proxmox-mirrors/proxmox
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox synced 2025-08-08 11:19:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

acme-api: use product-config instead of custom acme api configuration

Browse Source 
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
This commit is contained in:
Dietmar Maurer 2024-05-17 11:52:57 +02:00
parent 0ffe40fcfa
commit 7c899090e4
8 changed files with 608 additions and 649 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
proxmox-acme-api/Cargo.toml
View File

@ -32,12 +32,15 @@ proxmox-router = { workspace = true, optional = true }
proxmox-sys = { workspace = true, optional = true } proxmox-sys = { workspace = true, optional = true }
proxmox-schema = { workspace = true, features = ["api-macro", "api-types"] } proxmox-schema = { workspace = true, features = ["api-macro", "api-types"] }
proxmox-acme = { workspace = true, optional = true, features = ["api-types"] } proxmox-acme = { workspace = true, optional = true, features = ["api-types"] }
proxmox-product-config = { workspace = true, optional = true }
[features] [features]
default = ["api-types"] default = ["api-types"]
api-types = ["dep:proxmox-acme", "dep:proxmox-serde"] api-types = ["dep:proxmox-acme", "dep:proxmox-serde"]
impl = [ impl = [
"api-types", "api-types",
"dep:proxmox-product-config",
"proxmox-product-config?/impl",
"dep:proxmox-acme", "dep:proxmox-acme",
"proxmox-acme?/impl", "proxmox-acme?/impl",
"proxmox-acme?/async-client", "proxmox-acme?/async-client",

