Merge pull request #5719 from daemonhorn/fix/acme-client-false-validation-failed-on-skip
security/acme-client: fix false "validation failed" status on skipped renewal
security/acme-client: add JetKVM automation via acme.sh deploy hook (#5726)
Adds "Upload certificate to JetKVM (SSH)" (acme_jetkvm), a thin wrapper
around the acme.sh "jetkvm" deploy hook (acmesh-official/acme.sh#7254),
following the exact pattern already used by AcmeFritzbox/AcmePanos/
AcmeZyxelGs1900/etc.: set a few DEPLOY_JETKVM_* env vars from the
automation's config and let LeAutomation\Base::runAcme() invoke
`acme.sh --deploy --deploy-hook jetkvm`.
This is the "much smaller follow-up PR" requested by the maintainer on
opnsense/plugins#5621 in place of that PR's full custom PHP
implementation (own SSH exec session, own atomic-write logic, its own
API controller/configd actions) -- all of that now lives once in the
acme.sh hook instead of being duplicated here.
Exposes only what a user needs to fill in: host, username (default
root), port (default 22), and a "Reboot After Upload" checkbox (default
checked) that maps to the hook's DEPLOY_JETKVM_RESTART_CMD ("reboot" or
"none") -- narrower than the hook's own free-text restart command, kept
[62 lines not shown]
www/caddy: Emit access log plain to socket and filesystem at the same time when LogAccessPlain is enabled.
LogAccessPlain is mostly used by crowdsec and splitted the access log out into separate files in /var/log/caddy/access,
but for debugging having it in both log streams is better, which is possible now.
www/caddy: fix syslog integration (#5870)
Logs pass through syslog-ng twice.
- On the first pass, they are assigend a program name (caddy) and a severity, then sent to /var/run/log in syslog format. This uses syslog-ng as a normalizer for the non-syslog logs.
- On the second pass they go through s_all and into OPNsense's default handling logic
It's not ideal to process the logs two times, but there aren't too many alternatives for the given constraints.
security/acme-client: add 2FA support for 1984Hosting DNS API
1984Hosting now requires two-factor authentication on all accounts,
so logins with only a username and password fail and certificate
renewals stop working.
acme.sh has supported this since 3.1.4 through One984HOSTING_TOTP_Secret,
which it uses with oathtool to generate a one-time code at each login.
Add a TOTP Secret field and pass it on, following the existing INWX
Shared Secret handling: oath-toolkit stays an optional, manually
installed package, and validation fails with a clear error if the
secret is set but the package is missing.
net/freeradius: restore Eap model import in API controller (#5861)
Restore the import removed in 7f3cbdc448ce to fix model
resolution in the EAP API GET and POST actions.
security/acme-client: switch Selfhost DNS API to API key, closes #5825
Selfhost.de replaces its username/password based DNS API with a new
token based API. acme.sh 3.1.6 already supports it (acmesh-official/acme.sh#7307)
and no longer accepts SELFHOSTDNS_USERNAME/SELFHOSTDNS_PASSWORD.
Replace the user/password fields with an API key field that is passed
to acme.sh as SELFHOSTDNS_APIKEY. The RID mapping (SELFHOSTDNS_MAP) is
unchanged. Existing users need to enter the new API key.
Co-Authored-By: Claude Opus 5.5 <noreply at anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sf3iE5vLr8TGXKX91ZPDHz
net/freeradius: restore EAP-TTLS-GTC support and fix EAP-GTC against directories that do not expose passwords (#2421) (#5692)
* net/freeradius: make the EAP method inside the EAP-TTLS tunnel configurable (#2421)
The inner EAP method was hardcoded to md5, so EAP-TTLS-GTC could not be
used. Support was added in 1.9.9 as a "ttls-gtc" value of the outer
default_eap_type, which radiusd rejected with "No dictionary definition
for default EAP method 'ttls-gtc'"; 1.9.20 removed the option again and
left the template branch testing for it unreachable.
Add a separate default_eap_ttls_type field holding a real EAP method and
use it inside the ttls block, replacing the dead branch. Non-EAP inner
methods such as PAP are handled by the inner-tunnel virtual server and
are deliberately absent from the option list, as radiusd fails to start
on a non-EAP value. The field defaults to md5, keeping existing
configurations unchanged, and is hidden unless TTLS is the outer type.
* net/freeradius: fix EAP-GTC failing when the LDAP directory does not expose passwords
[10 lines not shown]
