From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 93A551FF0E5 for ; Wed, 29 Jul 2026 11:07:37 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 661C221419; Wed, 29 Jul 2026 11:07:37 +0200 (CEST) Message-ID: Date: Wed, 29 Jul 2026 11:07:01 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH proxmox-backup 6/7] acme: fix #6372 implement ARI renewal information fetching. To: Shan Shaji , pbs-devel@lists.proxmox.com, pdm-devel@lists.proxmox.com References: <20260625141337.181684-1-m.federanko@proxmox.com> <20260625141337.181684-7-m.federanko@proxmox.com> Content-Language: en-US From: Manuel Federanko In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785315982864 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.117 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: Y66NV77QUTZVKOUPACM6EDP5UQCVIBIM X-Message-ID-Hash: Y66NV77QUTZVKOUPACM6EDP5UQCVIBIM X-MailFrom: m.federanko@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 2026-07-27 3:30 PM, Shan Shaji wrote: > On Thu Jun 25, 2026 at 4:13 PM CEST, Manuel Federanko wrote: >> Try to fetch ARI renewal information and renew based on that, if it is >> not available fall back to normal lifetime based renewal logic. >> >> The ARI check needs to talk to the server, move all checks into the >> worker process and unconditionally call the worker process from all >> entry points. >> >> Add a method that returns the ARI ID from the CertInfo struct, which is >> easier than trying to pass along other information or switching to >> proxmox-acme-api's CertificateInfo struct. >> >> Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=6372 >> Signed-off-by: Manuel Federanko >> --- >> src/api2/node/certificates.rs | 106 +++++++++++++++++++------ >> src/bin/proxmox-daily-update.rs | 6 -- >> src/bin/proxmox_backup_manager/acme.rs | 8 -- >> 3 files changed, 81 insertions(+), 39 deletions(-) >> > [snip] >> diff --git a/src/bin/proxmox_backup_manager/acme.rs b/src/bin/proxmox_backup_manager/acme.rs >> index ed9e5868c..ea14cfe2b 100644 >> --- a/src/bin/proxmox_backup_manager/acme.rs >> +++ b/src/bin/proxmox_backup_manager/acme.rs >> @@ -413,14 +413,6 @@ pub fn plugin_cli() -> CommandLineInterface { >> )] >> /// Order a new ACME certificate. >> async fn order_acme_cert(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> { >> - if !param["force"].as_bool().unwrap_or(false) { >> - let (expires_soon, lead_days) = api2::node::certificates::check_renewal_needed()?; >> - if !expires_soon { >> - println!("Certificate does not expire within the next {lead_days} days, not renewing."); >> - return Ok(()); >> - } >> - } >> - > > Hi, Since this was now removed, we no longer get console feedback If the > certificate doesn't expire soon. However, the status was visible inside the > task log. Would showing it in the console as well be a good UX? Agreed, I'd prefer that too, I'm unsure on how to achieve this, since the acme check is imo better handled in the worker. > >> let info = &api2::node::certificates::API_METHOD_RENEW_ACME_CERT; >> let result = match info.handler { >> ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?, >> -- >> 2.47.3 >