56
proxmox-acme-api/src/account_api_impl.rs
View File

@ -11,9 +11,9 @@ use proxmox_acme::types::AccountData as AcmeAccountData;
use proxmox_rest_server::WorkerTask; use proxmox_rest_server::WorkerTask;
use proxmox_sys::task_warn; use proxmox_sys::task_warn;
use crate::types::{AccountEntry, AccountInfo, AcmeAccountName};
use crate::config::{AcmeApiConfig, DEFAULT_ACME_DIRECTORY_ENTRY};
use crate::account_config::AccountData; use crate::account_config::AccountData;
use crate::config::DEFAULT_ACME_DIRECTORY_ENTRY;
use crate::types::{AccountEntry, AccountInfo, AcmeAccountName};
fn account_contact_from_string(s: &str) -> Vec<String> { fn account_contact_from_string(s: &str) -> Vec<String> {
s.split(&[' ', ';', ',', '\0'][..]) s.split(&[' ', ';', ',', '\0'][..])
@ -21,21 +21,17 @@ fn account_contact_from_string(s: &str) -> Vec<String> {
.collect() .collect()
} }
impl AcmeApiConfig { pub fn list_accounts() -> Result<Vec<AccountEntry>, Error> {
pub fn list_accounts(&self) -> Result<Vec<AccountEntry>, Error> {
let mut entries = Vec::new(); let mut entries = Vec::new();
self.foreach_acme_account(|name| { super::account_config::foreach_acme_account(|name| {
entries.push(AccountEntry { name }); entries.push(AccountEntry { name });
ControlFlow::Continue(()) ControlFlow::Continue(())
})?; })?;
Ok(entries) Ok(entries)
} }
pub async fn get_account( pub async fn get_account(account_name: AcmeAccountName) -> Result<AccountInfo, Error> {
&self, let account_data = super::account_config::load_account_config(&account_name).await?;
account_name: AcmeAccountName,
) -> Result<AccountInfo, Error> {
let account_data = self.load_account_config(&account_name).await?;
Ok(AccountInfo { Ok(AccountInfo {
location: account_data.location.clone(), location: account_data.location.clone(),
tos: account_data.tos.clone(), tos: account_data.tos.clone(),
@ -45,24 +41,23 @@ impl AcmeApiConfig {
..account_data.account.clone() ..account_data.account.clone()
}, },
}) })
} }
pub async fn get_tos(&self, directory: Option<String>) -> Result<Option<String>, Error> { pub async fn get_tos(directory: Option<String>) -> Result<Option<String>, Error> {
let directory = directory.unwrap_or_else(|| DEFAULT_ACME_DIRECTORY_ENTRY.url.to_string()); let directory = directory.unwrap_or_else(|| DEFAULT_ACME_DIRECTORY_ENTRY.url.to_string());
Ok(AcmeClient::new(directory) Ok(AcmeClient::new(directory)
.terms_of_service_url() .terms_of_service_url()
.await? .await?
.map(str::to_owned)) .map(str::to_owned))
} }
pub async fn register_account( pub async fn register_account(
&self,
name: &AcmeAccountName, name: &AcmeAccountName,
contact: String, contact: String,
tos_url: Option<String>, tos_url: Option<String>,
directory_url: String, directory_url: String,
eab_creds: Option<(String, String)>, eab_creds: Option<(String, String)>,
) -> Result<String, Error> { ) -> Result<String, Error> {
let mut client = AcmeClient::new(directory_url.clone()); let mut client = AcmeClient::new(directory_url.clone());
let contact = account_contact_from_string(&contact); let contact = account_contact_from_string(&contact);
@ -72,18 +67,17 @@ impl AcmeApiConfig {
let account = AccountData::from_account_dir_tos(account, directory_url, tos_url); let account = AccountData::from_account_dir_tos(account, directory_url, tos_url);
self.create_account_config(&name, &account)?; super::account_config::create_account_config(&name, &account)?;
Ok(account.location) Ok(account.location)
} }
pub async fn deactivate_account( pub async fn deactivate_account(
&self,
worker: &WorkerTask, worker: &WorkerTask,
name: &AcmeAccountName, name: &AcmeAccountName,
force: bool, force: bool,
) -> Result<(), Error> { ) -> Result<(), Error> {
let mut account_data = self.load_account_config(name).await?; let mut account_data = super::account_config::load_account_config(name).await?;
let mut client = account_data.client(); let mut client = account_data.client();
match client match client
@ -92,7 +86,7 @@ impl AcmeApiConfig {
{ {
Ok(account) => { Ok(account) => {
account_data.account = account.data.clone(); account_data.account = account.data.clone();
self.save_account_config(&name, &account_data)?; super::account_config::save_account_config(&name, &account_data)?;
} }
Err(err) if !force => return Err(err), Err(err) if !force => return Err(err),
Err(err) => { Err(err) => {
@ -105,17 +99,16 @@ impl AcmeApiConfig {
} }
} }
self.mark_account_deactivated(&name)?; super::account_config::mark_account_deactivated(&name)?;
Ok(()) Ok(())
} }
pub async fn update_account( pub async fn update_account(
&self,
name: &AcmeAccountName, name: &AcmeAccountName,
contact: Option<String>, contact: Option<String>,
) -> Result<(), Error> { ) -> Result<(), Error> {
let mut account_data = self.load_account_config(name).await?; let mut account_data = super::account_config::load_account_config(name).await?;
let mut client = account_data.client(); let mut client = account_data.client();
let data = match contact { let data = match contact {
@ -127,8 +120,7 @@ impl AcmeApiConfig {
let account = client.update_account(&data).await?; let account = client.update_account(&data).await?;
account_data.account = account.data.clone(); account_data.account = account.data.clone();
self.save_account_config(&name, &account_data)?; super::account_config::save_account_config(&name, &account_data)?;
Ok(()) Ok(())
}
} }

