proxmox-mirrors/proxmox
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox synced 2025-08-08 14:39:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

acme-api: use product-config instead of custom acme api configuration

Browse Source 
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
This commit is contained in:
Dietmar Maurer 2024-05-17 11:52:57 +02:00
parent 0ffe40fcfa
commit 7c899090e4
8 changed files with 608 additions and 649 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
proxmox-acme-api/Cargo.toml
View File

@ -32,12 +32,15 @@ proxmox-router = { workspace = true, optional = true }
proxmox-sys = { workspace = true, optional = true } proxmox-sys = { workspace = true, optional = true }
proxmox-schema = { workspace = true, features = ["api-macro", "api-types"] } proxmox-schema = { workspace = true, features = ["api-macro", "api-types"] }
proxmox-acme = { workspace = true, optional = true, features = ["api-types"] } proxmox-acme = { workspace = true, optional = true, features = ["api-types"] }
proxmox-product-config = { workspace = true, optional = true }
[features] [features]
default = ["api-types"] default = ["api-types"]
api-types = ["dep:proxmox-acme", "dep:proxmox-serde"] api-types = ["dep:proxmox-acme", "dep:proxmox-serde"]
impl = [ impl = [
"api-types", "api-types",
"dep:proxmox-product-config",
"proxmox-product-config?/impl",
"dep:proxmox-acme", "dep:proxmox-acme",
"proxmox-acme?/impl", "proxmox-acme?/impl",
"proxmox-acme?/async-client", "proxmox-acme?/async-client",

