dualfroz/proxmox-git-pve-manager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix #5725: pvenode: acme: add options for external account binding

Browse Source 
The credentials for external account binding can only be entered
interactively when registering an ACME account with pvenode, and only
if the CA requires them or a custom directory was selected. So they
cannot be passed when the account is registered from a script, or
when the directory is passed with --directory and the CA does not
announce that it requires them.

Add the --eab-kid and --eab-hmac-key options, which the API endpoint
already supports, and only ask for the credentials if they were not
passed.

Signed-off-by: Michal Fox <me@dualfroz.com>
This commit is contained in:
dualfroz committed 2026-10-03 01:15:47 +02:00
1 parent d0798f384d
commit 723bba9164
1 file changed
+28 -14
Download Patch File Download Diff File Expand all files Collapse all files
PVE/CLI/pvenode.pm
+28 -14
View File
@@ -89,6 +89,18 @@ __PACKAGE__->register_method({
directory => get_standard_option('pve-acme-directory-url', {
optional => 1,
}),
'eab-kid' => {
description => 'Key Identifier for External Account Binding.',
type => 'string',
requires => 'eab-hmac-key',
optional => 1,
},
'eab-hmac-key' => {
description => 'HMAC key for External Account Binding.',
type => 'string',
requires => 'eab-kid',
optional => 1,
},
},
},
returns => { type => 'null' },
@@ -144,21 +156,23 @@ __PACKAGE__->register_method({
print "No Terms of Service found, proceeding.\n";
}
my $eab_enabled = $meta->{externalAccountRequired};
if (!$eab_enabled && $custom_directory) {
my $agreed =
PVE::PTY::read_line('Do you want to use external account binding? [y|N]: ');
$eab_enabled = ($agreed =~ /^y$/i);
} elsif ($eab_enabled) {
print "The CA requires external account binding.\n";
}
if ($eab_enabled) {
print "You should have received a key id and a key from your CA.\n";
my $eab_kid = PVE::PTY::read_line('Enter EAB key id: ');
my $eab_hmac_key = PVE::PTY::read_line('Enter EAB key: ');
if (!defined($param->{'eab-kid'})) {
my $eab_enabled = $meta->{externalAccountRequired};
if (!$eab_enabled && $custom_directory) {
my $agreed =
PVE::PTY::read_line('Do you want to use external account binding? [y|N]: ');
$eab_enabled = ($agreed =~ /^y$/i);
} elsif ($eab_enabled) {
print "The CA requires external account binding.\n";
}
if ($eab_enabled) {
print "You should have received a key id and a key from your CA.\n";
my $eab_kid = PVE::PTY::read_line('Enter EAB key id: ');
my $eab_hmac_key = PVE::PTY::read_line('Enter EAB key: ');
$param->{'eab-kid'} = $eab_kid;
$param->{'eab-hmac-key'} = $eab_hmac_key;
$param->{'eab-kid'} = $eab_kid;
$param->{'eab-hmac-key'} = $eab_hmac_key;
}
}
print "\nAttempting to register account with '$param->{directory}'..\n";