From 723bba91649716bddb77c243fcafc7c6a9f4043e Mon Sep 17 00:00:00 2001
From: Michal Fox <me@dualfroz.com>
Date: Sat, 3 Oct 2026 01:15:47 +0200
Subject: [PATCH] fix #5725: pvenode: acme: add options for external account
 binding

The credentials for external account binding can only be entered
interactively when registering an ACME account with pvenode, and only
if the CA requires them or a custom directory was selected. So they
cannot be passed when the account is registered from a script, or
when the directory is passed with --directory and the CA does not
announce that it requires them.

Add the --eab-kid and --eab-hmac-key options, which the API endpoint
already supports, and only ask for the credentials if they were not
passed.

Signed-off-by: Michal Fox <me@dualfroz.com>
---
 PVE/CLI/pvenode.pm | 42 ++++++++++++++++++++++++++++--------------
 1 file changed, 28 insertions(+), 14 deletions(-)

diff --git a/PVE/CLI/pvenode.pm b/PVE/CLI/pvenode.pm
index 7f71764..2533a41 100644
--- a/PVE/CLI/pvenode.pm
+++ b/PVE/CLI/pvenode.pm
@@ -89,6 +89,18 @@ __PACKAGE__->register_method({
             directory => get_standard_option('pve-acme-directory-url', {
                     optional => 1,
             }),
+            'eab-kid' => {
+                description => 'Key Identifier for External Account Binding.',
+                type => 'string',
+                requires => 'eab-hmac-key',
+                optional => 1,
+            },
+            'eab-hmac-key' => {
+                description => 'HMAC key for External Account Binding.',
+                type => 'string',
+                requires => 'eab-kid',
+                optional => 1,
+            },
         },
     },
     returns => { type => 'null' },
@@ -144,21 +156,23 @@ __PACKAGE__->register_method({
             print "No Terms of Service found, proceeding.\n";
         }
 
-        my $eab_enabled = $meta->{externalAccountRequired};
-        if (!$eab_enabled && $custom_directory) {
-            my $agreed =
-                PVE::PTY::read_line('Do you want to use external account binding? [y|N]: ');
-            $eab_enabled = ($agreed =~ /^y$/i);
-        } elsif ($eab_enabled) {
-            print "The CA requires external account binding.\n";
-        }
-        if ($eab_enabled) {
-            print "You should have received a key id and a key from your CA.\n";
-            my $eab_kid = PVE::PTY::read_line('Enter EAB key id: ');
-            my $eab_hmac_key = PVE::PTY::read_line('Enter EAB key: ');
+        if (!defined($param->{'eab-kid'})) {
+            my $eab_enabled = $meta->{externalAccountRequired};
+            if (!$eab_enabled && $custom_directory) {
+                my $agreed =
+                    PVE::PTY::read_line('Do you want to use external account binding? [y|N]: ');
+                $eab_enabled = ($agreed =~ /^y$/i);
+            } elsif ($eab_enabled) {
+                print "The CA requires external account binding.\n";
+            }
+            if ($eab_enabled) {
+                print "You should have received a key id and a key from your CA.\n";
+                my $eab_kid = PVE::PTY::read_line('Enter EAB key id: ');
+                my $eab_hmac_key = PVE::PTY::read_line('Enter EAB key: ');
 
-            $param->{'eab-kid'} = $eab_kid;
-            $param->{'eab-hmac-key'} = $eab_hmac_key;
+                $param->{'eab-kid'} = $eab_kid;
+                $param->{'eab-hmac-key'} = $eab_hmac_key;
+            }
         }
 
         print "\nAttempting to register account with '$param->{directory}'..\n";