34
proxmox-acme-api/src/account_api_impl.rs
View File

@ -11,9 +11,9 @@ use proxmox_acme::types::AccountData as AcmeAccountData;
use proxmox_rest_server::WorkerTask; use proxmox_rest_server::WorkerTask;
use proxmox_sys::task_warn; use proxmox_sys::task_warn;
use crate::types::{AccountEntry, AccountInfo, AcmeAccountName};
use crate::config::{AcmeApiConfig, DEFAULT_ACME_DIRECTORY_ENTRY};
use crate::account_config::AccountData; use crate::account_config::AccountData;
use crate::config::DEFAULT_ACME_DIRECTORY_ENTRY;
use crate::types::{AccountEntry, AccountInfo, AcmeAccountName};
fn account_contact_from_string(s: &str) -> Vec<String> { fn account_contact_from_string(s: &str) -> Vec<String> {
s.split(&[' ', ';', ',', '\0'][..]) s.split(&[' ', ';', ',', '\0'][..])
@ -21,21 +21,17 @@ fn account_contact_from_string(s: &str) -> Vec<String> {
.collect() .collect()
} }
impl AcmeApiConfig { pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
pub fn list_accounts(&self) -> Result<Vec<AccountEntry>, Error> {
let mut entries = Vec::new(); let mut entries = Vec::new();
self.foreach_acme_account(|name| { super::account_config::foreach_acme_account(|name| {
entries.push(AccountEntry { name }); entries.push(AccountEntry { name });
ControlFlow::Continue(()) ControlFlow::Continue(())
})?; })?;
Ok(entries) Ok(entries)
} }
pub async fn get_account( pub async fn get_account(account_name: AcmeAccountName) -> Result<AccountInfo, Error> {
&self, let account_data = super::account_config::load_account_config(&account_name).await?;
account_name: AcmeAccountName,
) -> Result<AccountInfo, Error> {
let account_data = self.load_account_config(&account_name).await?;
Ok(AccountInfo { Ok(AccountInfo {
location: account_data.location.clone(), location: account_data.location.clone(),
tos: account_data.tos.clone(), tos: account_data.tos.clone(),
@ -47,7 +43,7 @@ impl AcmeApiConfig {
}) })
} }
pub async fn get_tos(&self, directory: Option<String>) -> Result<Option<String>, Error> { pub async fn get_tos(directory: Option<String>) -> Result<Option<String>, Error> {
let directory = directory.unwrap_or_else(|| DEFAULT_ACME_DIRECTORY_ENTRY.url.to_string()); let directory = directory.unwrap_or_else(|| DEFAULT_ACME_DIRECTORY_ENTRY.url.to_string());
Ok(AcmeClient::new(directory) Ok(AcmeClient::new(directory)
.terms_of_service_url() .terms_of_service_url()
@ -56,7 +52,6 @@ impl AcmeApiConfig {
} }
pub async fn register_account( pub async fn register_account(
&self,
name: &AcmeAccountName, name: &AcmeAccountName,
contact: String, contact: String,
tos_url: Option<String>, tos_url: Option<String>,
@ -72,18 +67,17 @@ impl AcmeApiConfig {
let account = AccountData::from_account_dir_tos(account, directory_url, tos_url); let account = AccountData::from_account_dir_tos(account, directory_url, tos_url);
self.create_account_config(&name, &account)?; super::account_config::create_account_config(&name, &account)?;
Ok(account.location) Ok(account.location)
} }
pub async fn deactivate_account( pub async fn deactivate_account(
&self,
worker: &WorkerTask, worker: &WorkerTask,
name: &AcmeAccountName, name: &AcmeAccountName,
force: bool, force: bool,
) -> Result<(), Error> { ) -> Result<(), Error> {
let mut account_data = self.load_account_config(name).await?; let mut account_data = super::account_config::load_account_config(name).await?;
let mut client = account_data.client(); let mut client = account_data.client();
match client match client
@ -92,7 +86,7 @@ impl AcmeApiConfig {
{ {
Ok(account) => { Ok(account) => {
account_data.account = account.data.clone(); account_data.account = account.data.clone();
self.save_account_config(&name, &account_data)?; super::account_config::save_account_config(&name, &account_data)?;
} }
Err(err) if !force => return Err(err), Err(err) if !force => return Err(err),
Err(err) => { Err(err) => {
@ -105,17 +99,16 @@ impl AcmeApiConfig {
} }
} }
self.mark_account_deactivated(&name)?; super::account_config::mark_account_deactivated(&name)?;
Ok(()) Ok(())
} }
pub async fn update_account( pub async fn update_account(
&self,
name: &AcmeAccountName, name: &AcmeAccountName,
contact: Option<String>, contact: Option<String>,
) -> Result<(), Error> { ) -> Result<(), Error> {
let mut account_data = self.load_account_config(name).await?; let mut account_data = super::account_config::load_account_config(name).await?;
let mut client = account_data.client(); let mut client = account_data.client();
let data = match contact { let data = match contact {
@ -127,8 +120,7 @@ impl AcmeApiConfig {
let account = client.update_account(&data).await?; let account = client.update_account(&data).await?;
account_data.account = account.data.clone(); account_data.account = account.data.clone();
self.save_account_config(&name, &account_data)?; super::account_config::save_account_config(&name, &account_data)?;
Ok(()) Ok(())
} }
}

