diff --git a/.gitignore b/.gitignore
index 41c15f8..f81b658 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,7 @@ __pycache__
# Build artifacts
dist/
build/
+!build/assets/
*.egg-info/
/tests_e2e/static/conf/config.yml
diff --git a/.run/pytest in tests.run.xml b/.run/pytest in tests.run.xml
index 9b5784c..c72dc30 100644
--- a/.run/pytest in tests.run.xml
+++ b/.run/pytest in tests.run.xml
@@ -5,16 +5,17 @@
-
+
+
-
+
diff --git a/build/Dockerfile b/build/Dockerfile
index d091659..55d225a 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -10,8 +10,17 @@ RUN apk add --no-cache haproxy bash python3 certbot openssl curl \
&& curl -LsSf https://astral.sh/uv/install.sh | sh \
&& ln -s /root/.local/bin/uv /usr/local/bin/uv
-RUN openssl dhparam -out /etc/haproxy/dhparam 2048 \
- && openssl dhparam -out /etc/haproxy/dhparam-1024 1024
+RUN mkdir -p /etc/easyhaproxy/haproxy \
+ && openssl dhparam -out /etc/easyhaproxy/haproxy/dhparam 2048 \
+ && openssl dhparam -out /etc/easyhaproxy/haproxy/dhparam-1024 1024 \
+ && mkdir -p /etc/easyhaproxy/certs/certbot /etc/easyhaproxy/certs/haproxy \
+ && openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
+ -keyout /tmp/placeholder.key \
+ -out /tmp/placeholder.crt \
+ -subj "/CN=placeholder" \
+ && cat /tmp/placeholder.crt /tmp/placeholder.key > /etc/easyhaproxy/certs/certbot/placeholder.pem \
+ && cat /tmp/placeholder.crt /tmp/placeholder.key > /etc/easyhaproxy/certs/haproxy/placeholder.pem \
+ && rm /tmp/placeholder.key /tmp/placeholder.crt
WORKDIR /scripts
diff --git a/build/assets/etc/easyhaproxy/haproxy/conf.d/README.md b/build/assets/etc/easyhaproxy/haproxy/conf.d/README.md
new file mode 100644
index 0000000..c8f8f33
--- /dev/null
+++ b/build/assets/etc/easyhaproxy/haproxy/conf.d/README.md
@@ -0,0 +1,5 @@
+# Custom HAProxy Configuration
+
+Put `.cfg` files here to be included in the HAProxy configuration.
+
+These files will be available at `/etc/easyhaproxy/haproxy/conf.d/` inside the container.
\ No newline at end of file
diff --git a/build/assets/etc/haproxy/errors-custom/400.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/400.http
similarity index 99%
rename from build/assets/etc/haproxy/errors-custom/400.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/400.http
index 8e653cb..3dd81bb 100644
--- a/build/assets/etc/haproxy/errors-custom/400.http
+++ b/build/assets/etc/easyhaproxy/haproxy/errors-custom/400.http
@@ -4,7 +4,7 @@ Connection: close
Content-Type: text/html
-
+Ins
400 Bad request
diff --git a/build/assets/etc/haproxy/errors-custom/403.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/403.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/403.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/403.http
diff --git a/build/assets/etc/haproxy/errors-custom/408.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/408.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/408.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/408.http
diff --git a/build/assets/etc/haproxy/errors-custom/500.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/500.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/500.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/500.http
diff --git a/build/assets/etc/haproxy/errors-custom/502.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/502.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/502.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/502.http
diff --git a/build/assets/etc/haproxy/errors-custom/503.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/503.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/503.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/503.http
diff --git a/build/assets/etc/haproxy/errors-custom/504.http b/build/assets/etc/easyhaproxy/haproxy/errors-custom/504.http
similarity index 100%
rename from build/assets/etc/haproxy/errors-custom/504.http
rename to build/assets/etc/easyhaproxy/haproxy/errors-custom/504.http
diff --git a/build/assets/etc/haproxy/conf.d/README.md b/build/assets/etc/haproxy/conf.d/README.md
deleted file mode 100644
index 661ea82..0000000
--- a/build/assets/etc/haproxy/conf.d/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Custom HAProxy
-
-Put files .cfg to be included in the configuration
diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml
index f988247..7ed6e75 100644
--- a/deploy/docker/docker-compose.yml
+++ b/deploy/docker/docker-compose.yml
@@ -3,8 +3,8 @@ services:
image: byjg/easy-haproxy:5.0.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- - certs_certbot:/certs/certbot
- - certs_haproxy:/certs/haproxy
+ - certs_certbot:/etc/easyhaproxy/certs/certbot
+ - certs_haproxy:/etc/easyhaproxy/certs/haproxy
environment:
EASYHAPROXY_DISCOVER: docker
diff --git a/docs/Plugins/cleanup.md b/docs/Plugins/cleanup.md
index d1d9ef4..e19bfb2 100644
--- a/docs/Plugins/cleanup.md
+++ b/docs/Plugins/cleanup.md
@@ -28,7 +28,7 @@ Prevents disk space issues by automatically cleaning up temporary files created
### Static YAML Configuration
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
plugins:
enabled: [cleanup]
config:
@@ -53,7 +53,7 @@ Configure the Cleanup plugin globally:
### Custom Idle Time (1 hour)
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
plugins:
enabled: [cleanup]
config:
diff --git a/docs/Plugins/cloudflare.md b/docs/Plugins/cloudflare.md
index 8949c1e..c3cc77a 100644
--- a/docs/Plugins/cloudflare.md
+++ b/docs/Plugins/cloudflare.md
@@ -17,11 +17,11 @@ Cloudflare replaces the visitor's IP with its own. This plugin restores the orig
## Configuration Options
-| Option | Description | Default |
-|-------------------|------------------------------------------|-----------------------------------|
-| `enabled` | Enable/disable plugin | `true` |
-| `use_builtin_ips` | Use built-in Cloudflare IP ranges | `true` |
-| `ip_list_path` | Path to Cloudflare IP list | `/etc/haproxy/cloudflare_ips.lst` |
+| Option | Description | Default |
+|-------------------|------------------------------------------|---------------------------------------|
+| `enabled` | Enable/disable plugin | `true` |
+| `use_builtin_ips` | Use built-in Cloudflare IP ranges | `true` |
+| `ip_list_path` | Path to Cloudflare IP list | `/etc/easyhaproxy/cloudflare_ips.lst` |
## Configuration Examples
@@ -55,7 +55,7 @@ kind: Ingress
metadata:
annotations:
easyhaproxy.plugins: "cloudflare"
- easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
+ easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/easyhaproxy/cloudflare_ips.lst"
spec:
rules:
- host: example.com
@@ -72,7 +72,7 @@ spec:
### Static YAML Configuration
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
plugins:
config:
cloudflare:
@@ -84,11 +84,11 @@ plugins:
Configure Cloudflare plugin defaults for all domains:
-| Environment Variable | Config Key | Type | Default | Description |
-|-------------------------------------------------|-------------------|----------|-----------------------------------|---------------------------------------|
-| `EASYHAPROXY_PLUGIN_CLOUDFLARE_ENABLED` | `enabled` | boolean | `true` | Enable/disable plugin for all domains |
-| `EASYHAPROXY_PLUGIN_CLOUDFLARE_USE_BUILTIN_IPS` | `use_builtin_ips` | boolean | `true` | Use built-in Cloudflare IP ranges |
-| `EASYHAPROXY_PLUGIN_CLOUDFLARE_IP_LIST_PATH` | `ip_list_path` | string | `/etc/haproxy/cloudflare_ips.lst` | Path to Cloudflare IP list file |
+| Environment Variable | Config Key | Type | Default | Description |
+|-------------------------------------------------|-------------------|----------|---------------------------------------|---------------------------------------|
+| `EASYHAPROXY_PLUGIN_CLOUDFLARE_ENABLED` | `enabled` | boolean | `true` | Enable/disable plugin for all domains |
+| `EASYHAPROXY_PLUGIN_CLOUDFLARE_USE_BUILTIN_IPS` | `use_builtin_ips` | boolean | `true` | Use built-in Cloudflare IP ranges |
+| `EASYHAPROXY_PLUGIN_CLOUDFLARE_IP_LIST_PATH` | `ip_list_path` | string | `/etc/easyhaproxy/cloudflare_ips.lst` | Path to Cloudflare IP list file |
**Note:** Environment variables set defaults for ALL domains. To enable/disable per-domain, use container labels or Kubernetes annotations.
@@ -96,7 +96,7 @@ Configure Cloudflare plugin defaults for all domains:
```haproxy
# Cloudflare - Restore original visitor IP
-acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst
+acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst
http-request set-header X-Forwarded-For %[req.hdr(CF-Connecting-IP)] if from_cloudflare
```
@@ -114,7 +114,7 @@ The plugin includes the current Cloudflare IP ranges (22 ranges total):
- 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32
- 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32
-These ranges are automatically written to `/etc/haproxy/cloudflare_ips.lst` during each discovery cycle.
+These ranges are automatically written to `/etc/easyhaproxy/cloudflare_ips.lst` during each discovery cycle.
