# OPNsense os-acme-client -> RustProxy

A simple mechanism for automatically sending a certificate generated by `os-acme-client` on OPNsense to RustProxy via API.

## Files

- `opnsense-rustproxy-cert-deploy.sh` - sends the certificate and private key to RustProxy.
- `rustproxy-acme.conf` - connection settings, API token, and certificate file paths.
- `actions_rustproxy_cert.conf` - optional `configd` action that allows the script to be executed from Cron in OPNsense.

## 1. Installation

```sh
cp opnsense-rustproxy-cert-deploy.sh /usr/local/sbin/
chmod 750 /usr/local/sbin/opnsense-rustproxy-cert-deploy.sh

cp rustproxy-acme.conf.example /usr/local/etc/rustproxy-acme.conf
chmod 600 /usr/local/etc/rustproxy-acme.conf
```

## 2. Configuration

Edit:

```sh
vi /usr/local/etc/rustproxy-acme.conf
```

Important parameters:

```sh
RUSTPROXY_URL='https://127.0.0.1:9090'
RUSTPROXY_KEY_ID='opnsense-acme'
RUSTPROXY_TOKEN='RUSTPROXY_TOKEN'

CERTIFICATE_ID='shared-cert'

CERT_FILE='/var/etc/acme-client/certs/CERT_UUID/fullchain.pem'
KEY_FILE='/var/etc/acme-client/keys/CERT_UUID/private.key'
```

If `os-acme-client` exports the certificate to a custom directory, simply set the correct paths:

```sh
CERT_FILE='/path/to/fullchain.pem'
KEY_FILE='/path/to/private.key'
```

`CERTIFICATE_ID` is the stable external certificate id. If it does not exist, RustProxy creates a manual certificate entry. If it already exists as a manual certificate, RustProxy rotates it in place. RustProxy-managed ACME ids are rejected to prevent two renewal owners for one lineage.

## 3. RustProxy API

Create a certificate API key in RustProxy and enter its values in the configuration:

```text
RUSTPROXY_KEY_ID
RUSTPROXY_TOKEN
```

The script sends the certificate to:

```text
POST /api/certificates/deploy
```

The connection from OPNsense to RustProxy should use HTTPS.

## 4. Test

Run the certificate reconciliation:

```sh
/usr/local/sbin/opnsense-rustproxy-cert-deploy.sh
```

On success, you should see a message similar to:

```text
RustProxy certificate reconcile succeeded (HTTP 200, id=shared-cert)
```

## 5. OPNsense Automation

Optionally install the `configd` action:

```sh
cp actions_rustproxy_cert.conf /usr/local/opnsense/service/conf/actions.d/
service configd restart
```

Then go to **System -> Settings -> Cron** and add a scheduled execution of the `Deploy ACME certificate to RustProxy` action.

The script deliberately reconciles on every run instead of trusting a local cache. The server is the source of truth: an identical RustProxy-owned certificate generation is a no-op, a missing id is created, and changed material is rotated atomically. This also repairs drift when a certificate entry or generation was removed outside OPNsense.

## Additional Options

If RustProxy uses a private CA:

```sh
RUSTPROXY_CACERT='/usr/local/etc/ssl/rustproxy-ca.pem'
```

If you want to connect to a specific LAN address while keeping proper TLS hostname verification:

```sh
RUSTPROXY_RESOLVE='rustproxy.lan:8443:192.168.1.20'
```