96
proxmox-acme-api/src/account_config.rs
View File

@ -1,9 +1,9 @@
//! ACME account configuration helpers (load/save config) //! ACME account configuration helpers (load/save config)
use std::ops::ControlFlow;
use std::fs::OpenOptions; use std::fs::OpenOptions;
use std::path::Path; use std::ops::ControlFlow;
use std::os::unix::fs::OpenOptionsExt; use std::os::unix::fs::OpenOptionsExt;
use std::path::{Path, PathBuf};
use anyhow::{bail, format_err, Error}; use anyhow::{bail, format_err, Error};
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
@ -17,7 +17,6 @@ use proxmox_acme::async_client::AcmeClient;
use proxmox_acme::types::AccountData as AcmeAccountData; use proxmox_acme::types::AccountData as AcmeAccountData;
use proxmox_acme::Account; use proxmox_acme::Account;
use crate::config::AcmeApiConfig;
use crate::types::AcmeAccountName; use crate::types::AcmeAccountName;
#[inline] #[inline]
@ -79,26 +78,25 @@ impl AccountData {
} }
} }
impl AcmeApiConfig { fn acme_account_dir() -> PathBuf {
fn acme_account_dir(&self) -> String { super::config::acme_config_dir().join("accounts")
format!("{}/{}", self.config_dir, "accounts") }
}
/// Returns the path to the account configuration file (`$config_dir/accounts/$name`). /// Returns the path to the account configuration file (`$config_dir/accounts/$name`).
pub fn account_cfg_filename(&self, name: &str) -> String { pub fn account_cfg_filename(name: &str) -> PathBuf {
format!("{}/{}", self.acme_account_dir(), name) acme_account_dir().join(name)
} }
fn make_acme_account_dir(&self) -> nix::Result<()> { fn make_acme_account_dir() -> nix::Result<()> {
self.make_acme_dir()?; super::config::make_acme_dir()?;
Self::create_acme_subdir(&self.acme_account_dir()) super::config::create_secret_subdir(acme_account_dir())
} }
pub(crate) fn foreach_acme_account<F>(&self, mut func: F) -> Result<(), Error> pub(crate) fn foreach_acme_account<F>(mut func: F) -> Result<(), Error>
where where
F: FnMut(AcmeAccountName) -> ControlFlow<Result<(), Error>>, F: FnMut(AcmeAccountName) -> ControlFlow<Result<(), Error>>,
{ {
match proxmox_sys::fs::scan_subdir(-1, self.acme_account_dir().as_str(), &SAFE_ID_REGEX) { match proxmox_sys::fs::scan_subdir(-1, acme_account_dir().as_path(), &SAFE_ID_REGEX) {
Ok(files) => { Ok(files) => {
for file in files { for file in files {
let file = file?; let file = file?;
@ -122,13 +120,13 @@ impl AcmeApiConfig {
Err(err) if err.not_found() => Ok(()), Err(err) if err.not_found() => Ok(()),
Err(err) => Err(err.into()), Err(err) => Err(err.into()),
} }
} }
// Mark account as deactivated // Mark account as deactivated
pub(crate) fn mark_account_deactivated(&self, account_name: &str) -> Result<(), Error> { pub(crate) fn mark_account_deactivated(account_name: &str) -> Result<(), Error> {
let from = self.account_cfg_filename(account_name); let from = account_cfg_filename(account_name);
for i in 0..100 { for i in 0..100 {
let to = self.account_cfg_filename(&format!("_deactivated_{}_{}", account_name, i)); let to = account_cfg_filename(&format!("_deactivated_{}_{}", account_name, i));
if !Path::new(&to).exists() { if !Path::new(&to).exists() {
return std::fs::rename(&from, &to).map_err(|err| { return std::fs::rename(&from, &to).map_err(|err| {
format_err!( format_err!(
@ -143,50 +141,55 @@ impl AcmeApiConfig {
bail!( bail!(
"No free slot to rename deactivated account {:?}, please cleanup {:?}", "No free slot to rename deactivated account {:?}, please cleanup {:?}",
from, from,
self.acme_account_dir() acme_account_dir()
); );
} }