60
proxmox-acme-api/src/account_config.rs
View File

@ -1,9 +1,9 @@
//! ACME account configuration helpers (load/save config) //! ACME account configuration helpers (load/save config)
use std::ops::ControlFlow;
use std::fs::OpenOptions; use std::fs::OpenOptions;
use std::path::Path; use std::ops::ControlFlow;
use std::os::unix::fs::OpenOptionsExt; use std::os::unix::fs::OpenOptionsExt;
use std::path::{Path, PathBuf};
use anyhow::{bail, format_err, Error}; use anyhow::{bail, format_err, Error};
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
@ -17,7 +17,6 @@ use proxmox_acme::async_client::AcmeClient;
use proxmox_acme::types::AccountData as AcmeAccountData; use proxmox_acme::types::AccountData as AcmeAccountData;
use proxmox_acme::Account; use proxmox_acme::Account;
use crate::config::AcmeApiConfig;
use crate::types::AcmeAccountName; use crate::types::AcmeAccountName;
#[inline] #[inline]
@ -79,26 +78,25 @@ impl AccountData {
} }
} }
impl AcmeApiConfig { fn acme_account_dir() -> PathBuf {
fn acme_account_dir(&self) -> String { super::config::acme_config_dir().join("accounts")
format!("{}/{}", self.config_dir, "accounts")
} }
/// Returns the path to the account configuration file (`$config_dir/accounts/$name`). /// Returns the path to the account configuration file (`$config_dir/accounts/$name`).
pub fn account_cfg_filename(&self, name: &str) -> String { pub fn account_cfg_filename(name: &str) -> PathBuf {
format!("{}/{}", self.acme_account_dir(), name) acme_account_dir().join(name)
} }
fn make_acme_account_dir(&self) -> nix::Result<()> { fn make_acme_account_dir() -> nix::Result<()> {
self.make_acme_dir()?; super::config::make_acme_dir()?;
Self::create_acme_subdir(&self.acme_account_dir()) super::config::create_secret_subdir(acme_account_dir())
} }
pub(crate) fn foreach_acme_account<F>(&self, mut func: F) -> Result<(), Error> pub(crate) fn foreach_acme_account<F>(mut func: F) -> Result<(), Error>
where where
F: FnMut(AcmeAccountName) -> ControlFlow<Result<(), Error>>, F: FnMut(AcmeAccountName) -> ControlFlow<Result<(), Error>>,
{ {
match proxmox_sys::fs::scan_subdir(-1, self.acme_account_dir().as_str(), &SAFE_ID_REGEX) { match proxmox_sys::fs::scan_subdir(-1, acme_account_dir().as_path(), &SAFE_ID_REGEX) {
Ok(files) => { Ok(files) => {
for file in files { for file in files {
let file = file?; let file = file?;
@ -125,10 +123,10 @@ impl AcmeApiConfig {
} }
// Mark account as deactivated // Mark account as deactivated
pub(crate) fn mark_account_deactivated(&self, account_name: &str) -> Result<(), Error> { pub(crate) fn mark_account_deactivated(account_name: &str) -> Result<(), Error> {
let from = self.account_cfg_filename(account_name); let from = account_cfg_filename(account_name);
for i in 0..100 { for i in 0..100 {
let to = self.account_cfg_filename(&format!("_deactivated_{}_{}", account_name, i)); let to = account_cfg_filename(&format!("_deactivated_{}_{}", account_name, i));
if !Path::new(&to).exists() { if !Path::new(&to).exists() {
return std::fs::rename(&from, &to).map_err(|err| { return std::fs::rename(&from, &to).map_err(|err| {
format_err!( format_err!(
@ -143,27 +141,27 @@ impl AcmeApiConfig {
bail!( bail!(
"No free slot to rename deactivated account {:?}, please cleanup {:?}", "No free slot to rename deactivated account {:?}, please cleanup {:?}",
from, from,
self.acme_account_dir() acme_account_dir()
); );
} }
