src/PMG/CLI/pmgconfig.pm

   1 package PMG::CLI::pmgconfig;
   2
   3 use strict;
   4 use warnings;
   5 use IO::File;
   6 use Data::Dumper;
   7
   8 use Term::ReadLine;
   9
  10 use PVE::SafeSyslog;
  11 use PVE::Tools qw(extract_param);
  12 use PVE::INotify;
  13 use PVE::CLIHandler;
  14 use PVE::JSONSchema qw(get_standard_option);
  15
  16 use PMG::RESTEnvironment;
  17 use PMG::RuleDB;
  18 use PMG::RuleCache;
  19 use PMG::Cluster;
  20 use PMG::LDAPConfig;
  21 use PMG::LDAPSet;
  22 use PMG::Config;
  23 use PMG::Ticket;
  24
  25 use PMG::API2::ACME;
  26 use PMG::API2::ACMEPlugin;
  27 use PMG::API2::Certificates;
  28 use PMG::API2::DKIMSign;
  29
  30 use base qw(PVE::CLIHandler);
  31
  32 my $nodename = PVE::INotify::nodename();
  33
  34 sub setup_environment {
  35     PMG::RESTEnvironment->setup_default_cli_env();
  36 }
  37
  38 my $upid_exit = sub {
  39     my $upid = shift;
  40     my $status = PVE::Tools::upid_read_status($upid);
  41     print "Task $status\n";
  42     exit($status eq 'OK' ? 0 : -1);
  43 };
  44
  45 sub param_mapping {
  46     my ($name) = @_;
  47
  48     my $load_file_and_encode = sub {
  49         my ($filename) = @_;
  50
  51         return PVE::ACME::Challenge->encode_value('string', 'data', PVE::Tools::file_get_contents($filename));
  52     };
  53
  54     my $mapping = {
  55         'upload_custom_cert' => [
  56             'certificates',
  57             'key',
  58         ],
  59         'add_plugin' => [
  60             ['data', $load_file_and_encode, "File with one key-value pair per line, will be base64url encode for storage in plugin config.", 0],
  61         ],
  62         'update_plugin' => [
  63             ['data', $load_file_and_encode, "File with one key-value pair per line, will be base64url encode for storage in plugin config.", 0],
  64         ],
  65     };
  66
  67     return $mapping->{$name};
  68 }
  69
  70 __PACKAGE__->register_method ({
  71     name => 'dump',
  72     path => 'dump',
  73     method => 'POST',
  74     description => "Print configuration setting which can be used in templates.",
  75     parameters => {
  76         additionalProperties => 0,
  77         properties => {},
  78     },
  79     returns => { type => 'null'},
  80     code => sub {
  81         my ($param) = @_;
  82
  83         my $cfg = PMG::Config->new();
  84         my $vars = $cfg->get_template_vars();
  85
  86         foreach my $realm (sort keys %$vars) {
  87             foreach my $section (sort keys %{$vars->{$realm}}) {
  88                 my $secvalue = $vars->{$realm}->{$section} // '';
  89                 if (ref($secvalue)) {
  90                     foreach my $key (sort keys %{$vars->{$realm}->{$section}}) {
  91                         my $value = $vars->{$realm}->{$section}->{$key} // '';
  92                         print "$realm.$section.$key = $value\n";
  93                     }
  94                 } else {
  95                     print "$realm.$section = $secvalue\n";
  96                 }
  97             }
  98         }
  99
 100         return undef;
 101     }});
 102
 103 __PACKAGE__->register_method ({
 104     name => 'sync',
 105     path => 'sync',
 106     method => 'POST',
 107     description => "Synchronize Proxmox Mail Gateway configurations with system configuration.",
 108     parameters => {
 109         additionalProperties => 0,
 110         properties => {
 111             restart => {
 112                 description => "Restart services if necessary.",
 113                 type => 'boolean',
 114                 default => 0,
 115                 optional => 1,
 116             },
 117         },
 118     },
 119     returns => { type => 'null'},
 120     code => sub {
 121         my ($param) = @_;
 122
 123         my $cfg = PMG::Config->new();
 124
 125         my $ruledb = PMG::RuleDB->new();
 126         my $rulecache = PMG::RuleCache->new($ruledb);
 127
 128         $cfg->rewrite_config($rulecache, $param->{restart});
 129
 130         return undef;
 131     }});
 132
 133 __PACKAGE__->register_method ({
 134     name => 'ldapsync',
 135     path => 'ldapsync',
 136     method => 'POST',
 137     description => "Synchronize the LDAP database.",
 138     parameters => {
 139         additionalProperties => 0,
 140         properties => {},
 141     },
 142     returns => { type => 'null'},
 143     code => sub {
 144         my ($param) = @_;
 145
 146         my $ldap_cfg = PVE::INotify::read_file("pmg-ldap.conf");
 147         PMG::LDAPSet::ldap_resync($ldap_cfg, 1);
 148
 149         return undef;
 150     }});
 151
 152 __PACKAGE__->register_method ({
 153     name => 'apicert',
 154     path => 'apicert',
 155     method => 'POST',