// Load an existing ACME account by name. // Load an existing ACME account by name.
pub(crate) async fn load_account_config(&self, account_name: &str) -> Result<AccountData, Error> { pub(crate) async fn load_account_config(account_name: &str) -> Result<AccountData, Error> {
let account_cfg_filename = self.account_cfg_filename(account_name); let account_cfg_filename = account_cfg_filename(account_name);
let data = match tokio::fs::read(&account_cfg_filename).await { let data = match tokio::fs::read(&account_cfg_filename).await {
Ok(data) => data, Ok(data) => data,
Err(err) if err.kind() == std::io::ErrorKind::NotFound => { Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
bail!("acme account '{}' does not exist", account_name) bail!("acme account '{}' does not exist", account_name)
} }
Err(err) => bail!( Err(err) => bail!(
"failed to load acme account from '{}' - {}", "failed to load acme account from {:?} - {}",
account_cfg_filename, account_cfg_filename,
err err
), ),
}; };
let data: AccountData = serde_json::from_slice(&data).map_err(|err| { let data: AccountData = serde_json::from_slice(&data).map_err(|err| {
format_err!( format_err!(
"failed to parse acme account from '{}' - {}", "failed to parse acme account from {:?} - {}",
account_cfg_filename, account_cfg_filename,
err err
) )
})?; })?;
Ok(data) Ok(data)
} }
// Save an new ACME account (fails if the file already exists). // Save an new ACME account (fails if the file already exists).
pub(crate) fn create_account_config( pub(crate) fn create_account_config(
&self,
account_name: &AcmeAccountName, account_name: &AcmeAccountName,
account: &AccountData, account: &AccountData,
) -> Result<(), Error> { ) -> Result<(), Error> {
self.make_acme_account_dir()?; make_acme_account_dir()?;
let account_cfg_filename = self.account_cfg_filename(account_name.as_ref()); let account_cfg_filename = account_cfg_filename(account_name.as_ref());
let file = OpenOptions::new() let file = OpenOptions::new()
.write(true) .write(true)
.create_new(true) .create_new(true)
.mode(0o600) .mode(0o600)
.open(&account_cfg_filename) .open(&account_cfg_filename)
.map_err(|err| format_err!("failed to open {:?} for writing: {}", account_cfg_filename, err))?; .map_err(|err| {
format_err!(
"failed to open {:?} for writing: {}",
account_cfg_filename,
err
)
})?;
serde_json::to_writer_pretty(file, account).map_err(|err| { serde_json::to_writer_pretty(file, account).map_err(|err| {
format_err!( format_err!(
@ -197,15 +200,14 @@ impl AcmeApiConfig {
})?; })?;
Ok(()) Ok(())
} }
// Save ACME account data (overtwrite existing data). // Save ACME account data (overtwrite existing data).
pub(crate) fn save_account_config( pub(crate) fn save_account_config(
&self,
account_name: &AcmeAccountName, account_name: &AcmeAccountName,
account: &AccountData, account: &AccountData,
) -> Result<(), Error> { ) -> Result<(), Error> {
let account_cfg_filename = self.account_cfg_filename(account_name.as_ref()); let account_cfg_filename = account_cfg_filename(account_name.as_ref());
let mut data = Vec::<u8>::new(); let mut data = Vec::<u8>::new();
serde_json::to_writer_pretty(&mut data, account).map_err(|err| { serde_json::to_writer_pretty(&mut data, account).map_err(|err| {
@ -216,7 +218,8 @@ impl AcmeApiConfig {
) )
})?; })?;
self.make_acme_account_dir()?; make_acme_account_dir()?;
replace_file( replace_file(
account_cfg_filename, account_cfg_filename,
&data, &data,
@ -226,5 +229,4 @@ impl AcmeApiConfig {
.group(nix::unistd::Gid::from_raw(0)), .group(nix::unistd::Gid::from_raw(0)),
true, true,
) )
}
} }