// Load an existing ACME account by name. // Load an existing ACME account by name.
pub(crate) async fn load_account_config(&self, account_name: &str) -> Result<AccountData, Error> { pub(crate) async fn load_account_config(account_name: &str) -> Result<AccountData, Error> {
let account_cfg_filename = self.account_cfg_filename(account_name); let account_cfg_filename = account_cfg_filename(account_name);
let data = match tokio::fs::read(&account_cfg_filename).await { let data = match tokio::fs::read(&account_cfg_filename).await {
Ok(data) => data, Ok(data) => data,
Err(err) if err.kind() == std::io::ErrorKind::NotFound => { Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
bail!("acme account '{}' does not exist", account_name) bail!("acme account '{}' does not exist", account_name)
} }
Err(err) => bail!( Err(err) => bail!(
"failed to load acme account from '{}' - {}", "failed to load acme account from {:?} - {}",
account_cfg_filename, account_cfg_filename,
err err
), ),
}; };
let data: AccountData = serde_json::from_slice(&data).map_err(|err| { let data: AccountData = serde_json::from_slice(&data).map_err(|err| {
format_err!( format_err!(
"failed to parse acme account from '{}' - {}", "failed to parse acme account from {:?} - {}",
account_cfg_filename, account_cfg_filename,
err err
) )
@ -174,19 +172,24 @@ impl AcmeApiConfig {
// Save an new ACME account (fails if the file already exists). // Save an new ACME account (fails if the file already exists).
pub(crate) fn create_account_config( pub(crate) fn create_account_config(
&self,
account_name: &AcmeAccountName, account_name: &AcmeAccountName,
account: &AccountData, account: &AccountData,
) -> Result<(), Error> { ) -> Result<(), Error> {
self.make_acme_account_dir()?; make_acme_account_dir()?;
let account_cfg_filename = self.account_cfg_filename(account_name.as_ref()); let account_cfg_filename = account_cfg_filename(account_name.as_ref());
let file = OpenOptions::new() let file = OpenOptions::new()
.write(true) .write(true)
.create_new(true) .create_new(true)
.mode(0o600) .mode(0o600)
.open(&account_cfg_filename) .open(&account_cfg_filename)
.map_err(|err| format_err!("failed to open {:?} for writing: {}", account_cfg_filename, err))?; .map_err(|err| {
format_err!(
"failed to open {:?} for writing: {}",
account_cfg_filename,
err
)
})?;
serde_json::to_writer_pretty(file, account).map_err(|err| { serde_json::to_writer_pretty(file, account).map_err(|err| {
format_err!( format_err!(
@ -201,11 +204,10 @@ impl AcmeApiConfig {
// Save ACME account data (overtwrite existing data). // Save ACME account data (overtwrite existing data).
pub(crate) fn save_account_config( pub(crate) fn save_account_config(
&self,
account_name: &AcmeAccountName, account_name: &AcmeAccountName,
account: &AccountData, account: &AccountData,
) -> Result<(), Error> { ) -> Result<(), Error> {
let account_cfg_filename = self.account_cfg_filename(account_name.as_ref()); let account_cfg_filename = account_cfg_filename(account_name.as_ref());
let mut data = Vec::<u8>::new(); let mut data = Vec::<u8>::new();
serde_json::to_writer_pretty(&mut data, account).map_err(|err| { serde_json::to_writer_pretty(&mut data, account).map_err(|err| {
@ -216,7 +218,8 @@ impl AcmeApiConfig {
) )
})?; })?;
self.make_acme_account_dir()?; make_acme_account_dir()?;
replace_file( replace_file(
account_cfg_filename, account_cfg_filename,
&data, &data,
@ -227,4 +230,3 @@ impl AcmeApiConfig {
true, true,
) )
} }
}

