Re: [PATCH pve-manager v3 2/2] fix #8031: write APT proxy config on http_proxy change

["Elias Huhsovitz" <e.huhsovitz@proxmox.com>]

I tested this using a the baisc HTTP Proxy docker image ubuntu/squid:

https://hub.docker.com/r/ubuntu/squid

comments inlide.

On Tue Sep 15, 2026 at 11:16 AM CEST, Jonas Theisen wrote:
> Writes the necessary file for APT if the http_proxy variable
> on the datacenter level is changed.
>
> This reuses the same function from the APT API for a regular
> database update.
>
> Signed-off-by: Jonas Theisen <j.theisen@proxmox.com>
> ---
>  PVE/API2/Cluster.pm | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>
> diff --git a/PVE/API2/Cluster.pm b/PVE/API2/Cluster.pm
> index 4e5efbfd..efda3906 100644
> --- a/PVE/API2/Cluster.pm
> +++ b/PVE/API2/Cluster.pm
> @@ -36,6 +36,7 @@ use PVE::API2::ClusterConfig;
>  use PVE::API2::Firewall::Cluster;
>  use PVE::API2::HAConfig;
>  use PVE::API2::ReplicationConfig;
> +use PVE::API2::APT;

nit: imports are ordered Lexicographically.

So the new import should be after ACMEPlugin, like this:

use PVE::API2::ACMEPlugin;
use PVE::API2::APT;

>  
>  my $have_sdn;
>  eval {
> @@ -842,8 +843,17 @@ __PACKAGE__->register_method({
>      code => sub {
>          my ($param) = @_;
>  
> +        my $http_proxy_change = 0;
> +
>          my $delete = extract_param($param, 'delete');
>  
> +        if (
> +            defined($param->{http_proxy})
> +            || (defined($delete) && $delete =~ m/\bhttp_proxy\b/)
> +        ) {
> +            $http_proxy_change = 1;
> +        }
> +
>          cfs_lock_file(
>              'datacenter.cfg',
>              undef,
> @@ -859,6 +869,10 @@ __PACKAGE__->register_method({
>          );
>          die $@ if $@;
>  
> +        if ($http_proxy_change) {
> +            PVE::API2::APT::update_apt_proxy_config();
> +        }


Potential Pitfall
-----------------
The subroutine `update_apt_proxy_config` only writes the config to
the local node, not the cluster.

So we make a HTTP PUT request to the `/cluster/options` endpoint
expecting a cluster wide change, but only the node that accepted the
request actually updates their `/etc/apt/apt.conf.d/76pveproxy` config
file. 

I verified this behaviour on a 2 node cluster.

My take
-------
>From the top of my head 2 solutions come to mind:

1. Create a `update_apt_proxy_config_cluster()` subroutine that applies
the changes cluster wide. Then simply call this function, instead of
`update_apt_proxy_config()`

2. Create some kind of sync mechanism based on changes to the
datacenter.cfg. (also would need some kind of 
`update_apt_proxy_config_cluster()` subroutine)

This could consist of 2 functions:
* synch on change: You check diff between the previous datacenter.cfg
  and the new datacenter.cfg. 
  You apply the changes to all nodes in the cluster.

  e.g. if the `http_proxy` parameter is changed: update `76pveproxy` for
  all nodes in the cluster

* sync on demand: You go through the datacenter.cfg. For each config
  that needs additional settings on the host (e.g. `http_proxy`), apply
  the changes.

  e.g. I manually edit datacenter.cfg to set 
  `http_proxy: http://192.168.29.70:3128`

  I run the new subroutine `sync_datacenter_cfg`. All nodes in the
  cluster now contain:

   76pveproxy contents:
   Acquire::http::Proxy "http://192.168.29.70:3128";

  This function has to be idempotent.

  (Perhaps something like this already exists, I am not 100% sure atm)
 
  Let me know if this makes sense, or if you come up with a better
  solution!

> +
>          return undef;
>      },
>  });