Merge branch 'master' into issue/54

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: byjg

.github/workflows/build.yml

@@ -77,14 +77,39 @@ jobs:
             result = []
             tags.split("\n").forEach(function (item) {
               short_tag = item.trim().split(":")[1]; 
-              if (short_tag != "latest") {
+              if (short_tag == "master" || short_tag == "main") {
+                result.push("latest");
+              } else if (short_tag != "latest") {
                 result.push(short_tag);
               }
             })
             return result.join(",");
           result-encoding: string
-      - name: Get result
+
-        run: echo "${{ steps.tags.outputs.result }}"
+      - name: Get Tags
+        run: |
+          echo "${{ steps.tags.outputs.result }}"
+
+      - uses: actions/github-script@v6
+        id: normalized
+        with:
+          script: |
+            tags = `${{ join(steps.meta.outputs.tags, ',') }}`
+            result = []
+            tags.split("\n").forEach(function (item) {
+              short_tag = item.trim().split(":")[1]; 
+              if (short_tag == "master" || short_tag == "main") {
+                result.push("${{ env.IMAGE_NAME }}:latest");
+              } else if (short_tag != "latest") {
+                result.push("${{ env.IMAGE_NAME }}:" + short_tag);
+              }
+            })
+            return result.join(",");
+          result-encoding: string
+
+      - name: Get Normalized Docker Image
+        run: |
+          echo "${{ steps.normalized.outputs.result }}"
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
@@ -97,7 +122,7 @@ jobs:
             RELEASE_VERSION_ARG="${{ steps.tags.outputs.result }}"
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' || github.event.inputs.push == 'true' }}
-          tags: ${{ steps.meta.outputs.tags }}
+          tags: ${{ steps.normalized.outputs.result }}
           labels: ${{ steps.meta.outputs.labels }}
     
     outputs:
@@ -136,7 +161,9 @@ jobs:
           CURRENT_VERSION=$(grep "appVersion: " helm/easyhaproxy/Chart.yaml |  sed 's#appVersion: "\(.*\)"#\1#g')
 
           if [ "$TAG" = "$CURRENT_VERSION" ]; then
-            echo "Skipping update version..."
+            echo "Skipping version $CURRENT_VERSION..."
+          elif [ "$TAG" = "latest" ]; then
+            echo "Skipping latest version..."
           else
             sed -i "s#easy-haproxy:[a-zA-Z0-9\.-]*#easy-haproxy:$TAG#g" deploy/docker/docker-compose.yml 
             sed -i "s#version: \"[a-zA-Z0-9\.-]*\"#version: \"$TAG\"#g" deploy/kubernetes/easyhaproxy-*.yml 

.run/pytest in tests.run.xml

@@ -0,0 +1,21 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="pytest in tests" type="tests" factoryName="py.test" nameIsGenerated="true">
+    <module name="docker-easy-haproxy" />
+    <option name="ENV_FILES" value="" />
+    <option name="INTERPRETER_OPTIONS" value="" />
+    <option name="PARENT_ENVS" value="true" />
+    <option name="SDK_HOME" value="" />
+    <option name="SDK_NAME" value="Python 3.12 (docker-easy-haproxy)" />
+    <option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/src" />
+    <option name="IS_MODULE_SDK" value="false" />
+    <option name="ADD_CONTENT_ROOTS" value="true" />
+    <option name="ADD_SOURCE_ROOTS" value="true" />
+    <EXTENSION ID="PythonCoverageRunConfigurationExtension" runner="coverage.py" />
+    <option name="_new_keywords" value="&quot;&quot;" />
+    <option name="_new_parameters" value="&quot;&quot;" />
+    <option name="_new_additionalArguments" value="&quot;&quot;" />
+    <option name="_new_target" value="&quot;$PROJECT_DIR$/src/tests&quot;" />
+    <option name="_new_targetType" value="&quot;PATH&quot;" />
+    <method v="2" />
+  </configuration>
+</component>

CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing to byjg/docker-easy-haproxy
+
+First of all, thank you for taking the time to contribute!
+
+## How to Contribute
+
+### Issues
+
+If you encounter any issues, have questions, or need clarification, please open an issue on our [Issues page](https://github.com/your-repo/issues). This helps us track and prioritize bug fixes and enhancements.
+
+### Branches
+
+We have three main branches in this project:
+
+- **master**: Contains the latest code. It is generally stable, but we recommend using it with caution.
+- **a.b**: Use this branch for creating PRs. The naming convention follows `a.b`, where `a` is the major release and `b` is the minor release of the current version. For example, if the current release is 4.9.2, use the branch `4.9` for your PR. You can also use `4.9.x-dev` in your composer for development purposes.
+- **future release**: This branch is typically `(a+1).0`. For instance, if the current release is 4.9.2, the future release branch will be `5.0`.
+
+
+### Code Style and Guidelines
+
+- **Write Clear Commit Messages**: Use the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification.
+- **Documentation**: Update the documentation for any new features or changes.
+
+### Common Practices
+
+- **Keep Pull Requests Small**: Smaller PRs are easier to review and merge. Focus on one feature or fix per PR.
+- **Write Tests**: Ensure your changes are covered by tests. We aim for a high level of test coverage.
+- **Respect Reviewers' Time**: Be responsive to feedback and willing to make necessary changes.
+
+### Community
+
+- **Be Respectful**.
+- **Collaborate**: We encourage collaboration and open discussion. Don’t hesitate to ask for help or provide feedback.
+
+Thank you for contributing to byjg/docker-easy-haproxy! Your help is appreciated and makes a big difference.

README.md

@@ -24,6 +24,7 @@ EasyHAProxy can detect and configure HAProxy automatically on the following plat
 EasyHAProxy is part of some projects:
 - Dokku 
 - MicroK8s
+- DigitalOcean Marketplace
 
 See detailed instructions on how to install below.
 
@@ -70,6 +71,7 @@ Or you can install using tools:
 [![Helm](docs/easyhaproxy_helm.png)](docs/helm.md)
 [![MicroK8s](docs/easyhaproxy_microk8s.png)](docs/microk8s.md)
 [![Dokku](docs/easyhaproxy_dokku.png)](docs/dokku.md)
+[![DigitalOcean](docs/easyhaproxy_digitalocean.png)](docs/digitalocean.md)
 
 ## Special Topics
 

build/Dockerfile

@@ -1,20 +1,24 @@
-FROM alpine:3.18
+FROM alpine:3.20
 
 ARG RELEASE_VERSION_ARG
 
 ENV RELEASE_VERSION=$RELEASE_VERSION_ARG
 ENV TZ="Etc/UTC"
 
-WORKDIR /scripts
-
-COPY src/ /scripts/
-COPY build/assets /
-
 RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml certbot openssl \
- && pip3 install --upgrade pip \
+    && pip3 install --upgrade pip --break-system-packages
- && pip install -r requirements.txt \
+
- && pytest -s -vv tests/ \
+RUN openssl dhparam -out /etc/haproxy/dhparam 2048 \
- && openssl dhparam -out /etc/haproxy/dhparam 2048 \
     && openssl dhparam -out /etc/haproxy/dhparam-1024 1024
 
+WORKDIR /scripts
+
+COPY build/assets /
+
+COPY src/ /scripts/
+
+RUN pip install -r requirements.txt --break-system-packages
+
+RUN pytest -s -vv tests/
+
 CMD ["/usr/bin/python", "-u", "/scripts/main.py" ]

docs/acme.md

@@ -8,21 +8,25 @@ Most of the issuers offers Automatic Issuing free of cost.
 