16
proxmox-acme-api/src/certificate_helpers.rs
View File

@ -7,7 +7,6 @@ use proxmox_acme::async_client::AcmeClient;
use proxmox_rest_server::WorkerTask; use proxmox_rest_server::WorkerTask;
use proxmox_sys::{task_log, task_warn}; use proxmox_sys::{task_log, task_warn};
use crate::config::AcmeApiConfig;
use crate::types::{AcmeConfig, AcmeDomain}; use crate::types::{AcmeConfig, AcmeDomain};
pub struct OrderedCertificate { pub struct OrderedCertificate {
@ -15,9 +14,7 @@ pub struct OrderedCertificate {
pub private_key_pem: Vec<u8>, pub private_key_pem: Vec<u8>,
} }
impl AcmeApiConfig {
pub async fn order_certificate( pub async fn order_certificate(
&self,
worker: Arc<WorkerTask>, worker: Arc<WorkerTask>,
acme_config: AcmeConfig, acme_config: AcmeConfig,
domains: Vec<AcmeDomain>, domains: Vec<AcmeDomain>,
@ -40,9 +37,11 @@ impl AcmeApiConfig {
return Ok(None); return Ok(None);
} }
let mut acme = self.load_account_config(&acme_config.account).await?.client(); let mut acme = super::account_config::load_account_config(&acme_config.account)
.await?
.client();
let (plugins, _) = self.plugin_config()?; let (plugins, _) = super::plugin_config::plugin_config()?;
task_log!(worker, "Placing ACME order"); task_log!(worker, "Placing ACME order");
@ -77,8 +76,8 @@ impl AcmeApiConfig {
task_log!(worker, "The validation for {} is pending", domain); task_log!(worker, "The validation for {} is pending", domain);
let domain_config: &AcmeDomain = get_domain_config(&domain)?; let domain_config: &AcmeDomain = get_domain_config(&domain)?;
let plugin_id = domain_config.plugin.as_deref().unwrap_or("standalone"); let plugin_id = domain_config.plugin.as_deref().unwrap_or("standalone");
let mut plugin_cfg = crate::acme_plugin::get_acme_plugin(&plugins, plugin_id)? let mut plugin_cfg =
.ok_or_else(|| { crate::acme_plugin::get_acme_plugin(&plugins, plugin_id)?.ok_or_else(|| {
format_err!("plugin '{}' for domain '{}' not found!", plugin_id, domain) format_err!("plugin '{}' for domain '{}' not found!", plugin_id, domain)
})?; })?;
@ -87,7 +86,7 @@ impl AcmeApiConfig {
.setup(&mut acme, &auth, domain_config, Arc::clone(&worker)) .setup(&mut acme, &auth, domain_config, Arc::clone(&worker))
.await?; .await?;
let result = Self::request_validation(&worker, &mut acme, auth_url, validation_url).await; let result = request_validation(&worker, &mut acme, auth_url, validation_url).await;
if let Err(err) = plugin_cfg if let Err(err) = plugin_cfg
.teardown(&mut acme, &auth, domain_config, Arc::clone(&worker)) .teardown(&mut acme, &auth, domain_config, Arc::clone(&worker))
@ -203,4 +202,3 @@ impl AcmeApiConfig {
} }
} }
} }
}

41
