v0.36.1

integrations/opnsense-acme/README.md

@@ -5,7 +5,7 @@ A simple mechanism for automatically sending a certificate generated by `os-acme
 ## Files
 
 - `opnsense-rustproxy-cert-deploy.sh` - sends the certificate and private key to RustProxy.
-- `rustproxy-acme.conf` - connection settings, API token, and certificate file paths.
+- `rustproxy-acme.conf.example` - example connection settings, API token, and certificate file paths.
 - `actions_rustproxy_cert.conf` - optional `configd` action that allows the script to be executed from Cron in OPNsense.
 
 ## 1. Installation
@@ -50,13 +50,15 @@ KEY_FILE='/path/to/private.key'
 
 ## 3. RustProxy API
 
-Create a certificate API key in RustProxy and enter its values in the configuration:
+Create a certificate API key in **Settings -> Certificate API** and enter its values in the configuration:
 
 ```text
 RUSTPROXY_KEY_ID
 RUSTPROXY_TOKEN
 ```
 
+The credential must explicitly allow `CERTIFICATE_ID` and **Also allow deploy** (`allow_deploy`) must be enabled. A reload-only credential will be rejected with HTTP 403.
+
 The script sends the certificate to:
 
 ```text
@@ -88,7 +90,7 @@ cp actions_rustproxy_cert.conf /usr/local/opnsense/service/conf/actions.d/
 service configd restart
 ```
 
-Then go to **System -> Settings -> Cron** and add a scheduled execution of the `Deploy ACME certificate to RustProxy` action.
+Verify the action first with `configctl rustproxy_cert deploy`. Then go to **System -> Settings -> Cron** and add a scheduled execution of the `Deploy ACME certificate to RustProxy` action.
 
 The script deliberately reconciles on every run instead of trusting a local cache. The server is the source of truth: an identical RustProxy-owned certificate generation is a no-op, a missing id is created, and changed material is rotated atomically. This also repairs drift when a certificate entry or generation was removed outside OPNsense.
 

integrations/opnsense-acme/actions_rustproxy_cert.conf

@@ -0,0 +1,6 @@
+[deploy]
+command:/usr/local/sbin/opnsense-rustproxy-cert-deploy.sh
+parameters:
+type:script_output
+message:deploy ACME certificate to RustProxy
+description:Deploy ACME certificate to RustProxy

integrations/opnsense-acme/rustproxy-acme.conf.example

@@ -0,0 +1,21 @@
+# RustProxy administration endpoint reachable from OPNsense.
+RUSTPROXY_URL='https://rustproxy.example.lan:9090'
+
+# Certificate API credential created in RustProxy Settings -> Certificate API.
+# The credential must allow this CERTIFICATE_ID and have deploy permission enabled.
+RUSTPROXY_KEY_ID='opnsense-acme'
+RUSTPROXY_TOKEN='REPLACE_WITH_CERTIFICATE_API_TOKEN'
+
+# Stable RustProxy certificate id to create/update.
+CERTIFICATE_ID='shared-cert'
+
+# os-acme-client certificate material. Replace CERT_UUID with the actual UUID.
+CERT_FILE='/var/etc/acme-client/certs/CERT_UUID/fullchain.pem'
+KEY_FILE='/var/etc/acme-client/keys/CERT_UUID/private.key'
+
+# Optional: trust a private CA used by the RustProxy administration listener.
+# RUSTPROXY_CACERT='/usr/local/etc/ssl/rustproxy-ca.pem'
+
+# Optional: connect to a fixed address while keeping TLS verification for the URL hostname.
+# Format: hostname:port:address
+# RUSTPROXY_RESOLVE='rustproxy.example.lan:9090:192.0.2.20'

integrations/routeros-oci-build/README.md

@@ -77,10 +77,10 @@ ENV_FILE=integrations/routeros-oci-build/.env \
   bash integrations/routeros-oci-build/build-routeros-oci.sh push
 ```
 
-For example, with RustProxy version `0.36.0` and the defaults this publishes:
+For example, with RustProxy version `0.36.1` and the defaults this publishes:
 
 ```text
-zot.example.net/network/rustproxy:0.36.0
+zot.example.net/network/rustproxy:0.36.1
 zot.example.net/network/rustproxy:latest
 zot.example.net/network/rustproxy:routeros
 ```