certs: reload postfix to activate new certificate

[pmg-api.git] / src / PMG / API2 / Certificates.pm

diff --git a/src/PMG/API2/Certificates.pm b/src/PMG/API2/Certificates.pm
index ff5cae57568c8615dedaa754f4a3cc2cec8a7d34..1a7ded68294ebba3508ceec22f4a28a15100e7d1 100644 (file)
--- a/src/PMG/API2/Certificates.pm
+++ b/src/PMG/API2/Certificates.pm
@@ -10,6 +10,7 @@ use PVE::Tools qw(extract_param file_get_contents file_set_contents);
 
 use PMG::CertHelpers;
 use PMG::NodeConfig;
+use PMG::RS::Acme;
 use PMG::RS::CSR;
 
 use PMG::API2::ACMEPlugin;
@@ -43,6 +44,12 @@ my sub restart_after_cert_update : prototype($) {
     if ($type eq 'api') {
        print "Restarting pmgproxy\n";
        PVE::Tools::run_command(['systemctl', 'reload-or-restart', 'pmgproxy']);
+
+       my $cinfo = PMG::ClusterConfig->new();
+       if (scalar(keys %{$cinfo->{ids}})) {
+           print "Notify cluster about new fingerprint\n";
+           PMG::Cluster::trigger_update_fingerprints($cinfo);
+       }
     }
 };
 
@@ -62,16 +69,14 @@ my sub set_smtp : prototype($$) {
 
     my $code = sub {
        my $cfg = PMG::Config->new();
-       if (!$cfg->get('mail', 'tls') == !$on) {
-           return;
+       if (!$cfg->get('mail', 'tls') != !$on) {
+           print "Rewriting postfix config\n";
+           $cfg->set('mail', 'tls', $on);
+           $cfg->write();
+           my $changed = $cfg->rewrite_config_postfix();
        }
 
-       print "Rewriting postfix config\n";
-       $cfg->set('mail', 'tls', $on);
-       $cfg->write();
-       my $changed = $cfg->rewrite_config_postfix();
-
-       if ($changed && $reload) {
+       if ($reload) {
            print "Reloading postfix\n";
            PMG::Utils::service_cmd('postfix', 'reload');
        }
@@ -339,7 +344,7 @@ my $order_certificate = sub {
     my $plugins = PMG::API2::ACMEPlugin::load_config();
 
     print "Placing ACME order\n";
-    my ($order_url, $order) = $acme->new_order([ keys %{$acme_node_config->{domains}} ]);
+    my ($order_url, $order) = $acme->new_order([ sort keys %{$acme_node_config->{domains}} ]);
     print "Order URL: $order_url\n";
     for my $auth_url (@{$order->{authorizations}}) {
        print "\nGetting authorization details from '$auth_url'\n";
@@ -387,7 +392,11 @@ my $order_certificate = sub {
                        print "Status is 'valid', domain '$domain' OK!\n";
                        last;
                    }
-                   die "validating challenge '$auth_url' failed - status: $auth->{status}\n";
+                   my $error = "validating challenge '$auth_url' failed - status: $auth->{status}";
+                   for (@{$auth->{challenges}}) {
+                       $error .= ", $_->{error}->{detail}" if $_->{error}->{detail};
+                   }
+                   die "$error\n";
                }
            };
            my $err = $@;
@@ -457,17 +466,13 @@ my $order_certificate = sub {
 my $filter_domains = sub {
     my ($acme_config, $type) = @_;
 
-    my $domains = $acme_config->{domains};
-    foreach my $domain (keys %$domains) {
-       my $entry = $domains->{$domain};
-       if (!(grep { $_ eq $type } PVE::Tools::split_list($entry->{usage}))) {
-           delete $domains->{$domain};
-       }
-    }
+    my $domains = PMG::NodeConfig::filter_domains_by_type($acme_config->{domains}, $type);
 
-    if (!%$domains) {
+    if (!$domains) {
        raise("No domains configured for type '$type'\n", 400);
     }
+
+    $acme_config->{domains} = $domains;
 };
 
 __PACKAGE__->register_method ({
@@ -505,7 +510,7 @@ __PACKAGE__->register_method ({
        my $node_config = PMG::NodeConfig::load_config();
        my $acme_config = PMG::NodeConfig::get_acme_conf($node_config);
        raise("ACME domain list in configuration is missing!", 400)
-           if !$acme_config || !$acme_config->{domains}->%*;
+           if !($acme_config && $acme_config->{domains} && $acme_config->{domains}->%*);
 
        $filter_domains->($acme_config, $type);
 
@@ -603,7 +608,11 @@ __PACKAGE__->register_method ({
 
            if (defined($old_cert)) {
                print "Revoking old certificate\n";
-               eval { $acme->revoke_certificate($old_cert, undef) };
+               eval {
+                   $old_cert = pem_certificate($old_cert)
+                       or die "no certificate section found in '$cert_path'\n";
+                   $acme->revoke_certificate($old_cert, undef);
+               };
                warn "Revoke request to CA failed: $@" if $@;
            }
        };