26
proxmox-acme-api/src/certificate_helpers.rs
View File

@ -7,7 +7,6 @@ use proxmox_acme::async_client::AcmeClient;
use proxmox_rest_server::WorkerTask; use proxmox_rest_server::WorkerTask;
use proxmox_sys::{task_log, task_warn}; use proxmox_sys::{task_log, task_warn};
use crate::config::AcmeApiConfig;
use crate::types::{AcmeConfig, AcmeDomain}; use crate::types::{AcmeConfig, AcmeDomain};
pub struct OrderedCertificate { pub struct OrderedCertificate {
@ -15,13 +14,11 @@ pub struct OrderedCertificate {
pub private_key_pem: Vec<u8>, pub private_key_pem: Vec<u8>,
} }
impl AcmeApiConfig { pub async fn order_certificate(
pub async fn order_certificate(
&self,
worker: Arc<WorkerTask>, worker: Arc<WorkerTask>,
acme_config: AcmeConfig, acme_config: AcmeConfig,
domains: Vec<AcmeDomain>, domains: Vec<AcmeDomain>,
) -> Result<Option<OrderedCertificate>, Error> { ) -> Result<Option<OrderedCertificate>, Error> {
use proxmox_acme::authorization::Status; use proxmox_acme::authorization::Status;
use proxmox_acme::order::Identifier; use proxmox_acme::order::Identifier;
@ -40,9 +37,11 @@ impl AcmeApiConfig {
return Ok(None); return Ok(None);
} }
let mut acme = self.load_account_config(&acme_config.account).await?.client(); let mut acme = super::account_config::load_account_config(&acme_config.account)
.await?
.client();
let (plugins, _) = self.plugin_config()?; let (plugins, _) = super::plugin_config::plugin_config()?;
task_log!(worker, "Placing ACME order"); task_log!(worker, "Placing ACME order");
@ -77,8 +76,8 @@ impl AcmeApiConfig {
task_log!(worker, "The validation for {} is pending", domain); task_log!(worker, "The validation for {} is pending", domain);
let domain_config: &AcmeDomain = get_domain_config(&domain)?; let domain_config: &AcmeDomain = get_domain_config(&domain)?;
let plugin_id = domain_config.plugin.as_deref().unwrap_or("standalone"); let plugin_id = domain_config.plugin.as_deref().unwrap_or("standalone");
let mut plugin_cfg = crate::acme_plugin::get_acme_plugin(&plugins, plugin_id)? let mut plugin_cfg =
.ok_or_else(|| { crate::acme_plugin::get_acme_plugin(&plugins, plugin_id)?.ok_or_else(|| {
format_err!("plugin '{}' for domain '{}' not found!", plugin_id, domain) format_err!("plugin '{}' for domain '{}' not found!", plugin_id, domain)
})?; })?;
@ -87,7 +86,7 @@ impl AcmeApiConfig {
.setup(&mut acme, &auth, domain_config, Arc::clone(&worker)) .setup(&mut acme, &auth, domain_config, Arc::clone(&worker))
.await?; .await?;
let result = Self::request_validation(&worker, &mut acme, auth_url, validation_url).await; let result = request_validation(&worker, &mut acme, auth_url, validation_url).await;
if let Err(err) = plugin_cfg if let Err(err) = plugin_cfg
.teardown(&mut acme, &auth, domain_config, Arc::clone(&worker)) .teardown(&mut acme, &auth, domain_config, Arc::clone(&worker))
@ -168,14 +167,14 @@ impl AcmeApiConfig {
certificate: certificate.to_vec(), certificate: certificate.to_vec(),
private_key_pem: csr.private_key_pem, private_key_pem: csr.private_key_pem,
})) }))
} }
async fn request_validation( async fn request_validation(
worker: &WorkerTask, worker: &WorkerTask,
acme: &mut AcmeClient, acme: &mut AcmeClient,
auth_url: &str, auth_url: &str,
validation_url: &str, validation_url: &str,
) -> Result<(), Error> { ) -> Result<(), Error> {
task_log!(worker, "Triggering validation"); task_log!(worker, "Triggering validation");
acme.request_challenge_validation(validation_url).await?; acme.request_challenge_validation(validation_url).await?;
@ -202,5 +201,4 @@ impl AcmeApiConfig {
), ),
} }
} }
}
} }

