summary |
shortlog | log |
commit |
commitdiff |
tree
first ⋅ prev ⋅ next
Jens Meißner [Thu, 18 Nov 2021 08:49:34 +0000 (09:49 +0100)]
Add DNS challenge schema for knot.
Signed-off-by: Jens Meißner <meissner@b1-systems.de>
Thomas Lamprecht [Thu, 11 Nov 2021 09:17:14 +0000 (10:17 +0100)]
Revert "dns-challenge: add 'use-proxy' property"
a bit to weird of a place to configure this especially as enabling it
does not guarantee any proxying if there's none..
This reverts commit
e1088f616ffc73a96ee3433f0ea07639ef7513e7.
Stoiko Ivanov [Tue, 9 Nov 2021 16:36:29 +0000 (17:36 +0100)]
dns-challenge: add 'use-proxy' property
this patch adds an optional 'use-proxy' property to the dns
challenges.
If set to 1 the caller is expected to add the proxy url in the plugin
config, which is then set as 'http_proxy' and 'https_proxy'
environment variable by the plugin caller (and then used by curl)
Tested with the pdns plugin, direct traffic to the pdns server being
dropped, and a configured squid proxy
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Stoiko Ivanov [Tue, 9 Nov 2021 16:36:28 +0000 (17:36 +0100)]
add support for proxies
by setting the proxy for the LWP::UserAgent
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Thomas Lamprecht [Sat, 9 Oct 2021 12:21:05 +0000 (14:21 +0200)]
d/control: acme-perl: downgrade dependency to plugins to recommends
we have some places where we just do not need the plugins and the
perl library has no hard dependency on the plugin stuff, http
challenge and acme protocol implementation are independent of those
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 9 Nov 2021 16:57:57 +0000 (17:57 +0100)]
dns: cope with plugin json index not being available
not nice to die plainly on a using this module (which can come in
indirectly/transitively), so lets better cope with that.
Nice side-effect, if nothing uses it, it won't get loaded, so less
IO and memory in that case.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 8 Oct 2021 09:18:20 +0000 (11:18 +0200)]
buildsys: do not pass arch to upload
variable wasn't set and this is an `arch: all` package anyway..
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 8 Oct 2021 09:17:02 +0000 (11:17 +0200)]
bump version to 1.4.0
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 8 Oct 2021 09:03:58 +0000 (11:03 +0200)]
update acme.sh plugins to 3.0.1 and include new plugins in schema
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Fabian Grünbichler [Fri, 8 Oct 2021 08:18:21 +0000 (10:18 +0200)]
support downloading alternate chains
the current default chains end with an expired root certificate for
maximum compatibility with old Android versions. this breaks some other
older clients (openssl, gnutls) which don't expect chains to contain any
expired certificates, even if they are 'above' the trust anchor.
by setting $root, it is possible to specify which root the ACME provided
certificate chain should end with, downloading alternate chains as
necessary.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Reviewed-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Tested-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Jens Meißner [Mon, 13 Sep 2021 13:57:49 +0000 (15:57 +0200)]
Add DNS challenge schema for nsupdate.
Signed-off-by: Jens Meißner <meissner@b1-systems.de>
Fabian Grünbichler [Wed, 11 Aug 2021 10:26:39 +0000 (12:26 +0200)]
bump version to 1.3.0
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Stoiko Ivanov [Fri, 6 Aug 2021 15:44:29 +0000 (17:44 +0200)]
plugin-caller: pull in changes from upstream 3.0.0
Commits
ae3dda0f8fc3071495cd1e8dff0fe4a339febb1c and
d70b759cb9c5b413cce92e65e841a54a65813962
implementing retrying get and post requests seem worth pulling in.
From a quick look through the diff the remaining changes (between
2.9.0 and 3.0.0) should not be relevant for us
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Stoiko Ivanov [Fri, 6 Aug 2021 15:44:28 +0000 (17:44 +0200)]
update to acme.sh dns plugins to 3.0.0
fixes #3546
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Stoiko Ivanov [Fri, 6 Aug 2021 15:44:27 +0000 (17:44 +0200)]
acme client: fix #3536 untaint data returned from acme server
The data returned from the acme server (e.g. boulder) should be
considered tainted.
To see which places might need untainted I checked where $self->{ua}
was used (in $self->do) and a quick scan identified __get_result as
the consumer of the tainted data.
In all but one uses the data is decoded from json (which would die if the
result is not valid json).