## Important Notes
diff --git a/docs/Plugins/deny-pages.md b/docs/Plugins/deny-pages.md
index b62673b..c23a580 100644
--- a/docs/Plugins/deny-pages.md
+++ b/docs/Plugins/deny-pages.md
@@ -73,7 +73,7 @@ spec:
### Static YAML Configuration
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
containers:
"example.com:80":
ip: ["webapp:80"]
diff --git a/docs/Plugins/fastcgi.md b/docs/Plugins/fastcgi.md
index 28db516..0427988 100644
--- a/docs/Plugins/fastcgi.md
+++ b/docs/Plugins/fastcgi.md
@@ -20,7 +20,7 @@ Automatically generates HAProxy `fcgi-app` configuration that defines required C
| Option | Description | Default |
|-------------------|-----------------------------------------|------------------------------------|
| `enabled` | Enable/disable plugin | `true` |
-| `document_root` | Document root path | `/var/www/html` |
+| `document_root` | Document root path | `/etc/easyhaproxy/www` |
| `script_filename` | Custom pattern for SCRIPT_FILENAME | `%[path]` (uses HAProxy's default) |
| `index_file` | Default index file | `index.php` |
| `path_info` | Enable PATH_INFO support | `true` |
@@ -40,10 +40,10 @@ services:
easyhaproxy.http.localport: 9000
easyhaproxy.http.proto: fcgi
easyhaproxy.http.plugins: fastcgi
- easyhaproxy.http.plugin.fastcgi.document_root: /var/www/html
+ easyhaproxy.http.plugin.fastcgi.document_root: /etc/easyhaproxy/www
easyhaproxy.http.plugin.fastcgi.index_file: index.php
volumes:
- - ./app:/var/www/html
+ - ./app:/etc/easyhaproxy/www
```
### Docker/Docker Compose (Unix socket)
@@ -57,10 +57,10 @@ services:
easyhaproxy.http.socket: /run/php/php-fpm.sock
easyhaproxy.http.proto: fcgi
easyhaproxy.http.plugins: fastcgi
- easyhaproxy.http.plugin.fastcgi.document_root: /var/www/html
+ easyhaproxy.http.plugin.fastcgi.document_root: /etc/easyhaproxy/www
easyhaproxy.http.plugin.fastcgi.index_file: index.php
volumes:
- - ./app:/var/www/html
+ - ./app:/etc/easyhaproxy/www
- /run/php:/run/php
```
@@ -82,7 +82,7 @@ kind: Ingress
metadata:
annotations:
easyhaproxy.plugins: "fastcgi"
- easyhaproxy.plugin.fastcgi.document_root: "/var/www/html"
+ easyhaproxy.plugin.fastcgi.document_root: "/etc/easyhaproxy/www"
easyhaproxy.plugin.fastcgi.index_file: "index.php"
spec:
rules:
@@ -100,7 +100,7 @@ spec:
### Static YAML Configuration
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
easymapping:
- host: phpapp.local
port: 80
@@ -110,7 +110,7 @@ easymapping:
- fastcgi
plugin_config:
fastcgi:
- document_root: /var/www/html
+ document_root: /etc/easyhaproxy/www
index_file: index.php
path_info: true
```
@@ -122,7 +122,7 @@ Configure FastCGI plugin defaults for all domains:
| Environment Variable | Config Key | Type | Default | Description |
|----------------------------------------------|-------------------|----------|-----------------|---------------------------------------|
| `EASYHAPROXY_PLUGIN_FASTCGI_ENABLED` | `enabled` | boolean | `true` | Enable/disable plugin for all domains |
-| `EASYHAPROXY_PLUGIN_FASTCGI_DOCUMENT_ROOT` | `document_root` | string | `/var/www/html` | Document root path |
+| `EASYHAPROXY_PLUGIN_FASTCGI_DOCUMENT_ROOT` | `document_root` | string | `/etc/easyhaproxy/www` | Document root path |
| `EASYHAPROXY_PLUGIN_FASTCGI_SCRIPT_FILENAME` | `script_filename` | string | `%[path]` | Custom pattern for SCRIPT_FILENAME |
| `EASYHAPROXY_PLUGIN_FASTCGI_INDEX_FILE` | `index_file` | string | `index.php` | Default index file |
| `EASYHAPROXY_PLUGIN_FASTCGI_PATH_INFO` | `path_info` | boolean | `true` | Enable PATH_INFO support |
@@ -136,7 +136,7 @@ The plugin generates a top-level `fcgi-app` section and a `use-fcgi-app` directi
```haproxy
# Top-level fcgi-app definition (added after defaults, before frontends/backends)
fcgi-app fcgi_phpapp_local
- docroot /var/www/html
+ docroot /etc/easyhaproxy/www
index index.php
path-info ^(/.+\.php)(/.*)?$
diff --git a/docs/Plugins/ip-whitelist.md b/docs/Plugins/ip-whitelist.md
index 2ae8f15..c64e7dd 100644
--- a/docs/Plugins/ip-whitelist.md
+++ b/docs/Plugins/ip-whitelist.md
@@ -72,7 +72,7 @@ spec:
### Static YAML Configuration
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
easymapping:
- host: admin.example.com
port: 443
diff --git a/docs/Plugins/jwt-validator.md b/docs/Plugins/jwt-validator.md
index a1b5570..9cd4db8 100644
--- a/docs/Plugins/jwt-validator.md
+++ b/docs/Plugins/jwt-validator.md
@@ -77,9 +77,9 @@ services:
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
volumes:
- - ./pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
```
### Protect Specific Paths Only
@@ -87,7 +87,7 @@ services:
```yaml
labels:
easyhaproxy.http.plugins: jwt_validator
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/sensitive
easyhaproxy.http.plugin.jwt_validator.only_paths: false
# /api/health, /api/docs, etc. remain publicly accessible
@@ -98,7 +98,7 @@ labels:
```yaml
labels:
easyhaproxy.http.plugins: jwt_validator
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.paths: /api/public,/api/v1
easyhaproxy.http.plugin.jwt_validator.only_paths: true
# All paths except /api/public and /api/v1 are denied
@@ -110,7 +110,7 @@ labels:
labels:
easyhaproxy.http.plugin.jwt_validator.issuer: none
easyhaproxy.http.plugin.jwt_validator.audience: none
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
```
### Allow Anonymous Access (Optional JWT)
@@ -121,10 +121,10 @@ services:
labels:
easyhaproxy.http.host: api.example.com
easyhaproxy.http.plugins: jwt_validator
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.allow_anonymous: true
volumes:
- - ./pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
# Requests without Authorization header are allowed
# Requests with Authorization header are validated
# Invalid JWTs are rejected
@@ -204,7 +204,7 @@ metadata:
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
- easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
easyhaproxy.plugin.jwt_validator.paths: "/api/admin,/api/users"
easyhaproxy.plugin.jwt_validator.only_paths: "false"
spec:
@@ -227,7 +227,7 @@ spec:
### Static YAML Configuration
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
containers:
"api.example.com:443":
ip: ["api-service:8080"]
@@ -238,7 +238,7 @@ containers:
algorithm: RS256
issuer: https://auth.example.com/
audience: https://api.example.com
- pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
```
### Environment Variables
@@ -277,7 +277,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 }
http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless { var(txn.iss) -m str https://auth.example.com/ }
http-request deny content-type 'text/html' string 'Invalid JWT audience' unless { var(txn.aud) -m str https://api.example.com }
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 }
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 }
# Validate expiration
http-request set-var(txn.now) date()
@@ -303,7 +303,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
# Validate JWT (only on protected paths)
http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 } if jwt_protected_path
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 } if jwt_protected_path
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 } if jwt_protected_path
# Validate expiration
http-request set-var(txn.now) date() if jwt_protected_path
@@ -332,7 +332,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
# Validate JWT (all requests at this point are on allowed paths)
http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 }
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 }
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 }
# Validate expiration
http-request set-var(txn.now) date()
@@ -356,7 +356,7 @@ http-request set-var(txn.exp) http_auth_bearer,jwt_payload_query('$.exp','int')
http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 } if { req.hdr(authorization) -m found }
http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless { var(txn.iss) -m str https://auth.example.com/ } if { req.hdr(authorization) -m found }
http-request deny content-type 'text/html' string 'Invalid JWT audience' unless { var(txn.aud) -m str https://api.example.com } if { req.hdr(authorization) -m found }
-http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 } if { req.hdr(authorization) -m found }
+http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 } if { req.hdr(authorization) -m found }
# Validate expiration (only if Authorization header is present)
http-request set-var(txn.now) date() if { req.hdr(authorization) -m found }
diff --git a/docs/acme.md b/docs/acme.md
index 1e1765f..5aa3ac2 100644
--- a/docs/acme.md
+++ b/docs/acme.md
@@ -33,7 +33,7 @@ At a high level, ACME with Easy HAProxy works in two stages:
- Manually setting `EASYHAPROXY_CERTBOT_SERVER` (and `EASYHAPROXY_CERTBOT_EAB_KID` / `EASYHAPROXY_CERTBOT_EAB_HMAC_KEY` when your CA requires EAB).
- Always set your contact email via `EASYHAPROXY_CERTBOT_EMAIL`.
- Ensure ports 80 and 443 are publicly reachable on the EasyHAProxy host.
- - Persist the folder `/certs/certbot` on a durable volume so issued/renewed certificates survive container restarts and avoid hitting CA rate limits.
+ - Persist the folder `/etc/easyhaproxy/certs/certbot` on a durable volume so issued/renewed certificates survive container restarts and avoid hitting CA rate limits.
- Challenge method is HTTP-01 only; EasyHAProxy configures a standalone Certbot responder internally.
2. Enable ACME per domain (per service/app)
@@ -44,7 +44,7 @@ At a high level, ACME with Easy HAProxy works in two stages:
What happens under the hood
- When a labeled domain is detected and a certificate is needed, EasyHAProxy runs Certbot with `--preferred-challenges http` and a standalone responder bound to internal port 2080.
- HAProxy temporarily routes `/.well-known/acme-challenge/` for that domain to the Certbot responder, allowing the CA to validate via HTTP-01.
-- On success, EasyHAProxy merges the issued cert and key and stores them under `/certs/certbot` (one PEM per domain), then reloads HAProxy to serve HTTPS for that domain.
+- On success, EasyHAProxy merges the issued cert and key and stores them under `/etc/easyhaproxy/certs/certbot` (one PEM per domain), then reloads HAProxy to serve HTTPS for that domain.
- Certificates are monitored and renewed automatically before expiry.
Tips
@@ -105,7 +105,7 @@ docker run \
-e EASYHAPROXY_CERTBOT_EMAIL=john@doe.com \
-p 80:80 \
-p 443:443 \
- -v /path/to/guest/certbot/certs:/certs/certbot \
+ -v /path/to/guest/certbot/certs:/etc/easyhaproxy/certs/certbot \
... \
byjg/easy-haproxy
```
@@ -118,7 +118,7 @@ docker run \
:::danger Important: Persist Certbot Certificates
To avoid hitting rate limits and certificate issuing problems:
-- **You must persist** the container folder `/certs/certbot` outside the container
+- **You must persist** the container folder `/etc/easyhaproxy/certs/certbot` outside the container
- **Never delete or modify** its contents manually
- If you don't persist this folder, or if you delete/modify its contents, certificate issuing may not work properly and you may hit rate limits
:::
diff --git a/docs/environment-variable.md b/docs/environment-variable.md
index e591616..68ad738 100644
--- a/docs/environment-variable.md
+++ b/docs/environment-variable.md
@@ -4,20 +4,21 @@ sidebar_position: 12
# Docker environment variables
-| Environment Variable | Description | Default |
-|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
-| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
-| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
-| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md) | *empty* |
-| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` |
-| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 |
-| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
-| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
-| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | INFO |
-| HAPROXY_USERNAME | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set). | `admin` |
-| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined. | *empty* |
-| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined. | `1936` |
-| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |
+| Environment Variable | Description | Default |
+|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------|
+| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
+| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
+| EASYHAPROXY_BASE_PATH | (Optional) Base directory for all EasyHAProxy files. All paths (config, certs, plugins, www) are constructed relative to this base. | `/etc/easyhaproxy` |
+| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md) | *empty* |
+| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` |
+| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 |
+| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
+| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
+| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | INFO |
+| HAPROXY_USERNAME | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set). | `admin` |
+| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined. | *empty* |
+| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined. | `1936` |
+| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |
:::tip HAProxy Stats
Statistics are only configured when `HAPROXY_PASSWORD` is set. Without a password, the stats section is not generated.
diff --git a/docs/kubernetes.md b/docs/kubernetes.md
index d220751..0a3cdf4 100644
--- a/docs/kubernetes.md
+++ b/docs/kubernetes.md
@@ -177,7 +177,7 @@ metadata:
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
- easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
spec:
ingressClassName: easyhaproxy
```
diff --git a/docs/other.md b/docs/other.md
index cc45282..173c322 100644
--- a/docs/other.md
+++ b/docs/other.md
@@ -36,18 +36,18 @@ docker run \
## Mapping custom .cfg files
-You can concatenate valid HAProxy `.cfg` files to the dynamically generated `haproxy.cfg` by mapping the folder `/etc/haproxy/conf.d`.
+You can concatenate valid HAProxy `.cfg` files to the dynamically generated `haproxy.cfg` by mapping the folder `/etc/easyhaproxy/haproxy/conf.d`.
```bash title="Mount custom config directory"
docker run \
/* other parameters */
- -v /your/local/conf.d:/etc/haproxy/conf.d \
+ -v /your/local/conf.d:/etc/easyhaproxy/haproxy/conf.d \
-d byjg/easy-haproxy
```
## Setting Custom Errors
-If enabled, map the volume : `/etc/haproxy/errors-custom/` to your container and put a file named `ERROR_NUMBER.http`
+If enabled, map the volume : `/etc/easyhaproxy/haproxy/errors-custom/` to your container and put a file named `ERROR_NUMBER.http`
where ERROR_NUMBER is the HTTP error code (e.g., `503.http`)
----
diff --git a/docs/plugin-development.md b/docs/plugin-development.md
index fbcc520..29e1d0c 100644
--- a/docs/plugin-development.md
+++ b/docs/plugin-development.md
@@ -127,7 +127,7 @@ Execute **once per discovered domain/host**.
### Plugin Loading Order
1. **Builtin plugins** - Loaded from `/src/plugins/builtin/`
-2. **External plugins** - Loaded from `/etc/haproxy/plugins/`
+2. **External plugins** - Loaded from `/etc/easyhaproxy/plugins/`
Plugins are discovered automatically by filename (`*.py` excluding `__*.py`).
