From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id D14DA1FF09B for ; Mon, 12 Oct 2026 16:46:29 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id EC1D721663; Mon, 12 Oct 2026 16:46:26 +0200 (CEST) From: Jonas Theisen To: pve-devel@lists.proxmox.com Subject: [PATCH pve-mamager v3 2/3] api: apt: move proxy config to pmxcfs and symlink to it Date: Mon, 12 Oct 2026 16:45:35 +0200 Message-ID: <20261012144603.288276-3-j.theisen@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261012144603.288276-1-j.theisen@proxmox.com> References: <20261012144603.288276-1-j.theisen@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1791816374119 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.145 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: PQLMKCMFV5J3MMY4TDOAL7DQFGJTVKIZ X-Message-ID-Hash: PQLMKCMFV5J3MMY4TDOAL7DQFGJTVKIZ X-MailFrom: j.theisen@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The APT proxy config was written to /etc/apt/apt.conf.d/76pveproxy only if a database update was triggered through the PVE tooling. Write the config to /etc/pve/apt-proxy.conf instead and replace the local file with a symlink to it, so that changes are applied cluster-wide. The symlink is auto-generated on the next database update and checks for existance of the target file before creating it. The config is also only updated if it differs from the current to avoid unncessarry cluster traffic. Updateing the database without write access to /etc/pve still works and only issues a warning. Note that files in /etc/pve are not readable for users outside the www-data group, so APT invoked by such users will fail to read the proxy config. Signed-off-by: Jonas Theisen --- PVE/API2/APT.pm | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/PVE/API2/APT.pm b/PVE/API2/APT.pm index 8e16b813..2359a5f5 100644 --- a/PVE/API2/APT.pm +++ b/PVE/API2/APT.pm @@ -290,6 +290,24 @@ __PACKAGE__->register_method({ }, }); +my $apt_proxy_cfn = "/etc/apt/apt.conf.d/76pveproxy"; +my $pve_apt_proxy_cfn = "/etc/pve/apt-proxy.conf"; + +my $setup_apt_proxy_symlink = sub { + my $target = readlink($apt_proxy_cfn); + return if defined($target) && $target eq $pve_apt_proxy_cfn; + + my $tmpname = "$apt_proxy_cfn.tmp.$$"; + unlink($tmpname); + symlink($pve_apt_proxy_cfn, $tmpname) + || die "unable to create symlink '$tmpname' - $!\n"; + if (!rename($tmpname, $apt_proxy_cfn)) { + my $err = $!; + unlink($tmpname); + die "unable to replace '$apt_proxy_cfn' - $err\n"; + } +}; + sub update_apt_proxy_config { my ($dcconf) = @_; @@ -299,8 +317,14 @@ sub update_apt_proxy_config { my $http_proxy_uri = URI->new($http_proxy); $aptconf = "Acquire::http::Proxy \"${http_proxy_uri}\";\n"; } - my $aptcfn = "/etc/apt/apt.conf.d/76pveproxy"; - PVE::Tools::file_set_contents($aptcfn, $aptconf); + + my $current; + $current = PVE::Tools::file_get_contents($pve_apt_proxy_cfn) if -f $pve_apt_proxy_cfn; + if (!defined($current) || $current ne $aptconf) { + PVE::Tools::file_set_contents($pve_apt_proxy_cfn, $aptconf); + } + + $setup_apt_proxy_symlink->(); } __PACKAGE__->register_method({ @@ -347,7 +371,8 @@ __PACKAGE__->register_method({ my $realcmd = sub { my $upid = shift; - update_apt_proxy_config($dcconf); + eval { update_apt_proxy_config($dcconf) }; + warn "unable to update APT proxy config - $@" if $@; my $cmd = ['apt-get', 'update']; -- 2.47.3