase with master.
> - rephrase commit messages.
> - retested the changes again.
> 
> [...]

Applied, thanks!

[1/5] cli: admin: initialize worker tasks before calling acme API methods
      commit: 637a0063bc7b2e833be90ee569788a6edf7f57bc
[2/5] api: acme: define API type for ACME registration parameters
      commit: 8e50f425a565323aaac17cba83b483a168c2ee78
[3/5] server: api: add contact schema for ACME account update endpoint
      commit: 7d91baa6d466380853b38190462e8660516ed1da
[4/5] fix #7179: cli: admin: add commands to manage ACME settings
      commit: 5df0d5b6ef8536db6b0cd311d3c0bb4a6b35e367
[5/5] chore: update proxmox-acme version to 1
      commit: 0f3bf33ff8e21312a8567bb68ff8a32ffa56d2f1

Best regards,
-- 
Lukas Wagner <l.wagner@proxmox.com>