@@ -160,10 +160,10 @@ HAProxy Reload
### Step 1: Create Plugin File
-Create a new Python file in `/etc/haproxy/plugins/` (or builtin location for core plugins):
+Create a new Python file in `/etc/easyhaproxy/plugins/` (or builtin location for core plugins):
```python
-# /etc/haproxy/plugins/my_plugin.py
+# /etc/easyhaproxy/plugins/my_plugin.py
import os
import sys
@@ -248,7 +248,7 @@ services:
**Via YAML configuration:**
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
plugins:
enabled: [my_plugin]
config:
@@ -521,13 +521,13 @@ return PluginResult(
return PluginResult(
haproxy_config="use-fcgi-app fcgi_example_com",
global_configs=[
- "fcgi-app fcgi_example_com\n docroot /var/www/html"
+ "fcgi-app fcgi_example_com\n docroot /etc/easyhaproxy/www"
]
)
# With defaults-level config (new in v2.0)
return PluginResult(
- haproxy_config="acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst",
+ haproxy_config="acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst",
defaults_configs=[
'log-format "%{+Q}[var(txn.real_ip)]:-/%ci:%cp [%tr] %ft %b/%s"'
]
@@ -551,7 +551,7 @@ class PluginManager:
Args:
plugins_dir: Directory containing plugin files (defaults to
- EASYHAPROXY_PLUGINS_DIR env var or /etc/haproxy/plugins)
+ EASYHAPROXY_PLUGINS_DIR env var or /etc/easyhaproxy/plugins)
abort_on_error: If True, abort on plugin errors; if False, log and continue
"""
@@ -573,7 +573,7 @@ class PluginManager:
**Environment Variables:**
-- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/haproxy/plugins`)
+- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/easyhaproxy/plugins`)
**Note:** You typically don't interact with PluginManager directly when writing plugins. It's used by EasyHAProxy core.
@@ -712,7 +712,7 @@ The plugin creates:
Configuration:
- enabled: Enable/disable the plugin (default: true)
- - document_root: Document root path (default: /var/www/html)
+ - document_root: Document root path (default: /etc/easyhaproxy/www)
- script_filename: Pattern for SCRIPT_FILENAME (default: %[path])
- index_file: Default index file (default: index.php)
- path_info: Enable PATH_INFO support (default: true)
@@ -722,7 +722,7 @@ Example YAML config:
plugins:
fastcgi:
enabled: true
- document_root: /var/www/html
+ document_root: /etc/easyhaproxy/www
index_file: index.php
path_info: true
@@ -748,7 +748,7 @@ class FastcgiPlugin(PluginInterface):
def __init__(self):
self.enabled = True
- self.document_root = "/var/www/html"
+ self.document_root = "/etc/easyhaproxy/www"
self.script_filename = "%[path]"
self.index_file = "index.php"
self.path_info = True
@@ -885,7 +885,7 @@ Example YAML config:
algorithm: RS256
issuer: https://myaccount.auth0.com/
audience: https://api.mywebsite.com
- pubkey_path: /etc/haproxy/jwt_keys/pubkey.pem
+ pubkey_path: /etc/easyhaproxy/jwt_keys/pubkey.pem
paths:
- /api/admin
- /api/sensitive
@@ -896,7 +896,7 @@ Example Container Label:
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/sensitive
easyhaproxy.http.plugin.jwt_validator.only_paths: true
"""
@@ -1267,7 +1267,7 @@ class CleanupPlugin(PluginInterface):
### Core Environment Variables
-- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/haproxy/plugins`)
+- `EASYHAPROXY_PLUGINS_DIR` - Override plugin directory (default: `/etc/easyhaproxy/plugins`)
- `EASYHAPROXY_PLUGINS_ENABLED` - Comma-separated list of enabled plugins
- `EASYHAPROXY_PLUGINS_ABORT_ON_ERROR` - Abort on plugin errors (default: `false`)
@@ -1685,7 +1685,7 @@ services:
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- - ./my_plugin.py:/etc/haproxy/plugins/my_plugin.py
+ - ./my_plugin.py:/etc/easyhaproxy/plugins/my_plugin.py
environment:
- EASYHAPROXY_DISCOVER=docker
```
@@ -1707,7 +1707,7 @@ Expected output:
**Verify generated configuration:**
```bash
-docker-compose exec haproxy cat /etc/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
+docker-compose exec haproxy cat /etc/easyhaproxy/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
```
---
@@ -1722,13 +1722,13 @@ docker-compose exec haproxy cat /etc/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
1. **File not in plugins directory**
```bash
- ls -la /etc/haproxy/plugins/
+ ls -la /etc/easyhaproxy/plugins/
# Ensure my_plugin.py exists
```
2. **Invalid Python syntax**
```bash
- python3 -m py_compile /etc/haproxy/plugins/my_plugin.py
+ python3 -m py_compile /etc/easyhaproxy/plugins/my_plugin.py
# Check for syntax errors
```
@@ -1814,7 +1814,7 @@ docker-compose exec haproxy cat /etc/haproxy/haproxy.cfg | grep -A 5 "My Plugin"
1. **Invalid HAProxy syntax in generated config**
```bash
# Test configuration manually:
- haproxy -c -f /etc/haproxy/haproxy.cfg
+ haproxy -c -f /etc/easyhaproxy/haproxy/haproxy.cfg
```
2. **Missing quotes or escaping**
@@ -1907,7 +1907,7 @@ Share your plugin as a single `.py` file:
```bash
# Users copy the file to their plugins directory:
-cp my_plugin.py /etc/haproxy/plugins/
+cp my_plugin.py /etc/easyhaproxy/plugins/
```
**Advantages:**
@@ -1935,7 +1935,7 @@ my-easyhaproxy-plugin/
**Installation:**
```bash
# Users download and install:
-wget https://raw.githubusercontent.com/user/my-plugin/main/my_plugin.py -O /etc/haproxy/plugins/my_plugin.py
+wget https://raw.githubusercontent.com/user/my-plugin/main/my_plugin.py -O /etc/easyhaproxy/plugins/my_plugin.py
```
#### Option 3: Docker Image with Plugin
@@ -1949,7 +1949,7 @@ FROM byjg/easy-haproxy:latest
COPY my_plugin.py /app/src/plugins/builtin/
# Optional: Add default configuration
-COPY plugin_config.yaml /etc/haproxy/static/config.yaml
+COPY plugin_config.yaml /etc/easyhaproxy/static/config.yaml
```
**Build and distribute:**
@@ -1977,7 +1977,7 @@ Brief description of what your plugin does.
### Docker
\`\`\`bash
-wget https://example.com/my_plugin.py -O /etc/haproxy/plugins/my_plugin.py
+wget https://example.com/my_plugin.py -O /etc/easyhaproxy/plugins/my_plugin.py
\`\`\`
### Kubernetes
diff --git a/docs/plugins.md b/docs/plugins.md
index 9adda9a..cb10c44 100644
--- a/docs/plugins.md
+++ b/docs/plugins.md
@@ -71,7 +71,7 @@ metadata:
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
- easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
easyhaproxy.plugin.jwt_validator.paths: "/api/admin,/api/users"
easyhaproxy.plugin.jwt_validator.only_paths: "false"
# Configure deny_pages plugin
@@ -124,7 +124,7 @@ services:
### 3. Static YAML Configuration
-Configure plugins in `/etc/haproxy/static/config.yaml`:
+Configure plugins in `/etc/easyhaproxy/static/config.yaml`:
```yaml
plugins:
@@ -200,9 +200,9 @@ services:
easyhaproxy.http.plugins: jwt_validator
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth0.myapp.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
volumes:
- - ./auth_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./auth_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
```
**Protect only admin/sensitive endpoints:**
@@ -213,11 +213,11 @@ services:
labels:
easyhaproxy.http.host: api.example.com
easyhaproxy.http.plugins: jwt_validator
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/users,/api/billing
easyhaproxy.http.plugin.jwt_validator.only_paths: false
volumes:
- - ./auth_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./auth_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
# /api/health, /api/docs, etc. remain publicly accessible
```
@@ -229,11 +229,11 @@ services:
labels:
easyhaproxy.http.host: api.example.com
easyhaproxy.http.plugins: jwt_validator
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.paths: /api/v1,/api/v2
easyhaproxy.http.plugin.jwt_validator.only_paths: true
volumes:
- - ./auth_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./auth_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
# All paths except /api/v1 and /api/v2 are denied
```
@@ -287,7 +287,7 @@ labels:
Keep your system clean with automatic temp file removal:
```yaml
-# /etc/haproxy/static/config.yaml
+# /etc/easyhaproxy/static/config.yaml
plugins:
enabled: [cleanup]
config:
@@ -346,13 +346,13 @@ EASYHAPROXY_LOG_LEVEL=DEBUG
INFO: Loaded builtin plugin: cloudflare (domain)
INFO: Loaded builtin plugin: cleanup (global)
DEBUG: Executing domain plugin: cloudflare for domain: example.com
-DEBUG: Plugin cloudflare metadata: {'domain': 'example.com', 'ip_list_path': '/etc/haproxy/cloudflare_ips.lst'}
+DEBUG: Plugin cloudflare metadata: {'domain': 'example.com', 'ip_list_path': '/etc/easyhaproxy/cloudflare_ips.lst'}
```
### Plugin Not Loading
**Check:**
-1. Plugin file exists in `/etc/haproxy/plugins/` or builtin directory
+1. Plugin file exists in `/etc/easyhaproxy/plugins/` or builtin directory
2. Python syntax is valid
3. Plugin class inherits from `PluginInterface`
4. Check logs for load errors
diff --git a/docs/ssl.md b/docs/ssl.md
index 0c50b01..40ceaac 100644
--- a/docs/ssl.md
+++ b/docs/ssl.md
@@ -43,7 +43,7 @@ Add the Base64 string you generated before to the label `easyhaproxy.[definition
## Map the certificate as a docker volume
-EasyHAProxy stores the certificates inside the container folder `/certs/haproxy`.
+EasyHAProxy stores the certificates inside the container folder `/etc/easyhaproxy/certs/haproxy`.
1. Run EasyHAProxy with the volume for the certificates:
@@ -52,7 +52,7 @@ docker volume create certs_haproxy
docker run \
/* other parameters */
- -v certs_haproxy:/certs/haproxy \
+ -v certs_haproxy:/etc/easyhaproxy/certs/haproxy \
-d byjg/easy-haproxy
```
@@ -77,7 +77,7 @@ MIIEojCCA4qgAwIBAgIUegW2BimwuL4RzRZ2WYkHA6U5nkAwDQYJKoZIhvcNAQEL
3. Copy this certificate to EasyHAProxy volume:
```bash title="Copy certificate to container"
-docker cp single.pem easyhaproxy:/certs/haproxy
+docker cp single.pem easyhaproxy:/etc/easyhaproxy/certs/haproxy
```
----
diff --git a/docs/static.md b/docs/static.md
index e9e17f8..77aa9bb 100644
--- a/docs/static.md
+++ b/docs/static.md
@@ -66,12 +66,12 @@ The `containers` format simplifies static configuration:
- **Clearer mapping**: Format mirrors internal Docker label structure
:::
-Then map this file to `/etc/haproxy/static/config.yml` in your EasyHAProxy container:
+Then map this file to `/etc/easyhaproxy/static/config.yml` in your EasyHAProxy container:
```bash title="Run EasyHAProxy with static configuration"
docker run -d \
--name easy-haproxy-container \
- -v /my/static/:/etc/haproxy/static/ \
+ -v /my/static/:/etc/easyhaproxy/static/ \
-e EASYHAPROXY_DISCOVER="static" \
# + Environment Variables \
-p 80:80 \
diff --git a/docs/volumes.md b/docs/volumes.md
index c738523..176402e 100644
--- a/docs/volumes.md
+++ b/docs/volumes.md
@@ -8,15 +8,193 @@ sidebar_position: 13
These volumes allow you to persist certificates, provide custom configurations, and extend EasyHAProxy functionality.
:::
-You can map the following volumes:
+## Directory Structure
-| Volume | Description |
-|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------|
-| /etc/haproxy/static/ | The folder that will contain the [config.yml](static.md) file for static configuration |
-| /certs/haproxy/ | The folder that will contain the certificates (`PEM`) for the [SSL](ssl.md) |
-| /certs/certbot/ | The folder that will contain the certificates (`PEM`) processed by Certbot (e.g. Let's Encrypt). More info: [acme](acme.md). |
-| /etc/haproxy/conf.d/ | The folder that will contain the [custom configuration](other.md) files. |
-| /etc/haproxy/errors-custom/ | The folder that will contain the [custom error](other.md) html files. |
+:::info Base Path
+All EasyHAProxy files are organized under `/etc/easyhaproxy/`. This can be customized using the `EASYHAPROXY_BASE_PATH` environment variable.