 156     description => "Generate /etc/pmg/pmg-api.pem (self signed certificate for GUI and REST API).",
 157     parameters => {
 158         additionalProperties => 0,
 159         properties => {
 160             force => {
 161                 description => "Overwrite existing certificate.",
 162                 type => 'boolean',
 163                 optional => 1,
 164                 default => 0,
 165             },
 166         },
 167     },
 168     returns => { type => 'null'},
 169     code => sub {
 170         my ($param) = @_;
 171
 172         PMG::Ticket::generate_api_cert($param->{force});
 173
 174         return undef;
 175     }});
 176
 177 __PACKAGE__->register_method ({
 178     name => 'tlscert',
 179     path => 'tlscert',
 180     method => 'POST',
 181     description => "Generate /etc/pmg/pmg-tls.pem (self signed certificate for encrypted SMTP traffic).",
 182     parameters => {
 183         additionalProperties => 0,
 184         properties => {
 185             force => {
 186                 description => "Overwrite existing certificate.",
 187                 type => 'boolean',
 188                 optional => 1,
 189                 default => 0,
 190             },
 191         },
 192     },
 193     returns => { type => 'null'},
 194     code => sub {
 195         my ($param) = @_;
 196
 197         PMG::Utils::gen_proxmox_tls_cert($param->{force});
 198
 199         return undef;
 200     }});
 201
 202 __PACKAGE__->register_method ({
 203     name => 'init',
 204     path => 'init',
 205     method => 'POST',
 206     description => "Generate required files in /etc/pmg/",
 207     parameters => {
 208         additionalProperties => 0,
 209         properties => {},
 210     },
 211     returns => { type => 'null'},
 212     code => sub {
 213         my ($param) = @_;
 214
 215         my $cfg = PMG::Config->new();
 216
 217         PMG::Ticket::generate_api_cert();
 218         PMG::Ticket::generate_csrf_key();
 219         PMG::Ticket::generate_auth_key();
 220
 221         if ($cfg->get('mail', 'tls')) {
 222             PMG::Utils::gen_proxmox_tls_cert();
 223         }
 224
 225         return undef;
 226     }});
 227
 228 __PACKAGE__->register_method({
 229     name => 'acme_register',
 230     path => 'acme_register',
 231     method => 'POST',
 232     description => "Register a new ACME account with a compatible CA.",
 233     parameters => {
 234         additionalProperties => 0,
 235         properties => {
 236             name => get_standard_option('pmg-acme-account-name'),
 237             contact => get_standard_option('pmg-acme-account-contact'),
 238             directory => get_standard_option('pmg-acme-directory-url', {
 239                 optional => 1,
 240             }),
 241         },
 242     },
 243     returns => { type => 'null' },
 244     code => sub {
 245         my ($param) = @_;
 246
 247         if (!$param->{directory}) {
 248             my $directories = PMG::API2::ACME->get_directories({});
 249             print "Directory endpoints:\n";
 250             my $i = 0;
 251             while ($i < @$directories) {
 252                 print $i, ") ", $directories->[$i]->{name}, " (", $directories->[$i]->{url}, ")\n";
 253                 $i++;
 254             }
 255             print $i, ") Custom\n";
 256
 257             my $term = Term::ReadLine->new('pmgconfig');
 258             my $get_dir_selection = sub {
 259                 my $selection = $term->readline("Enter selection: ");
 260                 if ($selection =~ /^(\d+)$/) {
 261                     $selection = $1;
 262                     if ($selection == $i) {
 263                         $param->{directory} = $term->readline("Enter custom URL: ");
 264                         return;
 265                     } elsif ($selection < $i && $selection >= 0) {
 266                         $param->{directory} = $directories->[$selection]->{url};
 267                         return;
 268                     }
 269                 }
 270                 print "Invalid selection.\n";
 271             };
 272
 273             my $attempts = 0;
 274             while (!$param->{directory}) {
 275                 die "Aborting.\n" if $attempts > 3;
 276                 $get_dir_selection->();
 277                 $attempts++;
 278             }
 279         }
 280         print "\nAttempting to fetch Terms of Service from '$param->{directory}'..\n";
 281         my $tos = PMG::API2::ACME->get_tos({ directory => $param->{directory} });
 282         if ($tos) {
 283             print "Terms of Service: $tos\n";
 284             my $term = Term::ReadLine->new('pvenode');
 285             my $agreed = $term->readline('Do you agree to the above terms? [y|N]: ');
