1 package PVE
::ACME
::DNSChallenge
;
6 use Digest
::SHA
qw(sha256);
13 use base
qw(PVE::ACME::Challenge);
15 my $ACME_PATH = '/usr/share/proxmox-acme/proxmox-acme';
17 sub supported_challenge_types
{
25 my $DNS_API_CHALLENGE_SCHEMA_FN = '/usr/share/proxmox-acme/dns-challenge-schema.json';
28 sub get_supported_plugins
{
30 $plugin_cache = -e
$DNS_API_CHALLENGE_SCHEMA_FN # we allow this to be optional as not all users require
31 ? from_json
(PVE
::Tools
::file_get_contents
($DNS_API_CHALLENGE_SCHEMA_FN))
38 my $plugins = get_supported_plugins
();
41 description
=> "API plugin name",
43 enum
=> [sort keys %$plugins],
47 description
=> 'DNS plugin data. (base64 encoded)',
49 'validation-delay' => {
51 description
=> 'Extra delay in seconds to wait before requesting validation.'
52 .' Allows to cope with a long TTL of DNS records.',
53 # low default, but our bet is that the acme-challenge domain isn't
54 # cached at all, so it hopefully shouldn't run into TTL issues
58 maximum
=> 2 * 24 * 60 * 60,
61 description
=> "Flag indicating whether a http proxy should be used.",
71 data
=> { optional
=> 1 },
72 nodes
=> { optional
=> 1 },
73 disable
=> { optional
=> 1 },
74 'validation-delay' => { optional
=> 1 },
75 'use-proxy' => { optional
=> 1 },
79 my $proxmox_acme_command = sub {
80 my ($self, $acme, $auth, $data, $action) = @_;
82 die "No plugin data for DNSChallenge\n" if !defined($data->{plugin
});
84 my $alias = $data->{alias
};
85 my $domain = $auth->{identifier
}->{value
};
87 my $challenge = $self->extract_challenge($auth->{challenges
});
88 my $key_auth = $acme->key_authorization($challenge->{token
});
90 my $txtvalue = PVE
::ACME
::encode
(sha256
($key_auth));
91 my $dnsplugin = $data->{plugin
}->{api
};
92 my $plugin_conf_string = $data->{plugin
}->{data
};
93 my $proxy = $data->{plugin
}->{proxy
};
95 # for security reasons, we execute the command as nobody
96 # we can't verify that the code of the DNSPlugins are harmless.
97 my $cmd = ["setpriv", "--reuid", "nobody", "--regid", "nogroup", "--clear-groups", "--reset-env", "--"];
99 # The order of the parameters passed to proxmox-acme is important
100 # proxmox-acme <setup|teardown> $plugin <$domain|$alias> $txtvalue [$plugin_conf_string]
101 push @$cmd, "/bin/bash", $ACME_PATH, $action, $dnsplugin;
107 my $input = "$txtvalue\n";
108 $input .= "$plugin_conf_string\n" if $plugin_conf_string;
109 $input .= "https_proxy=$proxy\nhttp_proxy=$proxy\n" if $proxy;
111 PVE
::Tools
::run_command
($cmd, input
=> $input);
113 $data->{url
} = $challenge->{url
};
119 my ($self, $acme, $auth, $data) = @_;
121 my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'setup');
122 print "Add TXT record: _acme-challenge.$domain\n";
124 my $delay = $data->{plugin
}->{'validation-delay'} // 30;
126 print "Sleeping $delay seconds to wait for TXT record propagation\n";
127 sleep($delay); # don't care for EINTR
132 my ($self, $acme, $auth, $data) = @_;
134 my $domain = $proxmox_acme_command->($self, $acme, $auth, $data, 'teardown');
135 print "Remove TXT record: _acme-challenge.$domain\n";