+:::
+
+```plaintext title="/etc/easyhaproxy/ Directory Tree"
+/etc/easyhaproxy/
+├── static/ # 🔧 Runtime (static mode only)
+│ └── config.yml # Static service configuration
+│
+├── haproxy/
+│ ├── haproxy.cfg # 🔧 Runtime - Generated HAProxy config
+│ ├── conf.d/ # 📦 Base image
+│ │ ├── README.md
+│ │ └── *.cfg # User-provided custom configs
+│ ├── dhparam # 📦 Base image - DH params 2048-bit
+│ ├── dhparam-1024 # 📦 Base image - DH params 1024-bit
+│ └── errors-custom/ # 📦 Base image
+│ ├── 400.http # Bad Request
+│ ├── 403.http # Forbidden
+│ ├── 408.http # Request Timeout
+│ ├── 500.http # Internal Server Error
+│ ├── 502.http # Bad Gateway
+│ ├── 503.http # Service Unavailable
+│ └── 504.http # Gateway Timeout
+│
+├── certs/
+│ ├── live/ # 🔧 Runtime (Certbot)
+│ │ └── {domain}/
+│ │ ├── cert.pem # Certificate only
+│ │ ├── chain.pem # Certificate chain
+│ │ ├── fullchain.pem # cert.pem + chain.pem
+│ │ ├── privkey.pem # Private key
+│ │ └── README
+│ ├── archive/ # 🔧 Runtime (Certbot)
+│ │ └── {domain}/
+│ │ ├── cert1.pem, cert2.pem... # Versioned certificates
+│ │ └── privkey1.pem... # Versioned keys
+│ ├── work/ # 🔧 Runtime (Certbot working dir)
+│ ├── logs/ # 🔧 Runtime (Certbot logs)
+│ │ └── letsencrypt.log
+│ ├── certbot/ # 📦 Base image
+│ │ ├── {domain}.pem # 🔧 Runtime - Merged cert+key
+│ │ └── placeholder.pem # 📦 Base image - Placeholder cert
+│ └── haproxy/ # 📦 Base image
+│ ├── {domain}.pem # User-provided cert+key (PEM format)
+│ └── placeholder.pem # 📦 Base image - Placeholder cert
+│
+├── plugins/ # Optional - Custom plugins
+│ └── *.py # Python plugin files
+│
+├── jwt_keys/ # Optional - JWT validation
+│ └── *.pem # RSA public keys
+│
+├── cloudflare_ips.lst # Optional - Cloudflare plugin
+│
+└── www/ # Optional - FastCGI document root
+ └── index.php
+```
+
+:::tip Legend
+- **📦 Base image** - Included in the Docker image
+- **🔧 Runtime** - Created/generated when EasyHAProxy runs
+- **Optional** - Created only when specific features are used
+:::
+
+## Common Volume Mappings
+
+The most commonly mapped volumes for persistence and customization:
+
+| Volume | Purpose | Required |
+|-------------------------------------------|-------------------------------------------------------------------------------------------------------|----------|
+| `/etc/easyhaproxy/static/` | [Static configuration](static.md) - mount your `config.yml` here | Optional |
+| `/etc/easyhaproxy/certs/haproxy/` | [SSL certificates](ssl.md) - user-provided certificates in PEM format | Optional |
+| `/etc/easyhaproxy/certs/certbot/` | [ACME/Certbot certificates](acme.md) - auto-generated Let's Encrypt certificates | Optional |
+| `/etc/easyhaproxy/certs/live/` | Certbot live certificates - persist across container restarts | Optional |
+| `/etc/easyhaproxy/haproxy/conf.d/` | [Custom HAProxy config](other.md) - additional `.cfg` files to include | Optional |
+| `/etc/easyhaproxy/haproxy/errors-custom/` | [Custom error pages](other.md) - custom HTTP error pages (400, 403, 500, etc.) | Optional |
+| `/etc/easyhaproxy/plugins/` | [Custom plugins](plugins.md) - Python plugin files | Optional |
+| `/etc/easyhaproxy/jwt_keys/` | [JWT public keys](Plugins/jwt-validator.md) - RSA public keys for JWT validation | Optional |
+| `/etc/easyhaproxy/www/` | [FastCGI document root](Plugins/fastcgi.md) - PHP/FastCGI application files | Optional |
+
+## Directory Details
+
+### Configuration Files
+
+#### Static Configuration
+```bash
+/etc/easyhaproxy/static/config.yml
+```
+Static service configuration when not using service discovery (Docker/Kubernetes).
+
+:::note
+This directory only exists when `EASYHAPROXY_DISCOVER=static` is set.
+:::
+
+#### HAProxy Configuration
+```bash
+/etc/easyhaproxy/haproxy/haproxy.cfg
+```
+Auto-generated HAProxy configuration file.
+
+:::warning Do Not Edit
+This file is automatically generated by EasyHAProxy. Any manual changes will be overwritten.
+:::
+
+#### Custom Configuration Snippets
+```bash
+/etc/easyhaproxy/haproxy/conf.d/*.cfg
+```
+Place custom HAProxy configuration snippets here. These files are automatically included in the main configuration.
+
+:::tip Example
+```bash
+# Mount your custom config
+docker run -v ./my-custom.cfg:/etc/easyhaproxy/haproxy/conf.d/my-custom.cfg byjg/easy-haproxy
+```
+:::
+
+### SSL/TLS Certificates
+
+#### User-Provided Certificates
+```bash
+/etc/easyhaproxy/certs/haproxy/{domain}.pem
+```
+Place your SSL certificates here in PEM format (certificate + private key combined).
+
+:::info PEM Format
+```bash
+cat domain.crt domain.key > /etc/easyhaproxy/certs/haproxy/domain.com.pem
+```
+:::
+
+#### ACME/Let's Encrypt Certificates
+```bash
+/etc/easyhaproxy/certs/certbot/{domain}.pem # Merged cert+key for HAProxy
+/etc/easyhaproxy/certs/live/{domain}/ # Certbot live certificates (symlinks)
+/etc/easyhaproxy/certs/archive/{domain}/ # Versioned certificate archive
+```
+
+EasyHAProxy automatically merges Certbot certificates from `/etc/easyhaproxy/certs/live/` into `/etc/easyhaproxy/certs/certbot/` for HAProxy consumption.
+
+:::tip Persist Certbot Certificates
+```yaml
+volumes:
+ - certbot-certs:/etc/easyhaproxy/certs/live
+ - certbot-archive:/etc/easyhaproxy/certs/archive
+```
+:::
+
+### Plugins & Extensions
+
+#### Custom Plugins
+```bash
+/etc/easyhaproxy/plugins/*.py
+```
+Add custom Python plugins to extend EasyHAProxy functionality.
+
+See [Plugin Development](plugin-development.md) for details.
+
+#### JWT Public Keys
+```bash
+/etc/easyhaproxy/jwt_keys/*.pem
+```
+RSA public keys for [JWT token validation](Plugins/jwt-validator.md).
+
+#### Cloudflare IP Ranges
+```bash
+/etc/easyhaproxy/cloudflare_ips.lst
+```
+Cloudflare IP ranges for the [Cloudflare plugin](Plugins/cloudflare.md) to restore real client IPs.
+
+### Error Pages
+
+```bash
+/etc/easyhaproxy/haproxy/errors-custom/{code}.http
+```
+
+Custom HTTP error pages (400, 403, 408, 500, 502, 503, 504). Default error pages are included in the base image.
+
+:::tip Customize Error Pages
+```bash
+# Mount your custom 503 error page
+docker run -v ./custom-503.http:/etc/easyhaproxy/haproxy/errors-custom/503.http byjg/easy-haproxy
+```
+:::
----
[Open source ByJG](http://opensource.byjg.com)
diff --git a/pyproject.toml b/pyproject.toml
index 4098b84..07f707a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -67,6 +67,7 @@ markers = [
"cloudflare: marks tests for Cloudflare IP restoration plugin",
"custom_label: marks tests for custom label prefix functionality",
"static: marks tests for static configuration mode",
+ "acme: marks tests for certbot/acme",
]
[tool.ruff]
diff --git a/src/functions/__init__.py b/src/functions/__init__.py
index 98dc194..77761e3 100644
--- a/src/functions/__init__.py
+++ b/src/functions/__init__.py
@@ -271,12 +271,55 @@ class Functions:
return [-99, e]
+class classproperty:
+ """Decorator for class-level properties."""
+ def __init__(self, func):
+ self.func = func
+
+ def __get__(self, obj, owner):
+ return self.func(owner)
+
+
class Consts:
- easyhaproxy_config = "/etc/haproxy/static/config.yml"
- haproxy_config = "/etc/haproxy/haproxy.cfg"
- custom_config_folder = "/etc/haproxy/conf.d"
- certs_certbot = "/certs/certbot"
- certs_haproxy = "/certs/haproxy"
+ """Configuration constants with dynamic path resolution based on EASYHAPROXY_BASE_PATH."""
+ _base_path = None
+
+ @classproperty
+ def base_path(cls):
+ """Base directory for all EasyHAProxy files."""
+ if cls._base_path is None:
+ cls._base_path = os.getenv("EASYHAPROXY_BASE_PATH", "/etc/easyhaproxy")
+ return cls._base_path
+
+ @classmethod
+ def reset(cls):
+ """Reset cached base path to pick up environment variable changes."""
+ cls._base_path = None
+
+ @classproperty
+ def easyhaproxy_config(cls):
+ """Path to static configuration file."""
+ return f"{cls.base_path}/static/config.yml"
+
+ @classproperty
+ def haproxy_config(cls):
+ """Path to generated HAProxy configuration file."""
+ return f"{cls.base_path}/haproxy/haproxy.cfg"
+
+ @classproperty
+ def custom_config_folder(cls):
+ """Path to custom HAProxy config snippets directory."""
+ return f"{cls.base_path}/haproxy/conf.d"
+
+ @classproperty
+ def certs_certbot(cls):
+ """Path to Certbot/ACME certificates directory."""
+ return f"{cls.base_path}/certs/certbot"
+
+ @classproperty
+ def certs_haproxy(cls):
+ """Path to user-provided certificates directory."""
+ return f"{cls.base_path}/certs/haproxy"
class DaemonizeHAProxy:
@@ -304,12 +347,12 @@ class DaemonizeHAProxy:
custom_config_files = f"-f {self.custom_config_folder}"
if action == DaemonizeHAProxy.HAPROXY_START or not os.path.exists(pid_file):
- return f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg {custom_config_files} -p {pid_file} -S /var/run/haproxy.sock"
+ return f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} {custom_config_files} -p {pid_file} -S /var/run/haproxy.sock"
else:
return_code, output = Functions().run_bash(logger_haproxy, f"cat {pid_file}", log_output=False)
pid = "".join(output).rstrip()
if psutil.pid_exists(int(pid)):
- return f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg {custom_config_files} -p {pid_file} -x /var/run/haproxy.sock -sf {pid}"
+ return f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} {custom_config_files} -p {pid_file} -x /var/run/haproxy.sock -sf {pid}"
else:
os.unlink(pid_file)
logger_haproxy.warning(
@@ -440,6 +483,9 @@ class Certbot:
renew_certs.append(host_arg)
certbot_certonly = ('/usr/bin/certbot certonly {acme_server}'
+ ' --config-dir {base_path}/certs'
+ ' --work-dir {base_path}/certs/work'
+ ' --logs-dir {base_path}/certs/logs'
' --preferred-challenges {challenge}'
' --agree-tos'
' --issuance-timeout 90'
@@ -452,7 +498,8 @@ class Certbot:
certs=' '.join(request_certs),
email=self.email,
challenge=self.certbot_preferred_challenges,
- acme_server=self.acme_server)
+ acme_server=self.acme_server,
+ base_path=Consts.base_path)
)
if 'http' in self.certbot_preferred_challenges:
@@ -476,7 +523,8 @@ class Certbot:
ret_reload = True
if len(renew_certs) > 0:
- return_code_renew, output = Functions.run_bash(logger_certbot, "/usr/bin/certbot renew", return_result=False)
+ certbot_renew = f"/usr/bin/certbot renew --config-dir {Consts.base_path}/certs --work-dir {Consts.base_path}/certs/work --logs-dir {Consts.base_path}/certs/logs"
+ return_code_renew, output = Functions.run_bash(logger_certbot, certbot_renew, return_result=False)
ret_reload = True
if ret_reload:
@@ -497,7 +545,7 @@ class Certbot:
Functions.save(filename, cert + key)
def find_live_certificates(self):
- certbot_certs = "/etc/letsencrypt/live/"
+ certbot_certs = f"{Consts.base_path}/certs/live/"
if not os.path.exists(certbot_certs):
return
for item in os.listdir(certbot_certs):
diff --git a/src/plugins/__init__.py b/src/plugins/__init__.py
index fb48b95..859ecc6 100644
--- a/src/plugins/__init__.py
+++ b/src/plugins/__init__.py
@@ -6,7 +6,7 @@ from dataclasses import dataclass, field
from enum import Enum
from typing import Any
-from functions import logger_easyhaproxy
+from functions import logger_easyhaproxy, Consts
class PluginType(Enum):
@@ -108,12 +108,12 @@ class PluginManager:
Initialize the plugin manager
Args:
- plugins_dir: Directory containing plugin files (defaults to EASYHAPROXY_PLUGINS_DIR env var or /etc/haproxy/plugins)
+ plugins_dir: Directory containing plugin files (defaults to EASYHAPROXY_PLUGINS_DIR env var or /etc/easyhaproxy/plugins)
abort_on_error: If True, abort on plugin errors; if False, log and continue
"""
self.plugins_dir = plugins_dir or os.getenv(
"EASYHAPROXY_PLUGINS_DIR",
- "/etc/haproxy/plugins"
+ Consts.base_path + "/plugins"
)
self.abort_on_error = abort_on_error
self.plugins: dict[str, PluginInterface] = {}
diff --git a/src/plugins/builtin/cloudflare.py b/src/plugins/builtin/cloudflare.py
index 9e57509..180e4e6 100644
--- a/src/plugins/builtin/cloudflare.py
+++ b/src/plugins/builtin/cloudflare.py
@@ -8,7 +8,7 @@ The plugin includes built-in Cloudflare IP ranges that are automatically
updated and written to the IP list file.