The remaining use-case yields a certificate in PEM format (and is
handled at the caller of __get_result).
The issue is currently only visible if a proxy is set, because AFAICT
somewhere in SSLeay (or IO::Socket::SSL, which uses SSLeay) a taint
flag is not set on the return value.
A reproducer for the issue:
```
use strict;
use warnings;
use HTTP::Request;
use LWP::UserAgent;
$ENV{PATH} = "/usr/bin:/bin";
my $ua = LWP::UserAgent->new(env_proxy => 0);
my $request = HTTP::Request->new('GET', 'https://google.com/');
my $resp = $ua->request($request);
my $text = substr($resp->decoded_content, 0, 5);;
system("echo \"$text\""); # does work
$request = HTTP::Request->new('GET', 'http://neverssl.com/');
$resp = $ua->request($request);
$text = substr($resp->decoded_content, 0, 5);;
system("echo \"$text\""); # does not work
```
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Thomas Lamprecht [Fri, 16 Jul 2021 16:06:24 +0000 (18:06 +0200)]
bump version to 1.2.0
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 16 Jul 2021 16:03:37 +0000 (18:03 +0200)]
update to acme.sh dns plugins to 2.9.0
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Stoiko Ivanov [Fri, 16 Jul 2021 13:43:05 +0000 (15:43 +0200)]
plugin-caller: make no-ops always successful
proxmox-acme is used to call the dns-plugins from acme.sh and has the
config editing (saving/clearing) turned int no-ops.
bash's `return` statement w/o argument returns the value of the last
executed command (the one before our no-op method was called) (see
`help return` in bash).
This leads to unexpected behavior in some plugins, which call one of
the methods as last statement join the next step with `&&`.
tested bash behavior with:
```
foo() { return; }; if [ -z 'x' ]; then :; else foo ; fi; echo $?
```
reported in our community-forum:
https://forum.proxmox.com/threads/pmg-acme-dns-with-cyon-failing-to-issue-certificate.92762
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Stoiko Ivanov [Thu, 15 Jul 2021 13:56:57 +0000 (15:56 +0200)]
plugin-caller: add missing methods from acme.sh
As reported in our community forum [0] certain dns plugins use code
from `acme.sh`, which is currently not in our proxmox-acme.
I initially only added _sign and it's callees, but then though about
trying to get all missing methods somehow (only resethttp() was
missing in addition).
The heuristic used to get all missing methods was grepping for '\b_'
in all dns plugins and then removing:
* declarations in proxmox_acme (already present)
* methods declared in the plugins themselves
* $_.* (or ${_.*) - variable use
* comments
in shell:
```
present=$(awk 'BEGIN{ORS="|";} /^_/{ gsub(/\(\) {/, ""); print $0}' \
src/proxmox-acme | | sed -r 's/\|$//')
local=$(awk 'BEGIN{ORS="|";} /^_/{ gsub(/\(\) {/, ""); print $0}' \
src/acme.sh/dnsapi/dns*.sh | sed -r 's/\|$//')
grep '\b_' src/acme.sh/dnsapi/* | grep -Ev \
"$present|$local|_[a-zA-Z0-9_-]+=|\\$\{?_|^src/acme.sh/dnsapi/.*sh:#"
```
[0] https://forum.proxmox.com/threads/proxmox-acme-with-transip-plugin-_sign-command-not-found.92582/
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Thomas Lamprecht [Mon, 5 Jul 2021 16:58:34 +0000 (18:58 +0200)]
bump version to 1.1.1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Stoiko Ivanov [Wed, 12 May 2021 19:04:52 +0000 (21:04 +0200)]
fix #3390: standalone: explicitly bind to '::'
This patch follows
2f8be3bfda203065b22e60862e5f98d831a46921 from
pve-common:
Instead of not specifying a listen address, we first try to bind on
'::', which usually accepts connections for both ipv4 and ipv6,
and fall back to '0.0.0.0' if this fails (if ipv6 is disabled via
kernel commandline).
The arguments are the same for HTTP::Daemon as for IO::Socket::IP,
since the former has IO::Socket::IP as base.
