proxmox-backup-manager acme account register behind proxy

[kai.hofmann]

Hi, our Proxmox backup server needs a proxy server to access the wider internet.
We have configured the proxy in the web ui and in /etc/environments. Echo $http(s)_proxy returns the right settings.
Everything (apt, etc.) worked so far.
When we try to register a custom ACME account, however, backupmanager hangs on "Attempting to fetch Terms of Service from..." for a while after providing the directory URI, then throws an "Error: client error (Connect)".
When I run a curl on the same URI, I get a proper response from the CA's server.
The same procedure worked flawlessly with our PVE servers in the same network.
I am not entirely sure about what is going wrong, but it seems that proxmox-backup-manager does not honor the proxy settings for the ACME registration.
Has somebody seen this problem and can give me some advice?

 

[Chris]

Hi,
the ACME client currently does not take the PBS node proxy config into account. This is tracked as issue https://bugzilla.proxmox.com/show_bug.cgi?id=6173

 

[kai.hofmann]

Hello, thank you for the fast reply.
This is a bit unfortunate but at least I can stop searching for a solution for now.
We will try to find a workaround until this issue is solved.
Thanks again and best regards,
Kai

 

[longer]

Hello, thank you for the fast reply.
This is a bit unfortunate but at least I can stop searching for a solution for now.
We will try to find a workaround until this issue is solved.
Thanks again and best regards,
Kai

Have you founded a workaround?

Maybe add it to the service?

systemctl edit proxmox-backup-proxy.service

[Service]
Environment="HTTP_PROXY=http://your-proxy-ip:port"
Environment="HTTPS_PROXY=http://your-proxy-ip:port"
Environment="NO_PROXY=localhost,127.0.0.1"

 

[kai.hofmann]

Hi,
thank you for the hint I tried this just now.
No luck there.
I also had our firewall team add a temporary exception for the server. With this the errormessage changed.
Apparently proxmox-backup-manager also won't work with our CA (harica).
I will try to put the Servers in another subnet without a proxy when they go productive and hope for the best.

Best regards
Kai