Configuration:
- - ip_list_path: Path to file containing Cloudflare IP ranges (default: /etc/haproxy/cloudflare_ips.lst)
+ - ip_list_path: Path to file containing Cloudflare IP ranges (default: /etc/easyhaproxy/cloudflare_ips.lst)
- ip_list: Base64-encoded list of IP ranges (one per line), takes precedence over ip_list_path
- use_builtin_ips: Use built-in Cloudflare IP ranges (default: true)
- update_log_format: Update HAProxy log format to show real visitor IP (default: true)
@@ -17,7 +17,7 @@ Example YAML config:
plugins:
cloudflare:
enabled: true
- ip_list_path: /etc/haproxy/cloudflare_ips.lst
+ ip_list_path: /etc/easyhaproxy/cloudflare_ips.lst
use_builtin_ips: true
update_log_format: true
@@ -32,7 +32,7 @@ Example Container Label:
HAProxy Config Generated:
# Cloudflare - Restore original visitor IP
- acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst
+ acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst
http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP) if from_cloudflare
http-request set-header X-Forwarded-For %[var(txn.real_ip)] if from_cloudflare
@@ -48,7 +48,7 @@ import sys
# Add parent directory to path for imports
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-from functions import logger_easyhaproxy
+from functions import logger_easyhaproxy, Consts
from plugins import InitializationResult, PluginContext, PluginInterface, PluginResult, PluginType, ResourceRequest
@@ -85,7 +85,7 @@ class CloudflarePlugin(PluginInterface):
]
def __init__(self):
- self.ip_list_path = "/etc/haproxy/cloudflare_ips.lst"
+ self.ip_list_path = Consts.base_path + "/cloudflare_ips.lst"
self.enabled = True
self.use_builtin_ips = True
self.update_log_format = True
diff --git a/src/plugins/builtin/fastcgi.py b/src/plugins/builtin/fastcgi.py
index a63a5a1..f99855e 100644
--- a/src/plugins/builtin/fastcgi.py
+++ b/src/plugins/builtin/fastcgi.py
@@ -10,7 +10,7 @@ The plugin creates:
Configuration:
- enabled: Enable/disable the plugin (default: true)
- - document_root: Document root path (default: /var/www/html)
+ - document_root: Document root path (default: /etc/easyhaproxy/www)
- script_filename: Pattern for SCRIPT_FILENAME (default: %[path])
- index_file: Default index file (default: index.php)
- path_info: Enable PATH_INFO support (default: true)
@@ -39,6 +39,8 @@ Example Kubernetes Annotation:
import os
import sys
+from functions import Consts
+
# Add parent directory to path for imports
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
@@ -50,7 +52,7 @@ class FastcgiPlugin(PluginInterface):
def __init__(self):
self.enabled = True
- self.document_root = "/var/www/html"
+ self.document_root = Consts.base_path + "/www"
self.script_filename = "%[path]"
self.index_file = "index.php"
self.path_info = True
diff --git a/src/plugins/builtin/jwt_validator.py b/src/plugins/builtin/jwt_validator.py
index 3901e1d..1187ec0 100644
--- a/src/plugins/builtin/jwt_validator.py
+++ b/src/plugins/builtin/jwt_validator.py
@@ -47,7 +47,7 @@ Example YAML config:
algorithm: RS256
issuer: https://myaccount.auth0.com/
audience: https://api.mywebsite.com
- pubkey_path: /etc/haproxy/jwt_keys/pubkey.pem
+ pubkey_path: /etc/easyhaproxy/jwt_keys/pubkey.pem
paths:
- /api/admin
- /api/sensitive
@@ -58,7 +58,7 @@ Example Container Label:
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
easyhaproxy.http.plugin.jwt_validator.paths: /api/admin,/api/sensitive
easyhaproxy.http.plugin.jwt_validator.only_paths: true
@@ -86,7 +86,7 @@ HAProxy Config Generated:
http-request deny content-type 'text/html' string 'Unsupported JWT signing algorithm' unless { var(txn.alg) -m str RS256 }
http-request deny content-type 'text/html' string 'Invalid JWT issuer' unless { var(txn.iss) -m str https://auth.example.com/ }
http-request deny content-type 'text/html' string 'Invalid JWT audience' unless { var(txn.aud) -m str https://api.example.com }
- http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem") -m int 1 }
+ http-request deny content-type 'text/html' string 'Invalid JWT signature' unless { http_auth_bearer,jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem") -m int 1 }
# Validate expiration
http-request set-var(txn.now) date()
@@ -100,7 +100,7 @@ import sys
# Add parent directory to path for imports
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-from functions import Functions, logger_easyhaproxy
+from functions import Functions, logger_easyhaproxy, Consts
from plugins import InitializationResult, PluginContext, PluginInterface, PluginResult, PluginType, ResourceRequest
@@ -118,7 +118,7 @@ class JwtValidatorPlugin(PluginInterface):
self.only_paths = False # If true, only specified paths are accessible
self.allow_anonymous = False # If true, allow requests without Authorization header
# Make JWT_KEYS_DIR configurable via environment variable (for testing)
- self.jwt_keys_dir = os.getenv("EASYHAPROXY_JWT_KEYS_DIR", "/etc/haproxy/jwt_keys")
+ self.jwt_keys_dir = os.getenv("EASYHAPROXY_JWT_KEYS_DIR", Consts.base_path + "/jwt_keys")
@property
def name(self) -> str:
diff --git a/src/templates/bind.j2 b/src/templates/bind.j2
index d69de8f..a4b879d 100644
--- a/src/templates/bind.j2
+++ b/src/templates/bind.j2
@@ -1,5 +1,5 @@
{% if "ssl" in o %}
- bind *:{{ o["port"] }} ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+ bind *:{{ o["port"] }} ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
{% elif "h2" in o and o["h2"] %}
bind *:{{ o["port"] }} proto h2
option http-use-htx
diff --git a/src/templates/haproxy.cfg.j2 b/src/templates/haproxy.cfg.j2
index a50ac50..86eb965 100644
--- a/src/templates/haproxy.cfg.j2
+++ b/src/templates/haproxy.cfg.j2
@@ -31,13 +31,13 @@ defaults
timeout client 10s
timeout server 10m
{% if data["customerrors"] %}
- errorfile 400 /etc/haproxy/errors-custom/400.http
- errorfile 403 /etc/haproxy/errors-custom/403.http
- errorfile 408 /etc/haproxy/errors-custom/408.http
- errorfile 500 /etc/haproxy/errors-custom/500.http
- errorfile 502 /etc/haproxy/errors-custom/502.http
- errorfile 503 /etc/haproxy/errors-custom/503.http
- errorfile 504 /etc/haproxy/errors-custom/504.http
+ errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+ errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+ errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+ errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+ errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+ errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+ errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
{% endif %}
{% if defaults_plugin_configs %}
diff --git a/src/templates/ssl_default.j2 b/src/templates/ssl_default.j2
index 0357561..8548b23 100644
--- a/src/templates/ssl_default.j2
+++ b/src/templates/ssl_default.j2
@@ -9,4 +9,4 @@
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
diff --git a/src/templates/ssl_loose.j2 b/src/templates/ssl_loose.j2
index 0dafc55..6a244f9 100644
--- a/src/templates/ssl_loose.j2
+++ b/src/templates/ssl_loose.j2
@@ -6,5 +6,5 @@
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam-1024
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..99c67ce
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,43 @@
+"""
+Pytest configuration and fixtures for EasyHAProxy tests.
+
+This module provides session-wide and function-level fixtures for testing.
+"""
+
+import os
+import shutil
+import tempfile
+import pytest
+
+
+# Create a session-wide temporary directory for all tests
+# Use a different prefix to avoid conflicts with cleanup plugin (which looks for "easyhaproxy_*")
+_test_session_dir = tempfile.mkdtemp(prefix="pytest_easyhaproxy_")
+os.environ["EASYHAPROXY_BASE_PATH"] = _test_session_dir
+
+
+@pytest.fixture(scope="function", autouse=True)
+def reset_consts():
+ """
+ Reset Consts before and after each test.
+
+ This ensures:
+ 1. Each test picks up the EASYHAPROXY_BASE_PATH environment variable
+ 2. Tests don't get permission errors trying to write to /etc/easyhaproxy/
+ 3. Consts path cache is cleared between tests for isolation
+ """
+ from functions import Consts
+ Consts.reset()
+ yield
+ Consts.reset()
+
+
+def pytest_sessionfinish(session, exitstatus):
+ """
+ Cleanup session temporary directory after all tests complete.
+ """
+ try:
+ shutil.rmtree(_test_session_dir)
+ except Exception:
+ # Ignore cleanup errors
+ pass
\ No newline at end of file
diff --git a/tests/expected/docker.txt b/tests/expected/docker.txt
index 536d339..215f21f 100644
--- a/tests/expected/docker.txt
+++ b/tests/expected/docker.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
@@ -38,7 +38,7 @@ backend srv_stats
server Local 127.0.0.1:1936
frontend http_in_443
- bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+ bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local
diff --git a/tests/expected/no-services.txt b/tests/expected/no-services.txt
index a898508..0fb7fe8 100644
--- a/tests/expected/no-services.txt
+++ b/tests/expected/no-services.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
diff --git a/tests/expected/services-fcgi.txt b/tests/expected/services-fcgi.txt
index f7c1bf5..6051ee0 100644
--- a/tests/expected/services-fcgi.txt
+++ b/tests/expected/services-fcgi.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
diff --git a/tests/expected/services-letsencrypt.txt b/tests/expected/services-letsencrypt.txt
index ffb28c6..8a4110d 100644
--- a/tests/expected/services-letsencrypt.txt
+++ b/tests/expected/services-letsencrypt.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
@@ -21,13 +21,13 @@ defaults
timeout connect 3s
timeout client 10s
timeout server 10m
- errorfile 400 /etc/haproxy/errors-custom/400.http
- errorfile 403 /etc/haproxy/errors-custom/403.http
- errorfile 408 /etc/haproxy/errors-custom/408.http
- errorfile 500 /etc/haproxy/errors-custom/500.http
- errorfile 502 /etc/haproxy/errors-custom/502.http
- errorfile 503 /etc/haproxy/errors-custom/503.http
- errorfile 504 /etc/haproxy/errors-custom/504.http
+ errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+ errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+ errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+ errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+ errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+ errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+ errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
frontend stats
@@ -76,7 +76,7 @@ backend srv_test2_example_org_80
server srv-0 83d57d592e26:8080 check weight 1
frontend http_in_443
- bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+ bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org
diff --git a/tests/expected/services-multi-containers.txt b/tests/expected/services-multi-containers.txt
index 0cfedd8..6517bb7 100644
--- a/tests/expected/services-multi-containers.txt
+++ b/tests/expected/services-multi-containers.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
diff --git a/tests/expected/services-multiple-hosts.txt b/tests/expected/services-multiple-hosts.txt
index 0b3a64d..a49a0e0 100644
--- a/tests/expected/services-multiple-hosts.txt
+++ b/tests/expected/services-multiple-hosts.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
@@ -21,13 +21,13 @@ defaults
timeout connect 3s
timeout client 10s
timeout server 10m
- errorfile 400 /etc/haproxy/errors-custom/400.http
- errorfile 403 /etc/haproxy/errors-custom/403.http
- errorfile 408 /etc/haproxy/errors-custom/408.http
- errorfile 500 /etc/haproxy/errors-custom/500.http
- errorfile 502 /etc/haproxy/errors-custom/502.http
- errorfile 503 /etc/haproxy/errors-custom/503.http
- errorfile 504 /etc/haproxy/errors-custom/504.http
+ errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+ errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+ errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+ errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+ errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+ errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+ errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
frontend stats
diff --git a/tests/expected/services-redirect-ssl.txt b/tests/expected/services-redirect-ssl.txt
index 8c51afc..57b1091 100644
--- a/tests/expected/services-redirect-ssl.txt
+++ b/tests/expected/services-redirect-ssl.txt
@@ -9,7 +9,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam-1024
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
defaults
@@ -50,7 +50,7 @@ backend srv_host1_local_80
server srv-0 5b69bc7fea1b:80 check weight 1
frontend http_in_443
- bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+ bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_host2_local_443_1 hdr(host) -i host2.local
diff --git a/tests/expected/services-tcp.txt b/tests/expected/services-tcp.txt
index f9a41bd..f5422e0 100644
--- a/tests/expected/services-tcp.txt
+++ b/tests/expected/services-tcp.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
diff --git a/tests/expected/services.txt b/tests/expected/services.txt