 ## Environment Variables
 
-To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting up to 4 environment variables:
+To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting up to the following environment variables:
 
 | Environment Variable                     | Required? | Description                                                                                                                      |
-|----------------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------|
+|------------------------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------|
 | EASYHAPROXY_CERTBOT_EMAIL                | YES       | Your email in the certificate authority.                                                                                         |
 | EASYHAPROXY_CERTBOT_AUTOCONFIG           | -         | Will use pre-sets for your Certificate Authority (CA). See table below.                                                          |
 | EASYHAPROXY_CERTBOT_SERVER               | -         | The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below.                |
 | EASYHAPROXY_CERTBOT_EAB_KID              | -         | External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below. |
 | EASYHAPROXY_CERTBOT_EAB_HMAC_KEY         | -         | External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below.             |
 | EASYHAPROXY_CERTBOT_RETRY_COUNT          | -         | Wait 'n' requests before retrying issue invalid requests. Default 60.                                                            |
+| EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES | -         | The preferred challenges for Certbot. Available: `http`                                                                          |
+| EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK     | -         | The path to a script that will be executed (default: None)                                                                       |
 
 ## Auto Config Certificate Authority (CA)
 
 Here are detailed instructions per Certificate Authority (CA). If anyone is missing, please let's know.
 
+Possible values for: `EASYHAPROXY_CERTBOT_AUTOCONFIG`
+
 | CA                   | Auto Config      | Free? | Account Required?  | EAB KID? | EAB HMAC Key? | More Info                                                                                                                                                          |
 |----------------------|------------------|-------|--------------------|----------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | Let's Encrypt        | -                | Yes   | No                 | No       | No            | -                                                                                                                                                                  |

docs/digitalocean.md

@@ -0,0 +1,11 @@
+# DigitalOcean
+
+DigitalOcean is a cloud infrastructure provider focused on simplifying web infrastructure for software developers.
+
+EasyHAProxy is available on DigitalOcean Marketplace. 
+You can install it with a few clicks directly from the DigitalOcean dashboard.
+
+## Installing EasyHAProxy on DigitalOcean
+
+Please refer the [EasyHAProxy page on DigitalOcean Marketplace](https://marketplace.digitalocean.com/apps/easyhaproxy-ingress-controller).
+

docs/environment-variable.md

@@ -1,13 +1,13 @@
 # Docker environment variables
 
 | Environment Variable     | Description                                                                                                                                                                                    | Default       |
-|----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
+|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
 | EASYHAPROXY_DISCOVER     | How the services will be discovered to create `haproxy.cfg`:  `static`, `docker`, `swarm` or `kubernetes`                                                                                      | **required**  |
 | EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources.                                                                                                                                         | `easyhaproxy` |
 | EASYHAPROXY_CERTBOT_*    | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md)                                                                                                       | *empty*       |
 | EASYHAPROXY_SSL_MODE     | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`     |
 | EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds.                                                                                                                                  | 10            |
-| EASYHAPROXY_LOG_LEVEL            | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                | DEBUG         |
+| EASYHAPROXY_LOG_LEVEL    | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                | INFO          |
 | CERTBOT_LOG_LEVEL        | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | DEBUG         |
 | HAPROXY_LOG_LEVEL        | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL                                                                                                    | DEBUG         |
 | HAPROXY_USERNAME         | (Optional) The HAProxy username to the statistics.                                                                                                                                             | `admin`       |

src/functions/__init__.py

@@ -41,6 +41,8 @@ class ContainerEnv:
             "eab_kid": os.getenv("EASYHAPROXY_CERTBOT_EAB_KID", ""),
             "eab_hmac_key": os.getenv("EASYHAPROXY_CERTBOT_EAB_HMAC_KEY", ""),
             "retry_count": int(os.getenv("EASYHAPROXY_CERTBOT_RETRY_COUNT", 60)),
+            "preferred_challenges": os.getenv("EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES", "http"),
+            "manual_auth_hook": os.getenv("EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK", False),
         }
 
         if env_vars["certbot"]["autoconfig"] != "" and not env_vars["certbot"]["server"] and env_vars["certbot"]["email"] != "":
@@ -285,6 +287,8 @@ class Certbot:
         self.eab_hmac_key = self.set_eab_hmac_key(env["certbot"]["eab_hmac_key"])
         self.freeze_issue = {}
         self.retry_count = env["certbot"]["retry_count"]
+        self.certbot_preferred_challenges = env["certbot"]["preferred_challenges"]
+        self.certbot_manual_auth_hook = env["certbot"]["manual_auth_hook"]
 