 286             die "Cannot continue without agreeing to ToS, aborting.\n"
 287                 if ($agreed !~ /^y$/i);
 288
 289             $param->{tos_url} = $tos;
 290         } else {
 291             print "No Terms of Service found, proceeding.\n";
 292         }
 293         print "\nAttempting to register account with '$param->{directory}'..\n";
 294
 295         $upid_exit->(PMG::API2::ACME->register_account($param));
 296     }});
 297
 298 my $print_cert_info = sub {
 299     my ($schema, $cert, $options) = @_;
 300
 301     my $order = [qw(filename fingerprint subject issuer notbefore notafter public-key-type public-key-bits san)];
 302     PVE::CLIFormatter::print_api_result(
 303         $cert, $schema, $order, { %$options, noheader => 1, sort_key => 0 });
 304 };
 305
 306 our $cmddef = {
 307     'dump' => [ __PACKAGE__, 'dump', []],
 308     sync => [ __PACKAGE__, 'sync', []],
 309     ldapsync => [ __PACKAGE__, 'ldapsync', []],
 310     apicert => [ __PACKAGE__, 'apicert', []],
 311     tlscert => [ __PACKAGE__, 'tlscert', []],
 312     init => [ __PACKAGE__, 'init', []],
 313     dkim_set => [ 'PMG::API2::DKIMSign', 'set_selector', []],
 314     dkim_record => [ 'PMG::API2::DKIMSign', 'get_selector_info', [], undef,
 315         sub {
 316             my ($res) = @_;
 317             die "no dkim_selector configured\n" if !defined($res->{record});
 318             print "$res->{record}\n";
 319         }],
 320
 321     cert => {
 322         info => [ 'PMG::API2::Certificates', 'info', [], { node => $nodename }, sub {
 323             my ($res, $schema, $options) = @_;
 324
 325             if (!$options->{'output-format'} || $options->{'output-format'} eq 'text') {
 326                 for my $cert (sort { $a->{filename} cmp $b->{filename} } @$res) {
 327                     $print_cert_info->($schema->{items}, $cert, $options);
 328                 }
 329             } else {
 330                 PVE::CLIFormatter::print_api_result($res, $schema, undef, $options);
 331             }
 332
 333         }, $PVE::RESTHandler::standard_output_options],
 334         set => [ 'PMG::API2::Certificates', 'upload_custom_cert', ['type', 'certificates', 'key'], { node => $nodename }, sub {
 335             my ($res, $schema, $options) = @_;
 336             $print_cert_info->($schema, $res, $options);
 337         }, $PVE::RESTHandler::standard_output_options],
 338         delete => [ 'PMG::API2::Certificates', 'remove_custom_cert', ['type', 'restart'], { node => $nodename } ],
 339     },
 340
 341     acme => {
 342         account => {
 343             list => [ 'PMG::API2::ACME', 'account_index', [], {}, sub {
 344                 my ($res) = @_;
 345                 for my $acc (@$res) {
 346                     print "$acc->{name}\n";
 347                 }
 348             }],
 349             register => [ __PACKAGE__, 'acme_register', ['name', 'contact'], {}, $upid_exit ],
 350             deactivate => [ 'PMG::API2::ACME', 'deactivate_account', ['name'], {}, $upid_exit ],
 351             info => [ 'PMG::API2::ACME', 'get_account', ['name'], {}, sub {
 352                 my ($data, $schema, $options) = @_;
 353                 PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
 354             }, $PVE::RESTHandler::standard_output_options],
 355             update => [ 'PMG::API2::ACME', 'update_account', ['name'], {}, $upid_exit ],
 356         },
 357         cert => {
 358             order => [ 'PMG::API2::Certificates', 'new_acme_cert', ['type'], { node => $nodename }, $upid_exit ],
 359
 360
 361             renew => [ 'PMG::API2::Certificates', 'renew_acme_cert', ['type'], { node => $nodename }, $upid_exit ],
 362             revoke => [ 'PMG::API2::Certificates', 'revoke_acme_cert', ['type'], { node => $nodename }, $upid_exit ],
 363         },
 364         plugin => {
 365             list => [ 'PMG::API2::ACMEPlugin', 'index', [], {}, sub {
 366                 my ($data, $schema, $options) = @_;
 367                 PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
 368             }, $PVE::RESTHandler::standard_output_options ],
 369             config => [ 'PMG::API2::ACMEPlugin', 'get_plugin_config', ['id'], {}, sub {
 370                 my ($data, $schema, $options) = @_;
 371                 PVE::CLIFormatter::print_api_result($data, $schema, undef, $options);
 372             }, $PVE::RESTHandler::standard_output_options ],
 373             add => [ 'PMG::API2::ACMEPlugin', 'add_plugin', ['type', 'id'] ],
 374             set => [ 'PMG::API2::ACMEPlugin', 'update_plugin', ['id'] ],
 375             remove => [ 'PMG::API2::ACMEPlugin', 'delete_plugin', ['id'] ],
 376         },
 377
 378     },
 379 };
 380
 381
 382 1;