index 2c876f9..df0bba0 100644
--- a/tests/expected/services.txt
+++ b/tests/expected/services.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
@@ -68,7 +68,7 @@ backend srv_node-exporter_quantum_example_org_31337
server srv-0 my-stack_node-exporter:9100 check weight 1
frontend http_in_443
- bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+ bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
diff --git a/tests/expected/ssl-loose.txt b/tests/expected/ssl-loose.txt
index e9cb61f..3aeae3c 100644
--- a/tests/expected/ssl-loose.txt
+++ b/tests/expected/ssl-loose.txt
@@ -9,7 +9,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam-1024
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
defaults
diff --git a/tests/expected/static.txt b/tests/expected/static.txt
index ad98988..b10f8ac 100644
--- a/tests/expected/static.txt
+++ b/tests/expected/static.txt
@@ -12,7 +12,7 @@ global
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
- ssl-dh-param-file /etc/haproxy/dhparam
+ ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
defaults
log global
@@ -21,13 +21,13 @@ defaults
timeout connect 3s
timeout client 10s
timeout server 10m
- errorfile 400 /etc/haproxy/errors-custom/400.http
- errorfile 403 /etc/haproxy/errors-custom/403.http
- errorfile 408 /etc/haproxy/errors-custom/408.http
- errorfile 500 /etc/haproxy/errors-custom/500.http
- errorfile 502 /etc/haproxy/errors-custom/502.http
- errorfile 503 /etc/haproxy/errors-custom/503.http
- errorfile 504 /etc/haproxy/errors-custom/504.http
+ errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
+ errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
+ errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
+ errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
+ errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
+ errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
+ errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
frontend stats
@@ -46,7 +46,7 @@ backend srv_stats
server Local 127.0.0.1:1936
frontend http_in_443
- bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
+ bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
diff --git a/tests/fixtures/services-with-multiple-plugins b/tests/fixtures/services-with-multiple-plugins
index 1b13766..c57c6ab 100644
--- a/tests/fixtures/services-with-multiple-plugins
+++ b/tests/fixtures/services-with-multiple-plugins
@@ -4,7 +4,6 @@
"easyhaproxy.http.port": "80",
"easyhaproxy.http.localport": "8080",
"easyhaproxy.http.plugins": "cloudflare,deny_pages",
- "easyhaproxy.http.plugin.cloudflare.ip_list_path": "/etc/haproxy/cloudflare_ips.lst",
"easyhaproxy.http.plugin.deny_pages.paths": "/admin,/private",
"easyhaproxy.http.plugin.deny_pages.status_code": "403"
}
diff --git a/tests/test_daemonize.py b/tests/test_daemonize.py
index 2612adf..6ddb9f7 100644
--- a/tests/test_daemonize.py
+++ b/tests/test_daemonize.py
@@ -1,4 +1,5 @@
import os
+from functions import Consts
from functions import DaemonizeHAProxy
@@ -15,12 +16,12 @@ def test_daemonize_haproxy_check_config():
def test_daemonize_haproxy_get_haproxy_command_start():
daemon = DaemonizeHAProxy()
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START)
- assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock"
+ assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /run/haproxy.pid -S /var/run/haproxy.sock"
def test_daemonize_haproxy_get_haproxy_command_reload_nopid():
daemon = DaemonizeHAProxy()
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD)
- assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock"
+ assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /run/haproxy.pid -S /var/run/haproxy.sock"
def test_daemonize_haproxy_get_haproxy_command_reload_pidinvalid():
daemon = DaemonizeHAProxy()
@@ -28,7 +29,7 @@ def test_daemonize_haproxy_get_haproxy_command_reload_pidinvalid():
with open("/tmp/temp.pid", 'w') as file:
file.write("-1001")
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD, "/tmp/temp.pid")
- assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /tmp/temp.pid -S /var/run/haproxy.sock"
+ assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /tmp/temp.pid -S /var/run/haproxy.sock"
finally:
assert not os.path.exists("/tmp/temp.pid")
@@ -38,7 +39,7 @@ def test_daemonize_haproxy_get_haproxy_command_reload_existing_pin():
with open("/tmp/temp.pid", 'w') as file:
file.write("1")
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD, "/tmp/temp.pid")
- assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /tmp/temp.pid -x /var/run/haproxy.sock -sf 1"
+ assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /tmp/temp.pid -x /var/run/haproxy.sock -sf 1"
finally:
assert os.path.exists("/tmp/temp.pid")
os.unlink("/tmp/temp.pid")
@@ -54,4 +55,4 @@ def test_daemonize_haproxy2_check_config():
def test_daemonize_haproxy2_get_haproxy_command_start():
daemon = DaemonizeHAProxy(os.path.abspath(os.path.dirname(__file__)) + '/fixtures')
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START)
- assert command == f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f {os.path.dirname(__file__)}/fixtures -p /run/haproxy.pid -S /var/run/haproxy.sock"
+ assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -f {os.path.dirname(__file__)}/fixtures -p /run/haproxy.pid -S /var/run/haproxy.sock"
diff --git a/tests/test_plugins.py b/tests/test_plugins.py
index 72ff173..2cb7f40 100644
--- a/tests/test_plugins.py
+++ b/tests/test_plugins.py
@@ -17,6 +17,7 @@ import time
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
import easymapping
+from functions import Consts
from plugins import PluginContext, PluginManager
from plugins.builtin.cleanup import CleanupPlugin
from plugins.builtin.cloudflare import CloudflarePlugin
@@ -43,7 +44,7 @@ class TestCloudflarePlugin:
assert plugin.name == "cloudflare"
assert plugin.enabled is True
assert plugin.use_builtin_ips is True
- assert plugin.ip_list_path == "/etc/haproxy/cloudflare_ips.lst"
+ assert plugin.ip_list_path == f"{Consts.base_path}/cloudflare_ips.lst"
assert len(plugin.CLOUDFLARE_IPS) == 22 # 15 IPv4 + 7 IPv6
def test_cloudflare_plugin_configuration(self):
@@ -85,11 +86,11 @@ class TestCloudflarePlugin:
assert result.haproxy_config is not None
assert "Cloudflare" in result.haproxy_config
- assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in result.haproxy_config
+ assert f"acl from_cloudflare src -f {Consts.base_path}/cloudflare_ips.lst" in result.haproxy_config
assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP)" in result.haproxy_config
assert "http-request set-header X-Forwarded-For %[var(txn.real_ip)]" in result.haproxy_config
assert result.metadata["domain"] == "example.com"
- assert result.metadata["ip_list_path"] == "/etc/haproxy/cloudflare_ips.lst"
+ assert result.metadata["ip_list_path"] == f"{Consts.base_path}/cloudflare_ips.lst"
def test_cloudflare_plugin_disabled(self):
"""Test plugin returns empty config when disabled"""
@@ -123,7 +124,7 @@ class TestCloudflarePlugin:
# Verify Cloudflare config is in the output
assert "Cloudflare - Restore original visitor IP" in haproxy_config
- assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in haproxy_config
+ assert f"acl from_cloudflare src -f {Consts.base_path}/cloudflare_ips.lst" in haproxy_config
assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP)" in haproxy_config
assert "http-request set-header X-Forwarded-For %[var(txn.real_ip)]" in haproxy_config
# Verify log-format is in defaults section (from defaults_configs)
@@ -688,7 +689,7 @@ class TestJwtValidatorPlugin:
"algorithm": "RS256",
"issuer": "https://auth.example.com/",
"audience": "https://api.example.com",
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
})
context = PluginContext(
@@ -712,7 +713,7 @@ class TestJwtValidatorPlugin:
assert "var(txn.alg) -m str RS256" in result.haproxy_config
assert "var(txn.iss) -m str https://auth.example.com/" in result.haproxy_config
assert "var(txn.aud) -m str https://api.example.com" in result.haproxy_config
- assert 'jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem")' in result.haproxy_config
+ assert f'jwt_verify(txn.alg,"{Consts.base_path}/jwt_keys/api_pubkey.pem")' in result.haproxy_config
assert "JWT has expired" in result.haproxy_config
assert result.metadata["domain"] == "api.example.com"
assert result.metadata["algorithm"] == "RS256"
@@ -742,7 +743,7 @@ class TestJwtValidatorPlugin:
assert result.haproxy_config is not None
assert "JWT Validator" in result.haproxy_config
- assert "/etc/haproxy/jwt_keys/api_example_com_pubkey.pem" in result.haproxy_config
+ assert f"{Consts.base_path}/jwt_keys/api_example_com_pubkey.pem" in result.haproxy_config
# Verify the decoded content is stored in metadata
assert result.metadata["pubkey_content"] == "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqh...\n-----END PUBLIC KEY-----"
@@ -750,7 +751,7 @@ class TestJwtValidatorPlugin:
"""Test plugin skips issuer/audience validation when not configured"""
plugin = JwtValidatorPlugin()
plugin.configure({
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
})
context = PluginContext(
@@ -775,7 +776,7 @@ class TestJwtValidatorPlugin:
plugin = JwtValidatorPlugin()
plugin.configure({
"enabled": "false",
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
})
context = PluginContext(
@@ -826,7 +827,7 @@ class TestJwtValidatorPlugin:
"""Test plugin with paths configured and only_paths=false"""
plugin = JwtValidatorPlugin()
plugin.configure({
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
"paths": ["/api/admin", "/api/sensitive"],
"only_paths": "false"
})
@@ -860,7 +861,7 @@ class TestJwtValidatorPlugin:
"""Test plugin with paths configured and only_paths=true"""
plugin = JwtValidatorPlugin()
plugin.configure({
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
"paths": ["/api/public"],
"only_paths": "true"
})
@@ -894,7 +895,7 @@ class TestJwtValidatorPlugin:
"""Test plugin parses comma-separated paths from container labels"""
plugin = JwtValidatorPlugin()
plugin.configure({
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
"paths": "/api/admin,/api/sensitive,/api/protected"
})
@@ -904,7 +905,7 @@ class TestJwtValidatorPlugin:
"""Test plugin parses paths from list (YAML config)"""
plugin = JwtValidatorPlugin()
plugin.configure({
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
"paths": ["/api/admin", "/api/sensitive"]
})
@@ -914,7 +915,7 @@ class TestJwtValidatorPlugin:
"""Test plugin protects all paths when paths is not configured"""
plugin = JwtValidatorPlugin()
plugin.configure({
- "pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ "pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
})
context = PluginContext(
@@ -947,7 +948,7 @@ class TestFastcgiPlugin:
assert plugin.name == "fastcgi"
assert plugin.enabled is True
- assert plugin.document_root == "/var/www/html"
+ assert plugin.document_root == f"{Consts.base_path}/www"
assert plugin.index_file == "index.php"
assert plugin.path_info is True
assert plugin.custom_params == {}
@@ -969,7 +970,7 @@ class TestFastcgiPlugin:
"""Test plugin generates correct HAProxy config"""
plugin = FastcgiPlugin()
plugin.configure({
- "document_root": "/var/www/html",
+ "document_root": f"{Consts.base_path}/www",
"index_file": "index.php"
})
@@ -991,9 +992,9 @@ class TestFastcgiPlugin:
assert len(result.global_configs) == 1
fcgi_app_def = result.global_configs[0]
assert "fcgi-app fcgi_phpapp_local" in fcgi_app_def
- assert "docroot /var/www/html" in fcgi_app_def
+ assert f"docroot {Consts.base_path}/www" in fcgi_app_def
assert "index index.php" in fcgi_app_def
- assert result.metadata["document_root"] == "/var/www/html"
+ assert result.metadata["document_root"] == f"{Consts.base_path}/www"
assert result.metadata["index_file"] == "index.php"
def test_fastcgi_plugin_custom_params(self):
diff --git a/tests_e2e/docker/docker-compose-acme-e2e.yml b/tests_e2e/docker/docker-compose-acme-e2e.yml
index 88c2686..2bde350 100644
--- a/tests_e2e/docker/docker-compose-acme-e2e.yml
+++ b/tests_e2e/docker/docker-compose-acme-e2e.yml
@@ -5,7 +5,7 @@
# WHAT THIS TESTS:
# - HAProxy routing of /.well-known/acme-challenge/ to certbot backend
# - Certbot HTTP-01 challenge completion with Pebble ACME server
-# - Certificate issuance and storage in /certs/certbot/live/{domain}/
+# - Certificate issuance and storage in /etc/easyhaproxy/certs/live/{domain}/
# - HTTPS serving with issued certificate
# - Full end-to-end ACME protocol flow
#
@@ -32,7 +32,7 @@
# docker compose -f docker-compose-acme-e2e.yml logs haproxy
#
# # Verify certificate was issued
-# ls -la ../../certs/certbot/live/test.local/
+# ls -la ../../certs/live/test.local/
#
# # Test HTTPS (will show certificate warning - expected for test certs)
# curl -k https://localhost/ -H "Host: test.local"
@@ -104,7 +104,7 @@ services:
volumes:
- /var/run/docker.sock:/var/run/docker.sock