Additionally, by setting 'V6Only' explicitly to '0', the listening
socket will also accept ipv4 connections, even if the sysctl
'net.ipv6.bindv6only' is set to 1 - the sysctl provides a default
value, which can be overridden by a socket-option (see ipv6(7) -
IPV6_ONLY).
setting this option results in the following setsockopt-call being
added:
setsockopt(3, SOL_IPV6, IPV6_V6ONLY, [0], 4) = 0
AFAICT the socket option is available and overridable on Linux > 2.4
see [0] for an explanation of why this might not be wanted
Overriding the default setting set by an admin might be debateable,
but considering that the http-listener for the ACME challenge is
rather short-lived I think this is justified. The only other option
would be to create 2 listening sockets and binding on both - which
would mean reorganizing our perl-deamons to deal with multiple listen
sockets.
quickly tested on a publicly reachable test-machine of mine with:
* ipv6.domain.test (only AAAA record)
* ip46.domain.test (both AAAA and A)
* ipv4.domain.test (only A record)
with:
* sysctl net.ipv6.bindv6only=1 (for all 3 domains)
* disabling ipv6 via kernel-commandline (only ipv4 tested)
* disabling ipv6 via sysctl (only ipv4 tested)
* only configuring an ipv6 address (only ipv6 tested)
[0] https://man.openbsd.org/inet6.4
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
Thomas Lamprecht [Tue, 8 Jun 2021 08:29:08 +0000 (10:29 +0200)]
buildsys: change upload dist to bullseye
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 07:57:46 +0000 (09:57 +0200)]
bump version to 1.1.0
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 08:47:42 +0000 (10:47 +0200)]
d/control: fix descriptions
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 07:49:17 +0000 (09:49 +0200)]
split into two packages: a perl one and an acme.sh plugin one
Main reason for this split is PBS, which only needs the plugins and
would like to avoid the perl one (which pulls in pve-common too)
This includes a few small changes which are technically not direct
part of the split, but related enough:
* change source name of package from libproxmox-acme-perl to
libproxmox-acme
* make lintian override for script exec permission narrower to avoid
possible false negatives in the future, really only allow the
dnsapi ones.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 12:07:35 +0000 (14:07 +0200)]
move DNS plugin schema to separate JSON based file
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 12:32:05 +0000 (14:32 +0200)]
buildsys: actually install new plugins
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Lorenz Stechauner [Wed, 5 May 2021 08:26:42 +0000 (10:26 +0200)]
dns challenge: add world4you schema
Signed-off-by: Lorenz Stechauner <l.stechauner@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 07:54:36 +0000 (09:54 +0200)]
update acme.sh plugins to 2.8.9 and include new plugins in schema
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Wed, 5 May 2021 07:53:49 +0000 (09:53 +0200)]
debian: set source format correctly
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 16 Mar 2021 16:11:51 +0000 (17:11 +0100)]
bump version to 1.0.8
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 16 Mar 2021 16:04:35 +0000 (17:04 +0100)]
dns: add new plugins to schema and install them
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 16 Mar 2021 15:56:54 +0000 (16:56 +0100)]
update acme.sh to current master
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Wolfgang Bumiller [Tue, 9 Mar 2021 14:13:54 +0000 (15:13 +0100)]
add missing 'use PVE::Acme' statement
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Thomas Lamprecht [Fri, 11 Dec 2020 17:55:33 +0000 (18:55 +0100)]
bump version to 1.0.7
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 11 Dec 2020 18:10:13 +0000 (19:10 +0100)]
acme: define kapper.net and acme-dns schema
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 11 Dec 2020 17:54:11 +0000 (18:54 +0100)]
buildsys: ensure new plugins also get installed
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 11 Dec 2020 17:50:22 +0000 (18:50 +0100)]
add basic test so schema is in sync with available plugins
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 11 Dec 2020 17:43:16 +0000 (18:43 +0100)]
dns challenge: add missing plugins to schema
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 7 Dec 2020 10:59:17 +0000 (11:59 +0100)]
bump version to 1.0.6
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Mon, 7 Dec 2020 10:53:57 +0000 (11:53 +0100)]
update acme.sh to 2.8.8
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Fabian Grünbichler [Fri, 4 Sep 2020 12:01:17 +0000 (14:01 +0200)]
bump version to 1.0.5
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Thomas Lamprecht [Sat, 23 May 2020 22:24:44 +0000 (00:24 +0200)]
fix #2732: use actual plugin config data
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sat, 23 May 2020 21:55:35 +0000 (23:55 +0200)]
dns challenge: add 'INWX' acme.sh schema
https://bugzilla.proxmox.com/show_bug.cgi?id=2731
Requested-by: Claas Hilbrecht <Claas.Hilbrecht@linum.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 15 May 2020 18:07:01 +0000 (20:07 +0200)]
bump version to 1.0.4