49
proxmox-acme-api/src/config.rs
View File

@ -1,26 +1,15 @@
//! ACME API Configuration. //! ACME API Configuration.
use std::borrow::Cow; use std::borrow::Cow;
use std::path::{Path, PathBuf};
use proxmox_sys::error::SysError; use proxmox_sys::error::SysError;
use proxmox_sys::fs::CreateOptions; use proxmox_sys::fs::CreateOptions;
use proxmox_product_config::product_config;
use crate::types::KnownAcmeDirectory; use crate::types::KnownAcmeDirectory;
/// ACME API Configuration.
///
/// This struct provides access to the server side configuration, like the
/// configuration directory. All ACME API functions are implemented as member
/// fuction, so they all have access to this configuration.
///
pub struct AcmeApiConfig {
/// Path to the ACME configuration directory.
pub config_dir: &'static str,
/// Configuration file owner.
pub file_owner: fn() -> nix::unistd::User,
}
/// List of known ACME directorties. /// List of known ACME directorties.
pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[ pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[
KnownAcmeDirectory { KnownAcmeDirectory {
@ -36,20 +25,19 @@ pub const KNOWN_ACME_DIRECTORIES: &[KnownAcmeDirectory] = &[
/// Default ACME directorties. /// Default ACME directorties.
pub const DEFAULT_ACME_DIRECTORY_ENTRY: &KnownAcmeDirectory = &KNOWN_ACME_DIRECTORIES[0]; pub const DEFAULT_ACME_DIRECTORY_ENTRY: &KnownAcmeDirectory = &KNOWN_ACME_DIRECTORIES[0];
// local helpers to read/write acme configuration pub(crate) fn acme_config_dir() -> PathBuf {
impl AcmeApiConfig { product_config().absolute_path("acme")
pub(crate) fn acme_config_dir(&self) -> &'static str { }
self.config_dir
}
pub(crate) fn plugin_cfg_filename(&self) -> String { pub(crate) fn plugin_cfg_filename() -> PathBuf {
format!("{}/plugins.cfg", self.acme_config_dir()) acme_config_dir().join("plugins.cfg")
} }
pub(crate) fn plugin_cfg_lockfile(&self) -> String {
format!("{}/.plugins.lck", self.acme_config_dir())
}
pub(crate) fn create_acme_subdir(dir: &str) -> nix::Result<()> { pub(crate) fn plugin_cfg_lockfile() -> PathBuf {
acme_config_dir().join("plugins.lck")
}
pub(crate) fn create_secret_subdir<P: AsRef<Path>>(dir: P) -> nix::Result<()> {
let root_only = CreateOptions::new() let root_only = CreateOptions::new()
.owner(nix::unistd::ROOT) .owner(nix::unistd::ROOT)
.group(nix::unistd::Gid::from_raw(0)) .group(nix::unistd::Gid::from_raw(0))
@ -60,9 +48,8 @@ impl AcmeApiConfig {
Err(err) if err.already_exists() => Ok(()), Err(err) if err.already_exists() => Ok(()),
Err(err) => Err(err), Err(err) => Err(err),
} }
} }
pub(crate) fn make_acme_dir(&self) -> nix::Result<()> { pub(crate) fn make_acme_dir() -> nix::Result<()> {
Self::create_acme_subdir(&self.acme_config_dir()) create_secret_subdir(acme_config_dir())
}
} }

26
proxmox-acme-api/src/lib.rs
View File

@ -4,25 +4,37 @@
pub mod types; pub mod types;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub mod challenge_schemas; mod config;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub mod config; mod challenge_schemas;
#[cfg(feature = "impl")]
pub use challenge_schemas::get_cached_challenge_schemas;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod account_config; mod account_config;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod plugin_config; mod plugin_config;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod account_api_impl; mod account_api_impl;
#[cfg(feature = "impl")]
pub use account_api_impl::{
deactivate_account, get_account, get_tos, list_accounts, register_account, update_account,
};
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod plugin_api_impl; mod plugin_api_impl;
#[cfg(feature = "impl")]
pub use plugin_api_impl::{add_plugin, delete_plugin, get_plugin, list_plugins, update_plugin};
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod acme_plugin; pub(crate) mod acme_plugin;
#[cfg(feature = "impl")] #[cfg(feature = "impl")]
pub(crate) mod certificate_helpers; mod certificate_helpers;
#[cfg(feature = "impl")]
pub use certificate_helpers::order_certificate;