# Certificate storage (Docker volume for clean test isolation)
- - certbot-certs:/certs/certbot
+ - certbot-certs:/etc/easyhaproxy/certs
# Pebble CA certificate (downloaded during test session)
- ./pebble-ca.pem:/etc/ssl/certs/pebble-ca.pem:ro
ports:
diff --git a/tests_e2e/docker/docker-compose-acme.yml b/tests_e2e/docker/docker-compose-acme.yml
index 5137ea8..df37d96 100644
--- a/tests_e2e/docker/docker-compose-acme.yml
+++ b/tests_e2e/docker/docker-compose-acme.yml
@@ -20,7 +20,7 @@
# # - Line 36: easyhaproxy.http.host to your real domain
#
# # Create certs directory
-# mkdir -p ./certs/certbot
+# mkdir -p ./certs
# ```
#
# HOW TO START:
@@ -43,7 +43,7 @@
# # Expected: Issuer: C = US, O = Let's Encrypt
#
# # Check certificate files
-# ls -la ./certs/certbot/
+# ls -la ./certs/
# # Expected: Your domain certificate files
# ```
#
@@ -53,7 +53,7 @@
# # Keep certificates:
# # docker compose -f docker-compose-acme.yml down
# # Remove certificates too:
-# # docker compose -f docker-compose-acme.yml down && rm -rf ./certs/certbot
+# # docker compose -f docker-compose-acme.yml down && rm -rf ./certs
# ```
#
# ==============================================================================
@@ -64,7 +64,7 @@ services:
volumes:
- /var/run/docker.sock:/var/run/docker.sock
# Persist the CERTBOT to avoid re-challenge when the server restarts
- - ./certs/certbot:/certs/certbot
+ - ./certs:/etc/easyhaproxy/certs
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
diff --git a/tests_e2e/docker/docker-compose-cloudflare.yml b/tests_e2e/docker/docker-compose-cloudflare.yml
index aa0d456..13a96d9 100644
--- a/tests_e2e/docker/docker-compose-cloudflare.yml
+++ b/tests_e2e/docker/docker-compose-cloudflare.yml
@@ -53,7 +53,7 @@ services:
volumes:
- /var/run/docker.sock:/var/run/docker.sock
# Mount Cloudflare IP list
- - ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
+ - ./cloudflare_ips.lst:/etc/easyhaproxy/cloudflare_ips.lst:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
@@ -77,4 +77,4 @@ services:
# Use custom IP list (disable built-in IPs)
easyhaproxy.http.plugin.cloudflare.use_builtin_ips: false
- easyhaproxy.http.plugin.cloudflare.ip_list_path: /etc/haproxy/cloudflare_ips.lst
+ easyhaproxy.http.plugin.cloudflare.ip_list_path: /etc/easyhaproxy/cloudflare_ips.lst
diff --git a/tests_e2e/docker/docker-compose-jwt-validator.yml b/tests_e2e/docker/docker-compose-jwt-validator.yml
index d2dd636..019e1c9 100644
--- a/tests_e2e/docker/docker-compose-jwt-validator.yml
+++ b/tests_e2e/docker/docker-compose-jwt-validator.yml
@@ -57,7 +57,7 @@ services:
volumes:
- /var/run/docker.sock:/var/run/docker.sock
# Mount the public key for JWT verification
- - ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
@@ -85,4 +85,4 @@ services:
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
diff --git a/tests_e2e/docker/docker-compose-plugins-combined.yml b/tests_e2e/docker/docker-compose-plugins-combined.yml
index ec26370..75a582c 100644
--- a/tests_e2e/docker/docker-compose-plugins-combined.yml
+++ b/tests_e2e/docker/docker-compose-plugins-combined.yml
@@ -68,8 +68,8 @@ services:
image: byjg/easy-haproxy:local
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- - ./cloudflare_ips.lst:/etc/haproxy/cloudflare_ips.lst:ro
- - ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
+ - ./cloudflare_ips.lst:/etc/easyhaproxy/cloudflare_ips.lst:ro
+ - ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
environment:
EASYHAPROXY_DISCOVER: docker
HAPROXY_CUSTOMERRORS: "true"
@@ -114,7 +114,7 @@ services:
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
- easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
# Block internal/debug endpoints
easyhaproxy.http.plugin.deny_pages.paths: /internal,/debug,/metrics
diff --git a/tests_e2e/docker/docker-compose-portainer.yml b/tests_e2e/docker/docker-compose-portainer.yml
index 07a279c..3b582d8 100644
--- a/tests_e2e/docker/docker-compose-portainer.yml
+++ b/tests_e2e/docker/docker-compose-portainer.yml
@@ -62,8 +62,8 @@ services:
image: byjg/easy-haproxy:5.0.0
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- - certs_certbot:/certs/certbot
-# - certs_haproxy:/certs/haproxy
+ - certs_certbot:/etc/easyhaproxy/certs/certbot
+# - certs_haproxy:/etc/easyhaproxy/certs/haproxy
environment:
EASYHAPROXY_DISCOVER: docker
diff --git a/tests_e2e/docker/docker-compose.yml b/tests_e2e/docker/docker-compose.yml
index 460855c..431e2c9 100644
--- a/tests_e2e/docker/docker-compose.yml
+++ b/tests_e2e/docker/docker-compose.yml
@@ -54,7 +54,7 @@ services:
image: byjg/easy-haproxy:local
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- - ./host2.local.pem:/certs/haproxy/host2.local.pem
+ - ./host2.local.pem:/etc/easyhaproxy/certs/haproxy/host2.local.pem
environment:
EASYHAPROXY_DISCOVER: docker
EASYHAPROXY_SSL_MODE: "loose"
diff --git a/tests_e2e/kubernetes/cloudflare.yml b/tests_e2e/kubernetes/cloudflare.yml
index f2d14f6..77c3e25 100644
--- a/tests_e2e/kubernetes/cloudflare.yml
+++ b/tests_e2e/kubernetes/cloudflare.yml
@@ -27,7 +27,7 @@
# # Edit your EasyHAProxy deployment and add:
# # volumeMounts:
# # - name: cloudflare-ips
-# # mountPath: /etc/haproxy/cloudflare_ips.lst
+# # mountPath: /etc/easyhaproxy/cloudflare_ips.lst
# # subPath: cloudflare_ips.lst
# # volumes:
# # - name: cloudflare-ips
@@ -121,7 +121,7 @@ metadata:
# easyhaproxy.plugin.cloudflare.ip_list: "MTAuMC4wLjAvOAoxNzIuMTYuMC4wLzEyCjE5Mi4xNjguMC4wLzE2CjEyNy4wLjAuMQ=="
# Optional: Specify custom IP list file path (only used if ip_list is not provided)
- # easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
+ # easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/easyhaproxy/cloudflare_ips.lst"
name: webapp-ingress-cloudflare
namespace: default
spec:
diff --git a/tests_e2e/kubernetes/jwt-validator.yml b/tests_e2e/kubernetes/jwt-validator.yml
index c31077a..adafc22 100644
--- a/tests_e2e/kubernetes/jwt-validator.yml
+++ b/tests_e2e/kubernetes/jwt-validator.yml
@@ -6,7 +6,7 @@
# There are three ways to provide the JWT public key:
#
# 1. pubkey_path - Mount a file and reference the path (requires ConfigMap or Volume)
-# easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+# easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
#
# 2. k8s_secret.pubkey - Reference a Kubernetes secret (RECOMMENDED)
# Auto-detect key (tries common variations):
@@ -141,7 +141,7 @@ metadata:
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
- easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
name: api-ingress-jwt
namespace: default
spec:
diff --git a/tests_e2e/kubernetes/plugins-combined.yml b/tests_e2e/kubernetes/plugins-combined.yml
index fc9ea74..324eadb 100644
--- a/tests_e2e/kubernetes/plugins-combined.yml
+++ b/tests_e2e/kubernetes/plugins-combined.yml
@@ -187,7 +187,7 @@ metadata:
easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
- easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
+ easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/easyhaproxy/jwt_keys/api_pubkey.pem"
# Block internal paths
easyhaproxy.plugin.deny_pages.paths: "/internal,/debug,/metrics"
easyhaproxy.plugin.deny_pages.status_code: "403"
diff --git a/tests_e2e/static/README.md b/tests_e2e/static/README.md
index 3955368..a4374a6 100644
--- a/tests_e2e/static/README.md
+++ b/tests_e2e/static/README.md
@@ -18,7 +18,7 @@ Static mode uses explicit YAML configuration files instead of dynamic service di
## Configuration Files
-All scenarios use `/etc/haproxy/static/config.yml` mounted from `./conf/config.yml`.
+All scenarios use `/etc/easyhaproxy/static/config.yml` mounted from `./conf/config.yml`.
Choose one of these pre-made configurations:
diff --git a/tests_e2e/static/conf/config-basic.yml b/tests_e2e/static/conf/config-basic.yml
index e1808b0..c7573a8 100644
--- a/tests_e2e/static/conf/config-basic.yml
+++ b/tests_e2e/static/conf/config-basic.yml
@@ -5,8 +5,8 @@
#
# To use:
# 1. Update the container name and ports to match your setup
-# 2. Place SSL certificate at /certs/haproxy/host1.local.pem
-# 3. Mount this config: -v ./conf/config-basic.yml:/etc/haproxy/static/config.yml
+# 2. Place SSL certificate at /etc/easyhaproxy/certs/haproxy/host1.local.pem
+# 3. Mount this config: -v ./conf/config-basic.yml:/etc/easyhaproxy/static/config.yml
stats:
username: admin
diff --git a/tests_e2e/static/conf/config-certbot.yml b/tests_e2e/static/conf/config-certbot.yml
index 36201f3..216da88 100644
--- a/tests_e2e/static/conf/config-certbot.yml
+++ b/tests_e2e/static/conf/config-certbot.yml
@@ -15,14 +15,14 @@
# EASYHAPROXY_CERTBOT_EMAIL=your-email@example.com
#
# 4. Mount this config:
-# -v ./conf/config-certbot.yml:/etc/haproxy/static/config.yml
+# -v ./conf/config-certbot.yml:/etc/easyhaproxy/static/config.yml
#
# 5. Persist certificates:
-# -v ./certs/certbot:/certs/certbot
+# -v ./etc/easyhaproxy/certs/certbot:/etc/easyhaproxy/certs/certbot
#
# How it works:
# - EasyHAProxy requests certificates from Let's Encrypt via HTTP-01 challenge
-# - Certificates are stored in /certs/certbot/
+# - Certificates are stored in /etc/easyhaproxy/certs/certbot/
# - Certificates auto-renew when needed
#
# Note: Let's Encrypt has rate limits. Use staging environment for testing:
@@ -56,7 +56,7 @@ containers:
# Domain without certbot (uses custom certificate)
"custom.example.com:80":
ip: ["custom-app:8080"]
- # No certbot - expects certificate at /certs/haproxy/custom.example.com.pem
+ # No certbot - expects certificate at /etc/easyhaproxy/certs/haproxy/custom.example.com.pem
# HTTPS Port 443
# Serves HTTPS traffic with auto-generated certificates
@@ -65,7 +65,7 @@ containers:
ip: ["webapp:8080"]
ssl: true
# Certificate path (auto-generated by certbot)
- # /certs/certbot/example.com/fullchain.pem
+ # /etc/easyhaproxy/certs/certbot/example.com/fullchain.pem
"app.example.com:443":
ip: ["app:3000"]
@@ -76,7 +76,7 @@ containers:
ip: ["custom-app:8080"]
ssl: true
# Place your certificate at:
- # /certs/haproxy/custom.example.com.pem
+ # /etc/easyhaproxy/certs/haproxy/custom.example.com.pem
# Multiple domains with different backends
# Certbot will request separate certificates for each domain
diff --git a/tests_e2e/static/conf/config-deny-pages.yml b/tests_e2e/static/conf/config-deny-pages.yml
index 01309a2..7afec5e 100644
--- a/tests_e2e/static/conf/config-deny-pages.yml
+++ b/tests_e2e/static/conf/config-deny-pages.yml
@@ -6,7 +6,7 @@
#
# To use:
# 1. Update container names and ports
-# 2. Mount this config: -v ./conf/config-deny-pages.yml:/etc/haproxy/static/config.yml
+# 2. Mount this config: -v ./conf/config-deny-pages.yml:/etc/easyhaproxy/static/config.yml
# 3. Test blocked paths:
# curl http://host1.local/admin # Should return 404
# curl http://host2.local/wp-admin # Should return 403 (different config)
diff --git a/tests_e2e/static/conf/config-jwt-validator.yml b/tests_e2e/static/conf/config-jwt-validator.yml
index 91bf1ed..4fcb560 100644
--- a/tests_e2e/static/conf/config-jwt-validator.yml
+++ b/tests_e2e/static/conf/config-jwt-validator.yml
@@ -11,11 +11,11 @@
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
#
# 2. Mount public keys:
-# -v ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
-# -v ./jwt_pubkey2.pem:/etc/haproxy/jwt_keys/admin_pubkey.pem:ro
+# -v ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
+# -v ./jwt_pubkey2.pem:/etc/easyhaproxy/jwt_keys/admin_pubkey.pem:ro
#
# 3. Mount this config:
-# -v ./conf/config-jwt-validator.yml:/etc/haproxy/static/config.yml
+# -v ./conf/config-jwt-validator.yml:/etc/easyhaproxy/static/config.yml
#
# 4. Test:
# # Without token - should fail
@@ -42,7 +42,7 @@ containers:
algorithm: RS256
issuer: https://auth.example.com/
audience: https://api.example.com
- pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
# Internal API - validate signature only (no issuer/audience check)
"internal-api.local:80":
@@ -52,7 +52,7 @@ containers:
jwt_validator:
algorithm: RS256
# No issuer/audience = skip those validations
- pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
+ pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
# Admin API - different issuer and key
"admin-api.local:80":
@@ -63,7 +63,7 @@ containers:
algorithm: RS256
issuer: https://admin-auth.example.com/
audience: https://admin.example.com
- pubkey_path: /etc/haproxy/jwt_keys/admin_pubkey.pem
+ pubkey_path: /etc/easyhaproxy/jwt_keys/admin_pubkey.pem
deny_pages:
paths:
- /internal
diff --git a/tests_e2e/static/docker-compose.yml b/tests_e2e/static/docker-compose.yml
index fc9ac41..832d2b4 100644
--- a/tests_e2e/static/docker-compose.yml
+++ b/tests_e2e/static/docker-compose.yml
@@ -5,7 +5,7 @@
# WHAT THIS DEMONSTRATES:
# - EasyHAProxy using static YAML configuration (no service discovery)
# - Useful for non-containerized backends, VMs, or bare metal servers
-# - Configuration via /etc/haproxy/static/config.yml
+# - Configuration via /etc/easyhaproxy/static/config.yml
#
# REQUIREMENTS (run these first):
# ```bash
@@ -65,10 +65,10 @@ services:
context: ../..