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 15 May 2020 18:03:29 +0000 (20:03 +0200)]
dns challenge: describe digitalocean schema
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 15 May 2020 18:03:01 +0000 (20:03 +0200)]
dns challenge: add df (dyndnsfree.de) provider
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 15 May 2020 17:57:20 +0000 (19:57 +0200)]
update acme.sh dns plugins to 2.8.6
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Fri, 15 May 2020 17:53:19 +0000 (19:53 +0200)]
make clean: clean more
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 7 May 2020 19:50:00 +0000 (21:50 +0200)]
bump version to 1.0.3
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 7 May 2020 18:39:56 +0000 (20:39 +0200)]
dns challenge: provide schema for more providers
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 7 May 2020 15:29:35 +0000 (17:29 +0200)]
trigger activate-noawait pve-api-updates
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 5 May 2020 17:19:49 +0000 (19:19 +0200)]
bump version to 1.0.2
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 5 May 2020 17:18:58 +0000 (19:18 +0200)]
dns schema: move fields one level deeper
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Tue, 5 May 2020 16:34:33 +0000 (18:34 +0200)]
dns: complete OVH schema
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Dominik Csapak [Tue, 5 May 2020 12:38:12 +0000 (14:38 +0200)]
add note that the data has to be base64 encoded
but only via api, on the cli it is a file which contains
the data in plaintext
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Dominik Csapak [Tue, 5 May 2020 12:38:11 +0000 (14:38 +0200)]
DNSChallenge: make plugins a hash with an optional schema
so that we can use that schema to generate form fields in the gui
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Thomas Lamprecht [Mon, 4 May 2020 12:54:24 +0000 (14:54 +0200)]
plugin id: limit to 'pve-configid' format
Else one can pass almost arbitrary data as ID and break editing or
deletion of a plugin.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 16:06:01 +0000 (18:06 +0200)]
bump version to 1.0.1
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 16:05:29 +0000 (18:05 +0200)]
DNS Challenge: add validation-delay plugin option
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 15:17:39 +0000 (17:17 +0200)]
use smart-relative gitmodule path
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 15:07:44 +0000 (17:07 +0200)]
bump version to 1.0.0
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 15:05:29 +0000 (17:05 +0200)]
use native source format, fix lintian complaints
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 15:00:46 +0000 (17:00 +0200)]
buildsys: move submodule to src, cleanups
it's nicer as the build system is more coherent, i.e., I can do `make
install` from inside src and it actually works ;)
Use an atomic target for the build directory, else we can easily get
bogus builds.
Further use only one type of GNU make variable flavors, not both $()
and ${} mixed..
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 14:49:26 +0000 (16:49 +0200)]
buildsys: sort and cleanup
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sun, 3 May 2020 14:47:41 +0000 (16:47 +0200)]
allow to get full DNS plugins list
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Sat, 2 May 2020 16:48:07 +0000 (18:48 +0200)]
acme: variable name cleanup
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Thomas Lamprecht [Thu, 30 Apr 2020 10:14:41 +0000 (12:14 +0200)]
d/control: add ${perl:Depends} and require pve-common > 6~
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Fabian Grünbichler [Mon, 20 Apr 2020 08:34:23 +0000 (10:34 +0200)]
bump version to 1.0.0-1
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Mon, 20 Apr 2020 08:05:01 +0000 (10:05 +0200)]
d/control: add B+R libpve-common-perl
since we takeover the perl modules
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Mon, 20 Apr 2020 08:00:38 +0000 (10:00 +0200)]
d/control: wrap-and-sort
Fabian Grünbichler [Fri, 17 Apr 2020 13:11:05 +0000 (15:11 +0200)]
proxmox-acme: fix readaccountconf
by switching to bash and echoing the values passed in from the plugin
config.
plugins like the OVH config attempt to detect and handle changed config
by comparing set env variables and values stored in the config, leading
to confusing output otherwise.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Fri, 17 Apr 2020 13:09:34 +0000 (15:09 +0200)]
dns plugin: improve 'data' string encoding/passing
encode the full multi-line string as base64 single-line string on
each config write, and decode at config parse time. pass both the data
key/value pairs and the secret txtvalue via STDIN instead of as command
line arguments.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Fri, 17 Apr 2020 12:42:24 +0000 (14:42 +0200)]
dns plugin: reset environment
in addition to switching to nobody:nogroup, to reduce things exposed to
the dnsapi plugins
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Fri, 17 Apr 2020 12:31:49 +0000 (14:31 +0200)]
plugins: remove get_subplugins
it's unused, and the only plugin that has such functionality already
encodes the possible values as enum in the schema anyway..