61
proxmox-acme-api/src/plugin_api_impl.rs
View File

@ -8,45 +8,36 @@ use serde_json::Value;
use proxmox_schema::param_bail; use proxmox_schema::param_bail;
use crate::config::AcmeApiConfig; use crate::types::{
use crate::types::{DeletablePluginProperty, PluginConfig, DnsPlugin, DnsPluginCore, DnsPluginCoreUpdater}; DeletablePluginProperty, DnsPlugin, DnsPluginCore, DnsPluginCoreUpdater, PluginConfig,
};
use proxmox_router::{http_bail, RpcEnvironment}; use proxmox_router::{http_bail, RpcEnvironment};
impl AcmeApiConfig { pub fn list_plugins(rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<PluginConfig>, Error> {
pub fn list_plugins( let (plugins, digest) = super::plugin_config::plugin_config()?;
&self,
rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<PluginConfig>, Error> {
let (plugins, digest) = self.plugin_config()?;
rpcenv["digest"] = hex::encode(digest).into(); rpcenv["digest"] = hex::encode(digest).into();
Ok(plugins Ok(plugins
.iter() .iter()
.map(|(id, (ty, data))| modify_cfg_for_api(id, ty, data)) .map(|(id, (ty, data))| modify_cfg_for_api(id, ty, data))
.collect()) .collect())
} }
pub fn get_plugin( pub fn get_plugin(
&self,
id: String, id: String,
rpcenv: &mut dyn RpcEnvironment, rpcenv: &mut dyn RpcEnvironment,
) -> Result<PluginConfig, Error> { ) -> Result<PluginConfig, Error> {
let (plugins, digest) = self.plugin_config()?; let (plugins, digest) = super::plugin_config::plugin_config()?;
rpcenv["digest"] = hex::encode(digest).into(); rpcenv["digest"] = hex::encode(digest).into();
match plugins.get(&id) { match plugins.get(&id) {
Some((ty, data)) => Ok(modify_cfg_for_api(&id, ty, data)), Some((ty, data)) => Ok(modify_cfg_for_api(&id, ty, data)),
None => http_bail!(NOT_FOUND, "no such plugin"), None => http_bail!(NOT_FOUND, "no such plugin"),
} }
} }
pub fn add_plugin( pub fn add_plugin(r#type: String, core: DnsPluginCore, data: String) -> Result<(), Error> {
&self,
r#type: String,
core: DnsPluginCore,
data: String,
) -> Result<(), Error> {
// Currently we only support DNS plugins and the standalone plugin is "fixed": // Currently we only support DNS plugins and the standalone plugin is "fixed":
if r#type != "dns" { if r#type != "dns" {
param_bail!("type", "invalid ACME plugin type: {:?}", r#type); param_bail!("type", "invalid ACME plugin type: {:?}", r#type);
@ -57,9 +48,9 @@ impl AcmeApiConfig {
let id = core.id.clone(); let id = core.id.clone();
let _lock = self.lock_plugin_config()?; let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, _digest) = self.plugin_config()?; let (mut plugins, _digest) = super::plugin_config::plugin_config()?;
if plugins.contains_key(&id) { if plugins.contains_key(&id) {
param_bail!("id", "ACME plugin ID {:?} already exists", id); param_bail!("id", "ACME plugin ID {:?} already exists", id);
} }
@ -68,19 +59,18 @@ impl AcmeApiConfig {
plugins.insert(id, r#type, plugin); plugins.insert(id, r#type, plugin);
self.save_plugin_config(&plugins)?; super::plugin_config::save_plugin_config(&plugins)?;
Ok(()) Ok(())
} }
pub fn update_plugin( pub fn update_plugin(
&self,
id: String, id: String,
update: DnsPluginCoreUpdater, update: DnsPluginCoreUpdater,
data: Option<String>, data: Option<String>,
delete: Option<Vec<DeletablePluginProperty>>, delete: Option<Vec<DeletablePluginProperty>>,
digest: Option<String>, digest: Option<String>,
) -> Result<(), Error> { ) -> Result<(), Error> {
let data = data let data = data
.as_deref() .as_deref()
.map(base64::decode) .map(base64::decode)
@ -89,9 +79,9 @@ impl AcmeApiConfig {
.transpose() .transpose()
.map_err(|_| format_err!("data must be valid UTF-8"))?; .map_err(|_| format_err!("data must be valid UTF-8"))?;
let _lock = self.lock_plugin_config()?; let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, expected_digest) = self.plugin_config()?; let (mut plugins, expected_digest) = super::plugin_config::plugin_config()?;
if let Some(digest) = digest { if let Some(digest) = digest {
let digest = <[u8; 32]>::from_hex(digest)?; let digest = <[u8; 32]>::from_hex(digest)?;
@ -138,22 +128,21 @@ impl AcmeApiConfig {
None => http_bail!(NOT_FOUND, "no such plugin"), None => http_bail!(NOT_FOUND, "no such plugin"),
} }
self.save_plugin_config(&plugins)?; super::plugin_config::save_plugin_config(&plugins)?;
Ok(()) Ok(())
} }
pub fn delete_plugin(&self, id: String) -> Result<(), Error> { pub fn delete_plugin(id: String) -> Result<(), Error> {
let _lock = self.lock_plugin_config()?; let _lock = super::plugin_config::lock_plugin_config()?;
let (mut plugins, _digest) = self.plugin_config()?; let (mut plugins, _digest) = super::plugin_config::plugin_config()?;
if plugins.remove(&id).is_none() { if plugins.remove(&id).is_none() {
http_bail!(NOT_FOUND, "no such plugin"); http_bail!(NOT_FOUND, "no such plugin");
} }
self.save_plugin_config(&plugins)?; super::plugin_config::save_plugin_config(&plugins)?;
Ok(()) Ok(())
}
} }
// See PMG/PVE's $modify_cfg_for_api sub // See PMG/PVE's $modify_cfg_for_api sub