dockerfile: build/Dockerfile
volumes:
- - ./conf/:/etc/haproxy/static/
- - ../static/host1.local.pem:/certs/haproxy/host1.local.pem:ro
- - ../docker/jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
- - ../docker/jwt_pubkey.pem:/etc/haproxy/jwt_keys/admin_pubkey.pem:ro
+ - ./conf/:/etc/easyhaproxy/static/
+ - ../static/host1.local.pem:/etc/easyhaproxy/certs/haproxy/host1.local.pem:ro
+ - ../docker/jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
+ - ../docker/jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/admin_pubkey.pem:ro
- /var/run/docker.sock:/var/run/docker.sock
environment:
EASYHAPROXY_DISCOVER: static
diff --git a/tests_e2e/test_docker_compose.py b/tests_e2e/test_docker_compose.py
index 3a2bd4c..2d0a33d 100644
--- a/tests_e2e/test_docker_compose.py
+++ b/tests_e2e/test_docker_compose.py
@@ -201,7 +201,7 @@ class TestBasicSSL:
def test_haproxy_config(self, docker_compose_basic_ssl):
"""Test HAProxy configuration has SSL and redirect configurations"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -280,7 +280,7 @@ class TestJWTValidator:
def test_haproxy_config(self, docker_compose_jwt_validator):
"""Test HAProxy configuration has JWT validator rules in the correct backend"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -308,7 +308,7 @@ class TestJWTValidator:
assert "var(txn.aud) -m str https://api.example.com" in backend_block
# Verify JWT signature verification
- assert 'jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem")' in backend_block
+ assert 'jwt_verify(txn.alg,"/etc/easyhaproxy/jwt_keys/api_pubkey.pem")' in backend_block
# Verify expiration check
assert "JWT has expired" in backend_block
@@ -350,7 +350,7 @@ class TestMultiContainers:
def test_haproxy_config(self, docker_compose_multi_containers):
"""Test HAProxy configuration has multiple backend servers for load balancing"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -409,7 +409,7 @@ class TestPHPFPM:
def test_haproxy_config(self, docker_compose_php_fpm):
"""Test HAProxy configuration has FastCGI plugin configuration"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -495,7 +495,7 @@ class TestPluginsCombined:
def test_haproxy_config(self, docker_compose_plugins_combined):
"""Test HAProxy configuration has all plugin configurations in correct backends"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -506,7 +506,7 @@ class TestPluginsCombined:
website_block = extract_backend_block(config, "srv_website_local_80")
assert website_block, "Backend srv_website_local_80 not found"
assert "# Cloudflare - Restore original visitor IP" in website_block
- assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in website_block
+ assert "acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst" in website_block
assert "# Deny Pages - Block specific paths" in website_block
assert "acl denied_path path_beg /admin /wp-admin /wp-login.php /.env /config" in website_block
assert "http-request deny deny_status 404 if denied_path" in website_block
@@ -604,7 +604,7 @@ class TestIPWhitelist:
def test_haproxy_config(self, docker_compose_ip_whitelist):
"""Test HAProxy configuration has IP whitelist rules in the correct backend"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -657,7 +657,7 @@ class TestCloudflare:
def test_haproxy_config(self, docker_compose_cloudflare):
"""Test HAProxy configuration has Cloudflare plugin rules in the correct backend"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -672,7 +672,7 @@ class TestCloudflare:
assert "# Cloudflare - Restore original visitor IP" in backend_block
# Verify ACL for Cloudflare IPs
- assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in backend_block
+ assert "acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst" in backend_block
# Verify transaction variable for real IP
assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP) if from_cloudflare" in backend_block
@@ -767,7 +767,7 @@ class TestChangedLabel:
def test_haproxy_config(self, docker_compose_changed_label):
"""Test HAProxy configuration with custom label prefix"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -878,7 +878,7 @@ class TestACME:
def test_haproxy_config(self, docker_compose_acme):
"""Test HAProxy configuration has ACME challenge routing"""
result = subprocess.run(
- ["docker", "exec", "docker-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "docker-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -952,8 +952,8 @@ class TestACME:
f"HAProxy cannot connect to Pebble ACME server. Check docker network.\nLogs:\n{logs[-2000:]}"
# Verify merged certificate file exists
- # EasyHAProxy merges cert+key from /etc/letsencrypt/live/ to /certs/certbot/{domain}.pem
- merged_cert_path = "/certs/certbot/test.local.pem"
+ # EasyHAProxy merges cert+key from /etc/easyhaproxy/certs/live/ to /etc/easyhaproxy/certs/certbot/{domain}.pem
+ merged_cert_path = "/etc/easyhaproxy/certs/certbot/test.local.pem"
result = subprocess.run(
["docker", "exec", "docker-haproxy-1", "test", "-f", merged_cert_path],
capture_output=True
diff --git a/tests_e2e/test_kubernetes.py b/tests_e2e/test_kubernetes.py
index d475a89..b44d466 100644
--- a/tests_e2e/test_kubernetes.py
+++ b/tests_e2e/test_kubernetes.py
@@ -1145,7 +1145,7 @@ class TestIPWhitelist:
# Get HAProxy configuration
result = subprocess.run(
[kubectl, "exec", "-n", "easyhaproxy", pod_name,
- "--", "cat", "/etc/haproxy/haproxy.cfg"],
+ "--", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
check=True,
capture_output=True,
text=True
@@ -1292,7 +1292,7 @@ class TestJWTValidatorSecret:
# Get HAProxy configuration
result = subprocess.run(
[kubectl, "exec", "-n", "easyhaproxy", pod_name,
- "--", "cat", "/etc/haproxy/haproxy.cfg"],
+ "--", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
check=True,
capture_output=True,
text=True
@@ -1327,7 +1327,7 @@ class TestJWTValidatorSecret:
"JWT audience validation not found in API backend"
# Verify JWT keys directory is used in this backend
- assert "/etc/haproxy/jwt_keys/" in backend_block, \
+ assert "/etc/easyhaproxy/jwt_keys/" in backend_block, \
"JWT keys directory not found in API backend"
def test_access_without_token_denied(self, k8s_jwt_validator_secret):
@@ -1589,7 +1589,7 @@ class TestCloudflare:
# Get HAProxy configuration
result = subprocess.run(
[kubectl, "exec", "-n", "easyhaproxy", pod_name,
- "--", "cat", "/etc/haproxy/haproxy.cfg"],
+ "--", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
check=True,
capture_output=True,
text=True
@@ -1606,7 +1606,7 @@ class TestCloudflare:
"Cloudflare plugin comment not found in myapp backend"
# Verify ACL for Cloudflare IPs is in this backend
- assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in backend_block, \
+ assert "acl from_cloudflare src -f /etc/easyhaproxy/cloudflare_ips.lst" in backend_block, \
"Cloudflare IP ACL not found in myapp backend"
# Verify real IP extraction from CF-Connecting-IP header is in this backend
@@ -1639,7 +1639,7 @@ class TestCloudflare:
# Read the Cloudflare IP list file
result = subprocess.run(
[kubectl, "exec", "-n", "easyhaproxy", pod_name,
- "--", "cat", "/etc/haproxy/cloudflare_ips.lst"],
+ "--", "cat", "/etc/easyhaproxy/cloudflare_ips.lst"],
check=True,
capture_output=True,
text=True
diff --git a/tests_e2e/test_static.py b/tests_e2e/test_static.py
index 1747083..83438fa 100644
--- a/tests_e2e/test_static.py
+++ b/tests_e2e/test_static.py
@@ -101,7 +101,7 @@ class TestStaticBasic:
def test_haproxy_config(self, static_basic):
"""Test HAProxy configuration has SSL and redirect configurations"""
result = subprocess.run(
- ["docker", "exec", "static-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "static-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -155,7 +155,7 @@ class TestStaticDenyPages:
def test_haproxy_config(self, static_deny_pages):
"""Test HAProxy configuration has deny pages rules"""
result = subprocess.run(
- ["docker", "exec", "static-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "static-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
@@ -209,7 +209,7 @@ class TestStaticJWTValidator:
def test_haproxy_config(self, static_jwt_validator):
"""Test HAProxy configuration has JWT validation rules"""
result = subprocess.run(
- ["docker", "exec", "static-haproxy-1", "cat", "/etc/haproxy/haproxy.cfg"],
+ ["docker", "exec", "static-haproxy-1", "cat", "/etc/easyhaproxy/haproxy/haproxy.cfg"],
capture_output=True,
text=True,
check=True
diff --git a/tests_e2e/utils.py b/tests_e2e/utils.py
index ea20c28..ebf53c5 100644
--- a/tests_e2e/utils.py
+++ b/tests_e2e/utils.py
@@ -10,6 +10,7 @@ import subprocess
import tempfile
import time
from pathlib import Path
+import requests
import jwt as jwt_lib
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
@@ -21,9 +22,12 @@ _docker_image_built = False
class DockerComposeFixture:
"""Helper class to manage docker-compose lifecycle"""
- def __init__(self, compose_file: str, startup_wait: int = 3, build: bool = None):
+ def __init__(self, compose_file: str, startup_wait: int = 3, build: bool = None,
+ health_check: callable = None, health_check_timeout: int = 60):
self.compose_file = compose_file
self.startup_wait = startup_wait
+ self.health_check = health_check
+ self.health_check_timeout = health_check_timeout
# Smart build strategy: build on first call, skip on subsequent calls
global _docker_image_built
@@ -60,9 +64,31 @@ class DockerComposeFixture:
if self.build:
_docker_image_built = True
- print(f" ✓ Services started, waiting {self.startup_wait}s for initialization...")
- time.sleep(self.startup_wait)
- print(f" ✓ Services ready")
+ # Use health check if provided, otherwise fall back to fixed delay
+ if self.health_check:
+ print(f" ✓ Services started, waiting for health check (timeout: {self.health_check_timeout}s)...")
+ start_time = time.time()
+ poll_interval = 1
+
+ while time.time() - start_time < self.health_check_timeout:
+ try:
+ if self.health_check():
+ elapsed = time.time() - start_time
+ print(f" ✓ Services ready (health check passed in {elapsed:.1f}s)")
+ return
+ except Exception:
+ # Health check not ready yet, continue polling
+ pass
+
+ time.sleep(poll_interval)
+
+ # Health check timed out
+ elapsed = time.time() - start_time
+ raise TimeoutError(f"Health check did not pass within {elapsed:.1f}s")
+ else:
+ print(f" ✓ Services started, waiting {self.startup_wait}s for initialization...")
+ time.sleep(self.startup_wait)
+ print(f" ✓ Services ready")
def down(self):
"""Stop and remove docker-compose services"""