New Add-On for step-ca: step-admin by heinemannj · Pull Request #1736 · community-scripts/ProxmoxVED

heinemannj · 2026-04-23T14:45:31Z

Scripts which are clearly AI generated and not further revised by the Author of this PR (in terms of Coding Standards and Script Layout) may be closed without review.

✍️ Description

New Add-On for step-ca
https://community-scripts.org/scripts?q=step-ca

The Add-On can be used on any LXC (including the step-ca LXC) for CA and Certificate Maintenance.

Will replacing the step-ca-admin.sh on the step-ca LXC to simplyfy the installation script (upcoming separate PR).

🔗 Related PR / Issue

Link: #
community-scripts/ProxmoxVE#11504

✅ Prerequisites (X in brackets)

Self-review completed – Code follows project standards.
Tested thoroughly – Changes work as expected.
No breaking changes – Existing functionality remains intact.
No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

🛠️ Type of Change (X in brackets)

🐞 Bug fix – Resolves an issue without breaking functionality.
✨ New feature – Adds new, non-breaking functionality.
💥 Breaking change – Alters existing functionality in a way that may require updates.
🆕 New script – A fully functional and tested script or script set.
🌍 Website update – Changes to website-related JSON files or metadata.
🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

🔍 Code & Security Review (X in brackets)

Follows Code_Audit.md & CONTRIBUTING.md guidelines
Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
No hardcoded credentials

📋 Additional Information (optional)

Environment Variables introduced to support further automation:

# ==============================================================================
# USAGE
# Run with --help to output the script usage
# ==============================================================================
function print_usage() {
  cat <<EOF
Usage: $(basename "$0") [OPTIONS]

Maintain certificate(s) issued by a Step certificate authority.

Options:
  --help              Show this help message
  --export-config     Export current Configuration as JSON

Environment Variables:

  VERBOSE             Run in verbose mode (yes/no); no for silent script execution
  var_unattended      Run without user interaction (yes/no)
  var_action          Skip initial dialog and directly perform an maintenance option (install/update/uninstall/maintain/export-config)
  var_cert_type       Skip dialog and directly maintain selected certificate type (x509/ssh/ca)
  var_x509_action     Skip dialog and directly perform an maintenance option for x509 certificates (bootstrap/request/renew/revoke/inspect/list/crl)

Examples:
  # Run interactively
  $(basename "$0")

  # Install unattended
  var_unattended=yes var_action=install $(basename "$0")

  # Update unattended
  var_unattended=yes var_action=update $(basename "$0")

  # Renew system certificate unattended
  var_unattended=yes var_x509_action=renew $(basename "$0")

  # Export current Configuration
  $(basename "$0") --export-config
EOF
}

📦 Application Requirements (for new scripts)

Required for 🆕 New script submissions.
Pull requests that do not meet these requirements may be closed without review.

The application is at least 6 months old
The application is actively maintained
The application has 600+ GitHub stars
Official release tarballs are published
I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

🌐 Source

Source: https://smallstep.com/ | Github: https://github.com/smallstep

Changed sources for testing

Typo in sources

Typo

CrazyWolf13 · 2026-04-23T17:11:00Z

+function detect_os() {
+  if grep -qi "alpine" /etc/os-release; then
+    #OS="Alpine"
+    PKG_UPDATE=""
+    PKG_INSTALL="apk add --no-cache"
+    PKG_UPGRADE="apk update"
+    PKG_UNINSTALL="apk del"
+    PKG_AUTOREMOVE=""
+  elif grep -qi "arch" /etc/os-release; then
+    #OS="Arch"
+    PKG_UPDATE=""
+    PKG_INSTALL="pacman -S"
+    PKG_UPGRADE="pacman -Syu"
+    PKG_UNINSTALL="pacman -Rs"
+    PKG_AUTOREMOVE=""
+  elif grep -qi "debian" /etc/os-release; then
+    #OS="Debian"
+    PKG_UPDATE="apt update"
+    PKG_INSTALL="apt -y install"
+    PKG_UPGRADE="apt -y upgrade"
+    PKG_UNINSTALL="apt -y --purge remove"
+    PKG_AUTOREMOVE="apt -y --purge autoremove"
+    if ! [[ -f /etc/apt/sources.list.d/smallstep.sources ]]; then
+      setup_deb822_repo \
+        "smallstep" \
+        "https://packages.smallstep.com/keys/apt/repo-signing-key.gpg" \
+        "https://packages.smallstep.com/stable/debian" \
+        "debs" \
+        "main"
+    fi
+  elif grep -qi "ubuntu" /etc/os-release; then
+    #OS="Ubuntu"
+    PKG_UPDATE="apt update"
+    PKG_INSTALL="apt -y install"
+    PKG_UPGRADE="apt -y upgrade"
+    PKG_UNINSTALL="apt -y --purge remove"
+    PKG_AUTOREMOVE="apt -y --purge autoremove"
+    if ! [[ -f /etc/apt/sources.list.d/smallstep.sources ]]; then
+      setup_deb822_repo \
+        "smallstep" \
+        "https://packages.smallstep.com/keys/apt/repo-signing-key.gpg" \
+        "https://packages.smallstep.com/stable/debian" \
+        "debs" \
+        "main"
+    fi
+  else
+    die "Unsupported OS. Exiting."
+  fi
+}
+
+# ==============================================================================
+# HELPER FUNCTIONS
+# ==============================================================================
+function resolve_ip() {
+  local FQDN=$1
+  local IP
+  IP=$(dig +short "$FQDN")
+ [[ -z "$IP" ]] && exit 1 || echo "$IP"
+}