54
proxmox-acme-api/src/plugin_config.rs
View File

@ -6,9 +6,9 @@ use serde_json::Value;
use proxmox_schema::{ApiType, Schema}; use proxmox_schema::{ApiType, Schema};
use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin}; use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin};
use proxmox_product_config::{ApiLockGuard, open_api_lockfile, replace_config};
use crate::config::AcmeApiConfig; use crate::types::{DnsPlugin, StandalonePlugin, PLUGIN_ID_SCHEMA};
use crate::types::{PLUGIN_ID_SCHEMA, DnsPlugin, StandalonePlugin};
lazy_static! { lazy_static! {
static ref CONFIG: SectionConfig = init(); static ref CONFIG: SectionConfig = init();
@ -52,31 +52,16 @@ fn init() -> SectionConfig {
config config
} }
// LockGuard for the plugin configuration pub(crate) fn lock_plugin_config() -> Result<ApiLockGuard, Error> {
pub(crate) struct AcmePluginConfigLockGuard { super::config::make_acme_dir()?;
_file: Option<std::fs::File>,
let plugin_cfg_lockfile = super::config::plugin_cfg_lockfile();
open_api_lockfile(plugin_cfg_lockfile, None, true)
} }
impl AcmeApiConfig { pub(crate) fn plugin_config() -> Result<(PluginData, [u8; 32]), Error> {
pub(crate) fn lock_plugin_config(&self) -> Result<AcmePluginConfigLockGuard, Error> { let plugin_cfg_filename = super::config::plugin_cfg_filename();
self.make_acme_dir()?;
let file_owner = (self.file_owner)();
let mode = nix::sys::stat::Mode::from_bits_truncate(0o0660);
let options = proxmox_sys::fs::CreateOptions::new()
.perm(mode)
.owner(file_owner.uid)
.group(file_owner.gid);
let timeout = std::time::Duration::new(10, 0);
let plugin_cfg_lockfile = self.plugin_cfg_lockfile();
let file = proxmox_sys::fs::open_file_locked(&plugin_cfg_lockfile, timeout, true, options)?;
Ok(AcmePluginConfigLockGuard { _file: Some(file) })
}
pub(crate) fn plugin_config(&self) -> Result<(PluginData, [u8; 32]), Error> {
let plugin_cfg_filename = self.plugin_cfg_filename();
let content = let content =
proxmox_sys::fs::file_read_optional_string(&plugin_cfg_filename)?.unwrap_or_default(); proxmox_sys::fs::file_read_optional_string(&plugin_cfg_filename)?.unwrap_or_default();
@ -91,23 +76,14 @@ impl AcmeApiConfig {
} }
Ok((PluginData { data }, digest)) Ok((PluginData { data }, digest))
} }
pub(crate) fn save_plugin_config(&self, config: &PluginData) -> Result<(), Error> { pub(crate) fn save_plugin_config(config: &PluginData) -> Result<(), Error> {
self.make_acme_dir()?; super::config::make_acme_dir()?;
let plugin_cfg_filename = self.plugin_cfg_filename(); let plugin_cfg_filename = super::config::plugin_cfg_filename();
let raw = CONFIG.write(&plugin_cfg_filename, &config.data)?; let raw = CONFIG.write(&plugin_cfg_filename, &config.data)?;
let file_owner = (self.file_owner)();
let mode = nix::sys::stat::Mode::from_bits_truncate(0o0640); replace_config(plugin_cfg_filename, raw.as_bytes())
// set the correct owner/group/permissions while saving file
let options = proxmox_sys::fs::CreateOptions::new()
.perm(mode)
.owner(file_owner.uid)
.group(file_owner.gid);
proxmox_sys::fs::replace_file(plugin_cfg_filename, raw.as_bytes(), options, true)
}
} }
pub(crate) struct PluginData { pub(crate) struct PluginData {