fix #5725: pvenode: acme: add options for external account binding

The credentials for external account binding can only be entered
interactively when registering an ACME account with pvenode, and only
if the CA requires them or a custom directory was selected. So they
cannot be passed when the account is registered from a script, or
when the directory is passed with --directory and the CA does not
announce that it requires them.

Add the --eab-kid and --eab-hmac-key options, which the API endpoint
already supports, and only ask for the credentials if they were not
passed.

Signed-off-by: Michal Fox <me@dualfroz.com>

PVE/CLI/pvenode.pm

@@ -89,6 +89,18 @@ __PACKAGE__->register_method({
             directory => get_standard_option('pve-acme-directory-url', {
                     optional => 1,
             }),
+            'eab-kid' => {
+                description => 'Key Identifier for External Account Binding.',
+                type => 'string',
+                requires => 'eab-hmac-key',
+                optional => 1,
+            },
+            'eab-hmac-key' => {
+                description => 'HMAC key for External Account Binding.',
+                type => 'string',
+                requires => 'eab-kid',
+                optional => 1,
+            },
         },
     },
     returns => { type => 'null' },
@@ -144,6 +156,7 @@ __PACKAGE__->register_method({
             print "No Terms of Service found, proceeding.\n";
         }
 
+        if (!defined($param->{'eab-kid'})) {
             my $eab_enabled = $meta->{externalAccountRequired};
             if (!$eab_enabled && $custom_directory) {
                 my $agreed =
@@ -160,6 +173,7 @@ __PACKAGE__->register_method({
                 $param->{'eab-kid'} = $eab_kid;
                 $param->{'eab-hmac-key'} = $eab_hmac_key;
             }
+        }
 
         print "\nAttempting to register account with '$param->{directory}'..\n";