this should not be part of this PR.

there is another PR open for this, and we'd rather like those changes be incorporated into our existing funcs, if even needed.

You are partly wrong - I've opened a PR for pve-lxc-system-admin.sh
#1627

During the initial discussion on this PR I have only asked for a suitable possibility to add some new supporting functions ...

For the moment the refactoring of the step-ca LXC is much more important (separate PR is coming quickly) and for that reason this step-admin Add-On will be handled by me with priority.

If needed I can make separate PRs for the supporting functions, but for the moment from my perspection nothing is opened beside parts of this PR...

How to proceed???

we won't just add new core things for a single script, and we will also not create even more scripts like admin-core.sh.

also those changes make not that much sense, as some of that code already exists in our functions and would be doubled code.

Yes seperate Pr for supporting funcs would be appreciated, but this would come with integrating them into our existing core and possible also directly applying to other scripts that may benefit from the new helper function

detect_os function:

Copy&Paste from one of existing addon and define a funtion for better readability - I've seen this code fragments under the heading OS Detection) in most of actual existing Add-Ons under MAIN ...

If a core function for detect OS is already available please let me know

whitail is widely used in your framework - but every usage of whiptail is handmade ...

If whiptail functions are already available please let me know - I've found nothing

resolve_ip function:

peanuts - I can simply move back into the add-on

the whiptail is definitely something we have already talked about, but ultimately not yet tackled as basically every whiptail is a lot different.

So I think it would be nice if you could contribute the whiptail function as seperate PR.
Same for detect_os, but I think that can be incorporated into out core, as there are possibly already parts of that in core.

@MickLesk please correct me if I'm wrong. You know best about core.

@CrazyWolf13 and @MickLesk :

PR for whiptail helper-scripts: whiptail helper functions for dialog boxes #1760

moved back to the step-admin add-on until above PR is validated

detect_os function - giving up - moved back to the step-admin add-on

resolve_ip function - giving up - moved back to the step-admin add-on

CrazyWolf13 · 2026-04-23T17:12:20Z

+# ==============================================================================
+# Enable error handling
+#
+# set -E (enable errtrace option)
+# set -e (enable errexit option)
+# set -u (enable nounset option)
+# set -o pipefail
+# ==============================================================================
+set -Eeuo pipefail
+#trap 'error_handler' ERR
+
+shopt -s expand_aliases
+alias die='EXIT=$? LINE=$LINENO error_exit'
+trap die ERR
+
+function error_exit() {
+  trap - ERR
+  local reason="Unknown failure occured!"
+  local msg="${1:-$reason}"
+  msg_error "ERROR $EXIT at line $LINE: ${YW}$msg${CL}" 1>&2
+  exit "$EXIT"
+}


take a look at other addons especially the "-exporter ones

take a look at other addons especially the "-exporter ones

From tools/addon/qbittorrent-exporter.sh

# Enable error handling set -Eeuo pipefail trap 'error_handler' ERR load_functions

from tools/addon/all-templates.sh which is very closely to my solution (initial copy&paste from this one ...)

set -eEuo pipefail shopt -s expand_aliases alias die='EXIT=$? LINE=$LINENO error_exit' trap die ERR function error_exit() { trap - ERR local DEFAULT='Unknown failure occured.' local REASON="\e[97m${1:-$DEFAULT}\e[39m" local FLAG="\e[91m[ERROR] \e[93m$EXIT@$LINE" msg "$FLAG $REASON" 1>&2 [ ! -z ${CTID-} ] && cleanup_ctid exit $EXIT }

I really need a simple die function with custom error messages:
$STD update-ca-certificates || die "Update of System CA Certificates failed!"

ah my bad, that code was added later on.

Can't you use msg_warn "Update of System CA Certificates failed!" ?