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Fri, 17 Apr 2020 12:27:42 +0000 (14:27 +0200)]
plugins: unify extract_challenge
we have a list of supported challenge types per plugin, so we only need
one generic implementation.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Fri, 17 Apr 2020 07:39:50 +0000 (09:39 +0200)]
plugins: refactor setup/teardown signatures
and move handling of tokens/key_auths to plugins, since it's not bound
to be identical for all challenge types forever.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Thu, 16 Apr 2020 18:47:55 +0000 (20:47 +0200)]
dns plugin: use non-usrmerged path for bash
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Thu, 16 Apr 2020 18:45:04 +0000 (20:45 +0200)]
dns plugin: make data optional
it might be hard-coded in a (modified) plugin, or not needed
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Thu, 16 Apr 2020 18:10:32 +0000 (20:10 +0200)]
protocol: request validation with empty body
including the key authorization is deprecated and will be removed at
some point, might as well clean that up now to be prepared.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Fabian Grünbichler [Thu, 16 Apr 2020 18:07:33 +0000 (20:07 +0200)]
config: always define a 'standalone' plugin instance
so that consumers can fallback to it
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Wolfgang Link [Wed, 8 Apr 2020 09:06:10 +0000 (11:06 +0200)]
Implement function to resolve all subplugins
This function helps to retrieve all subplugins
that are supported by the plugins.
This will later be used as an enumeration for entering parameters.
Wolfgang Link [Tue, 31 Mar 2020 06:53:45 +0000 (08:53 +0200)]
Add debug mode
This can be used at setup time to get feedback on the DNS plugin parameters.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Tue, 31 Mar 2020 07:01:06 +0000 (09:01 +0200)]
Add DNSChallenge Plugin
This plugin calls the custom script acme.sh and uses the implementation of the DNS API.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Mon, 6 Apr 2020 06:35:06 +0000 (08:35 +0200)]
Use the caller's data instead of extracting it yourself.
Add the server in the data structure to return it.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Tue, 7 Apr 2020 08:40:02 +0000 (10:40 +0200)]
Create the plugin config.
At the moment, Proxmox has two different configurations that require different properties.
DNSChallange requires credentials for the DNSAPI.
Standalone has no settings because Letsencrypt only supports port 80 with the http-01 challenge.
This configuration is registered in the pve-manager.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Mon, 6 Apr 2020 11:30:23 +0000 (13:30 +0200)]
Refactor extract_callenge for code reuse.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Tue, 31 Mar 2020 06:39:28 +0000 (08:39 +0200)]
Move code from pve-common
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Fri, 3 Apr 2020 11:16:19 +0000 (13:16 +0200)]
Add submodule acme.sh for DNS plugins
Copy the DNS plugins form acme.sh
The project acme.sh can be found here.
https://github.com/Neilpang/acme.sh
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Thu, 2 Apr 2020 12:32:11 +0000 (14:32 +0200)]
Implement feature setup and teardown functionality.
We use these functions to add and remove a txt record via the dnsapi.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Mon, 6 Apr 2020 04:48:38 +0000 (06:48 +0200)]
Add funtion to set DNSAPI variable
acme.sh DNS plugins expect a configuration in which the login information
is stored.
We pass the credentials with the command.
This function supports the expected behavior of the plugins.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Tue, 31 Mar 2020 06:38:50 +0000 (08:38 +0200)]
Remove unnecessary Code and fixes.
This Code is not required in the Proxmox environment.
We know in our environment what we have as a tool-change.
Fix Code what does not work because variable or functions are missing.
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Tue, 31 Mar 2020 06:38:22 +0000 (08:38 +0200)]
Copy the needed function form acme.sh
For the thin wrapper around acme.sh DNS plugins, the required functions are copied.
The project acme.sh can be found here.
https://github.com/Neilpang/acme.sh
Signed-off-by: Wolfgang Link <w.link@proxmox.com>
Wolfgang Link [Thu, 2 Apr 2020 12:29:16 +0000 (14:29 +0200)]
Add Debian Buildsystem config
Signed-off-by: Wolfgang Link <w.link@proxmox.com>