proxmox-acme-api/src/config.rs
View File

@ -1,26 +1,15 @@
//! ACME API Configuration. //! ACME API Configuration.
use std::borrow::Cow; use std::borrow::Cow;
use std::path::{Path, PathBuf};
use proxmox_sys::error::SysError; use proxmox_sys::error::SysError;
use proxmox_sys::fs::CreateOptions; use proxmox_sys::fs::CreateOptions;
use proxmox_product_config::product_config;
use crate::types::KnownAcmeDirectory; use crate::types::KnownAcmeDirectory;
/// ACME API Configuration.
///
/// This struct provides access to the server side configuration, like the
/// configuration directory. All ACME API functions are implemented as member
/// fuction, so they all have access to this configuration.
///
pub struct AcmeApiConfig {
/// Path to the ACME configuration directory.
pub config_dir: &'static str,
/// Configuration file owner.
pub file_owner: fn() -> nix::unistd::User,
}
/// List of known ACME directorties. /// List of known ACME directorties.
pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[ pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[
KnownAcmeDirectory { KnownAcmeDirectory {
@ -36,20 +25,19 @@ pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[
/// Default ACME directorties. /// Default ACME directorties.
pub const DEFAULT_ACME_DIRECTORY_ENTRY: &KnownAcmeDirectory = &KNOWN_ACME_DIRECTORIES[0]; pub const DEFAULT_ACME_DIRECTORY_ENTRY: &KnownAcmeDirectory = &KNOWN_ACME_DIRECTORIES[0];
// local helpers to read/write acme configuration pub(crate) fn acme_config_dir() -> PathBuf {
impl AcmeApiConfig { product_config().absolute_path("acme")
pub(crate) fn acme_config_dir(&self) -> &'static str {
self.config_dir
} }
pub(crate) fn plugin_cfg_filename(&self) -> String { pub(crate) fn plugin_cfg_filename() -> PathBuf {
format!("{}/plugins.cfg", self.acme_config_dir()) acme_config_dir().join("plugins.cfg")
}
pub(crate) fn plugin_cfg_lockfile(&self) -> String {
format!("{}/.plugins.lck", self.acme_config_dir())
} }
pub(crate) fn create_acme_subdir(dir: &str) -> nix::Result<()> { pub(crate) fn plugin_cfg_lockfile() -> PathBuf {
acme_config_dir().join("plugins.lck")
}
pub(crate) fn create_secret_subdir<P: AsRef<Path>>(dir: P) -> nix::Result<()> {
let root_only = CreateOptions::new() let root_only = CreateOptions::new()
.owner(nix::unistd::ROOT) .owner(nix::unistd::ROOT)
.group(nix::unistd::Gid::from_raw(0)) .group(nix::unistd::Gid::from_raw(0))
@ -62,7 +50,6 @@ impl AcmeApiConfig {
} }
} }
pub(crate) fn make_acme_dir(&self) -> nix::Result<()> { pub(crate) fn make_acme_dir() -> nix::Result<()> {
Self::create_acme_subdir(&self.acme_config_dir()) create_secret_subdir(acme_config_dir())
}
} }