Intension of the die function:

terminate (exit) with exit number

with custom error message and

additional trap information

The initial code fragment I've copy&paste was coming from our famous tteck (tteckster)

@MickLesk has written the msg_warn func as far as I know.

See https://github.com/community-scripts/ProxmoxVE/blob/main/misc/core.func:

a) By using your core functions I'm a little bit lost - error exit is NOT working:

#!/usr/bin/env bash source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/core.func) source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/tools.func) source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/error_handler.func) # Enable error handling # set -Eeuo pipefail trap 'error_handler' ERR # Initialize all core functions (colors, formatting, icons, STD mode) # load_functions # Main # msg_info "Start Main\n" ls -lisa not_available.tmp || msg_error "expected exit with exit code" msg_ok "Should never be reached"

Output - Not expected:
⠋ Start Main
ls: cannot access 'not_available.tmp': No such file or directory
✖️ expected exit with exit code
✔️ Should never be reached

b) The usage of tteck (tteckster) die function is working as expected:

#!/usr/bin/env bash source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/core.func) source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/tools.func) source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/error_handler.func) # Enable error handling # set -Eeuo pipefail #trap 'error_handler' ERR shopt -s expand_aliases alias die='EXIT=$? LINE=$LINENO error_exit' trap die ERR function error_exit() { trap - ERR local reason="Unknown failure occured!" local msg="${1:-$reason}" msg_error "ERROR $EXIT at line $LINE: ${YW}$msg${CL}" 1>&2 exit "$EXIT" } # Initialize all core functions (colors, formatting, icons, STD mode) # load_functions # Main # msg_info "Start Main\n" ls -lisa not_available.tmp || die "expected exit with exit code" msg_ok "Should never be reached"

Output - Works as designed:
⠋ Start Main
ls: cannot access 'not_available.tmp': No such file or directory
✖️ ERROR 2 at line 31: expected exit with exit code

c) How to use your core functions properly?

Tteck is passed 1.5 year ago. We have other functions. Why shouldn’t it work? 580 other scripts work perfectly well with the core and the error_handler.

Incidentally, AllTemplates is the worst example you could possibly use; it’s hopelessly outdated, relies on the old architecture and has never been updated. Why? Because nobody uses it.

Why shouldn’t it work?

Jung: Das war genau meine Frage!
Was wäre denn jetzt die Perfekte Lösung?

A simple code template would be appreciated ...

Removed outdated source calls and added whiptail, detect_os and resolve_IP helper functions back to the add-on.

Removed commented-out header function and its content.

github-actions · 2026-05-19T02:39:22Z

@heinemannj Closing stale PR due to inactivity (no commits for 7 days after stale label).

heinemannj added 4 commits April 23, 2026 16:10

Initial commit of step-admin

d3a1875

Update step-admin.sh

5c383c8

Changed sources for testing

Update step-admin.sh

944bf91

Typo in sources

Update whiptail.func

3bbac8f

Typo

heinemannj requested a review from a team as a code owner April 23, 2026 14:45

github-actions Bot added breaking change maintenance new script core labels Apr 23, 2026

CrazyWolf13 requested changes Apr 23, 2026

View reviewed changes

This was referenced Apr 27, 2026

Step ca update community-scripts/ProxmoxVE#14058

Merged

whiptail helper functions for dialog boxes #1760

Closed

heinemannj added 7 commits April 27, 2026 16:56

Refactor step-admin.sh to include whiptail functions

017b3e5

Removed outdated source calls and added whiptail, detect_os and resolve_IP helper functions back to the add-on.

Delete misc/admin-core.func misc/whiptail.func

7ddc172

Delete misc/whiptail.func

50d6745

Add step-admin header file

6d03f59

Use header_info function from sources

c6df615

Update step-admin.sh

98e28c4

Remove header_info function and comments

0d7a93e

Removed commented-out header function and its content.

heinemannj requested a review from CrazyWolf13 April 27, 2026 17:31

CrazyWolf13 requested a review from MickLesk April 27, 2026 18:06

github-actions Bot added the stale label May 12, 2026

github-actions Bot closed this May 19, 2026

Uh oh!

Uh oh!

Conversation

heinemannj commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scripts which are clearly AI generated and not further revised by the Author of this PR (in terms of Coding Standards and Script Layout) may be closed without review.

✍️ Description

🔗 Related PR / Issue

✅ Prerequisites (X in brackets)

🛠️ Type of Change (X in brackets)

🔍 Code & Security Review (X in brackets)

📋 Additional Information (optional)

📦 Application Requirements (for new scripts)

🌐 Source

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

heinemannj Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

heinemannj Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

heinemannj commented Apr 23, 2026 •

edited

Loading

heinemannj Apr 23, 2026 •

edited

Loading

heinemannj Apr 24, 2026 •

edited

Loading