46 lines
1.7 KiB
Go
46 lines
1.7 KiB
Go
package osupdate
|
||
|
||
// The root step that keeps a readable copy of Proxmox's root CA for the agent (R-1380, D80, felhom.eu `03` §12a).
|
||
// The rule lives in the wrapper (mode pve-ca-copy: one fixed source, one fixed place, a CA certificate only); the plan
|
||
// names nothing. internal/pvetrust decides when to ask and what to do with the answer.
|
||
|
||
import (
|
||
"context"
|
||
"encoding/json"
|
||
"fmt"
|
||
)
|
||
|
||
// PVECACopyPath is where the wrapper puts the copy (felhom-os-apply PVE_CA_COPY) — the agent's `proxmox.tls.ca_file`.
|
||
const PVECACopyPath = "/etc/felhom-agent/pve-root-ca.pem"
|
||
|
||
// PVECACopyResult is the wrapper's pve_ca_copy object.
|
||
type PVECACopyResult struct {
|
||
Outcome string `json:"outcome"` // written | same
|
||
Path string `json:"path"`
|
||
SHA256 string `json:"sha256"`
|
||
NotAfter string `json:"not_after"`
|
||
DaysLeft int `json:"days_left"`
|
||
Replaced bool `json:"replaced"`
|
||
}
|
||
|
||
// PVECACopy asks the wrapper to make or refresh the copy. An error names a refusal (T1–T3, or R11 from a wrapper that
|
||
// does not know the mode yet) or a wrapper that gave no answer.
|
||
func (l *Leg) PVECACopy(ctx context.Context) (PVECACopyResult, error) {
|
||
wr, err := l.call(ctx, "pveca"+l.now().UTC().Format("150405"), map[string]any{"release_id": "pve-ca-copy",
|
||
"layer": LayerHost, "mode": "pve-ca-copy"})
|
||
if err != nil {
|
||
return PVECACopyResult{}, err
|
||
}
|
||
if wr.refused() {
|
||
return PVECACopyResult{}, fmt.Errorf("pve-ca-copy refused: %s", wr.Refused)
|
||
}
|
||
if wr.failed() {
|
||
return PVECACopyResult{}, fmt.Errorf("pve-ca-copy failed: %s", wr.Failed)
|
||
}
|
||
var res PVECACopyResult
|
||
if jerr := json.Unmarshal(wr.PVECACopy, &res); jerr != nil || res.Outcome == "" || res.Path == "" {
|
||
return PVECACopyResult{}, fmt.Errorf("pve-ca-copy: the wrapper gave no result (%v)", jerr)
|
||
}
|
||
return res, nil
|
||
}
|