26
proxmox-acme-api/src/lib.rs
View File

@ -4,25 +4,37 @@
pub mod types; pub mod types;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub mod challenge_schemas; mod config;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub mod config; mod challenge_schemas;
#[cfg(feature = "impl")]
pub use challenge_schemas::get_cached_challenge_schemas;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod account_config; mod account_config;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod plugin_config; mod plugin_config;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod account_api_impl; mod account_api_impl;
#[cfg(feature = "impl")]
pub use account_api_impl::{
deactivate_account, get_account, get_tos, list_accounts, register_account, update_account,
};
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod plugin_api_impl; mod plugin_api_impl;
#[cfg(feature = "impl")]
pub use plugin_api_impl::{add_plugin, delete_plugin, get_plugin, list_plugins, update_plugin};
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod acme_plugin; pub(crate) mod acme_plugin;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod certificate_helpers; mod certificate_helpers;
#[cfg(feature = "impl")]
pub use certificate_helpers::order_certificate;

45
proxmox-acme-api/src/plugin_api_impl.rs
View File

@ -8,17 +8,14 @@ use serde_json::Value;
use proxmox_schema::param_bail; use proxmox_schema::param_bail;
use crate::config::AcmeApiConfig; use crate::types::{
use crate::types::{DeletablePluginProperty, PluginConfig, DnsPlugin, DnsPluginCore, DnsPluginCoreUpdater}; DeletablePluginProperty, DnsPlugin, DnsPluginCore, DnsPluginCoreUpdater, PluginConfig,
};
use proxmox_router::{http_bail, RpcEnvironment}; use proxmox_router::{http_bail, RpcEnvironment};
impl AcmeApiConfig { pub fn list_plugins(rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<PluginConfig>, Error> {
pub fn list_plugins( let (plugins, digest) = super::plugin_config::plugin_config()?;
&self,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<PluginConfig>, Error> {
let (plugins, digest) = self.plugin_config()?;
rpcenv["digest"] = hex::encode(digest).into(); rpcenv["digest"] = hex::encode(digest).into();
Ok(plugins Ok(plugins
@ -28,11 +25,10 @@ impl AcmeApiConfig {
} }
pub fn get_plugin( pub fn get_plugin(
&self,
id: String, id: String,
rpcenv: &mut dyn RpcEnvironment, rpcenv: &mut dyn RpcEnvironment,
) -> Result<PluginConfig, Error> { ) -> Result<PluginConfig, Error> {
let (plugins, digest) = self.plugin_config()?; let (plugins, digest) = super::plugin_config::plugin_config()?;
rpcenv["digest"] = hex::encode(digest).into(); rpcenv["digest"] = hex::encode(digest).into();
match plugins.get(&id) { match plugins.get(&id) {
@ -41,12 +37,7 @@ impl AcmeApiConfig {
} }
} }
pub fn add_plugin( pub fn add_plugin(r#type: String, core: DnsPluginCore, data: String) -> Result<(), Error> {
&self,
r#type: String,
core: DnsPluginCore,
data: String,
) -> Result<(), Error> {
// Currently we only support DNS plugins and the standalone plugin is "fixed": // Currently we only support DNS plugins and the standalone plugin is "fixed":
if r#type != "dns" { if r#type != "dns" {
param_bail!("type", "invalid ACME plugin type: {:?}", r#type); param_bail!("type", "invalid ACME plugin type: {:?}", r#type);
@ -57,9 +48,9 @@ impl AcmeApiConfig {
let id = core.id.clone(); let id = core.id.clone();
let _lock = self.lock_plugin_config()?; let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, _digest) = self.plugin_config()?; let (mut plugins, _digest) = super::plugin_config::plugin_config()?;
if plugins.contains_key(&id) { if plugins.contains_key(&id) {
param_bail!("id", "ACME plugin ID {:?} already exists", id); param_bail!("id", "ACME plugin ID {:?} already exists", id);
} }
@ -68,13 +59,12 @@ impl AcmeApiConfig {
plugins.insert(id, r#type, plugin); plugins.insert(id, r#type, plugin);
self.save_plugin_config(&plugins)?; super::plugin_config::save_plugin_config(&plugins)?;
Ok(()) Ok(())
} }
pub fn update_plugin( pub fn update_plugin(
&self,
id: String, id: String,
update: DnsPluginCoreUpdater, update: DnsPluginCoreUpdater,
data: Option<String>, data: Option<String>,
@ -89,9 +79,9 @@ impl AcmeApiConfig {
.transpose() .transpose()
.map_err(|_| format_err!("data must be valid UTF-8"))?; .map_err(|_| format_err!("data must be valid UTF-8"))?;
let _lock = self.lock_plugin_config()?; let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, expected_digest) = self.plugin_config()?; let (mut plugins, expected_digest) = super::plugin_config::plugin_config()?;
if let Some(digest) = digest { if let Some(digest) = digest {
let digest = <[u8; 32]>::from_hex(digest)?; let digest = <[u8; 32]>::from_hex(digest)?;
@ -138,23 +128,22 @@ impl AcmeApiConfig {
None => http_bail!(NOT_FOUND, "no such plugin"), None => http_bail!(NOT_FOUND, "no such plugin"),
} }
self.save_plugin_config(&plugins)?; super::plugin_config::save_plugin_config(&plugins)?;
Ok(()) Ok(())
} }
pub fn delete_plugin(&self, id: String) -> Result<(), Error> { pub fn delete_plugin(id: String) -> Result<(), Error> {
let _lock = self.lock_plugin_config()?; let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, _digest) = self.plugin_config()?; let (mut plugins, _digest) = super::plugin_config::plugin_config()?;
if plugins.remove(&id).is_none() { if plugins.remove(&id).is_none() {
http_bail!(NOT_FOUND, "no such plugin"); http_bail!(NOT_FOUND, "no such plugin");
} }
self.save_plugin_config(&plugins)?; super::plugin_config::save_plugin_config(&plugins)?;
Ok(()) Ok(())
} }
}
// See PMG/PVE's $modify_cfg_for_api sub // See PMG/PVE's $modify_cfg_for_api sub
fn modify_cfg_for_api(id: &str, ty: &str, data: &Value) -> PluginConfig { fn modify_cfg_for_api(id: &str, ty: &str, data: &Value) -> PluginConfig {

52
proxmox-acme-api/src/plugin_config.rs
View File

@ -6,9 +6,9 @@ use serde_json::Value;
use proxmox_schema::{ApiType, Schema}; use proxmox_schema::{ApiType, Schema};
use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin}; use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin};
use proxmox_product_config::{ApiLockGuard, open_api_lockfile, replace_config};
use crate::config::AcmeApiConfig; use crate::types::{DnsPlugin, StandalonePlugin, PLUGIN_ID_SCHEMA};
use crate::types::{PLUGIN_ID_SCHEMA, DnsPlugin, StandalonePlugin};
lazy_static! { lazy_static! {
static ref CONFIG: SectionConfig = init(); static ref CONFIG: SectionConfig = init();
@ -52,31 +52,16 @@ fn init() -> SectionConfig {
config config
} }
// LockGuard for the plugin configuration pub(crate) fn lock_plugin_config() -> Result<ApiLockGuard, Error> {
pub(crate) struct AcmePluginConfigLockGuard { super::config::make_acme_dir()?;
_file: Option<std::fs::File>,
let plugin_cfg_lockfile = super::config::plugin_cfg_lockfile();
open_api_lockfile(plugin_cfg_lockfile, None, true)
} }
impl AcmeApiConfig { pub(crate) fn plugin_config() -> Result<(PluginData, [u8; 32]), Error> {
pub(crate) fn lock_plugin_config(&self) -> Result<AcmePluginConfigLockGuard, Error> { let plugin_cfg_filename = super::config::plugin_cfg_filename();
self.make_acme_dir()?;
let file_owner = (self.file_owner)();
let mode = nix::sys::stat::Mode::from_bits_truncate(0o0660);
let options = proxmox_sys::fs::CreateOptions::new()
.perm(mode)
.owner(file_owner.uid)
.group(file_owner.gid);
let timeout = std::time::Duration::new(10, 0);
let plugin_cfg_lockfile = self.plugin_cfg_lockfile();
let file = proxmox_sys::fs::open_file_locked(&plugin_cfg_lockfile, timeout, true, options)?;
Ok(AcmePluginConfigLockGuard { _file: Some(file) })
}
pub(crate) fn plugin_config(&self) -> Result<(PluginData, [u8; 32]), Error> {
let plugin_cfg_filename = self.plugin_cfg_filename();
let content = let content =
proxmox_sys::fs::file_read_optional_string(&plugin_cfg_filename)?.unwrap_or_default(); proxmox_sys::fs::file_read_optional_string(&plugin_cfg_filename)?.unwrap_or_default();
@ -93,21 +78,12 @@ impl AcmeApiConfig {
Ok((PluginData { data }, digest)) Ok((PluginData { data }, digest))
} }
pub(crate) fn save_plugin_config(&self, config: &PluginData) -> Result<(), Error> { pub(crate) fn save_plugin_config(config: &PluginData) -> Result<(), Error> {
self.make_acme_dir()?; super::config::make_acme_dir()?;
let plugin_cfg_filename = self.plugin_cfg_filename(); let plugin_cfg_filename = super::config::plugin_cfg_filename();
let raw = CONFIG.write(&plugin_cfg_filename, &config.data)?; let raw = CONFIG.write(&plugin_cfg_filename, &config.data)?;
let file_owner = (self.file_owner)();
let mode = nix::sys::stat::Mode::from_bits_truncate(0o0640); replace_config(plugin_cfg_filename, raw.as_bytes())
// set the correct owner/group/permissions while saving file
let options = proxmox_sys::fs::CreateOptions::new()
.perm(mode)
.owner(file_owner.uid)
.group(file_owner.gid);
proxmox_sys::fs::replace_file(plugin_cfg_filename, raw.as_bytes(), options, true)
}
} }
pub(crate) struct PluginData { pub(crate) struct PluginData {