     @staticmethod
     def set_acme_server(acme_server):
@@ -337,9 +341,7 @@ class Certbot:
                     renew_certs.append(host_arg)
 
             certbot_certonly = ('/usr/bin/certbot certonly {acme_server}'
-                                '    --standalone'
+                                '    --preferred-challenges {challenge}'
-                                '    --preferred-challenges http'
-                                '    --http-01-port 2080'
                                 '    --agree-tos'
                                 '    --issuance-timeout 90'
                                 '    --no-eff-email'
@@ -350,9 +352,18 @@ class Certbot:
                                                                      eab_hmac_key=self.eab_hmac_key,
                                                                      certs=' '.join(request_certs),
                                                                      email=self.email,
+                                                                     challenge=self.certbot_preferred_challenges,
                                                                      acme_server=self.acme_server)
                                 )
 
+            if 'http' in self.certbot_preferred_challenges:
+                certbot_certonly += ('    --http-01-port 2080'
+                                     '    --standalone'
+                                    )
+
+            if self.certbot_manual_auth_hook:
+                certbot_certonly += '    --manual --manual-auth-hook \'{hook}\''.format(hook=self.certbot_manual_auth_hook)
+
             ret_reload = False
             return_code_issue = 0
             return_code_renew = 0

src/main.py

@@ -63,8 +63,8 @@ def main():
 
     Functions.log(Functions.INIT_LOG, Functions.INFO, "                      _                               ")
     Functions.log(Functions.INIT_LOG, Functions.INFO, " ___ __ _ ____  _ ___| |_  __ _ _ __ _ _ _____ ___  _ ")
-    Functions.log(Functions.INIT_LOG, Functions.INFO, "/ -_) _` (_-< || |___| ' \/ _` | '_ \ '_/ _ \ \ / || |")
+    Functions.log(Functions.INIT_LOG, Functions.INFO, "/ -_) _` (_-< || |___| ' \\/ _` | '_ \\ '_/ _ \\ \\ / || |")
-    Functions.log(Functions.INIT_LOG, Functions.INFO, "\___\__,_/__/\_, |   |_||_\__,_| .__/_| \___/_\_\\_, |")
+    Functions.log(Functions.INIT_LOG, Functions.INFO, "\\___\\__,_/__/\\_, |   |_||_\\__,_| .__/_| \\___/_\\_\\_, |")
     Functions.log(Functions.INIT_LOG, Functions.INFO, "             |__/              |_|               |__/ ")
 
     Functions.log(Functions.INIT_LOG, Functions.INFO, "Release: %s" % (os.getenv("RELEASE_VERSION")))

src/tests/test_containerenv.py

@@ -18,7 +18,9 @@ def test_container_env_empty():
                            "eab_kid": "",
                            "email": "",
                            "server": False,
-                           "retry_count": 60}
+                           "retry_count": 60,
+                           "preferred_challenges": "http",
+                           "manual_auth_hook": False}
            } == ContainerEnv.read()
 
     # os.environ['CERTBOT_LOG_LEVEL'] = 'warn'
@@ -41,7 +43,9 @@ def test_container_env_customerrors():
                                "eab_kid": "",
                                "email": "",
                                "server": False,
-                               "retry_count": 60}
+                               "retry_count": 60,
+                               "preferred_challenges": "http",
+                               "manual_auth_hook": False}
                } == ContainerEnv.read()
     finally:
         del os.environ['HAPROXY_CUSTOMERRORS']
@@ -64,7 +68,9 @@ def test_container_env_sslmode():
                                "eab_kid": "",
                                "email": "",
                                "server": False,
-                               "retry_count": 60}
+                               "retry_count": 60,
+                               "preferred_challenges": "http",
+                               "manual_auth_hook": False}
                } == ContainerEnv.read()
     finally:
         del os.environ['EASYHAPROXY_SSL_MODE']
@@ -88,7 +94,9 @@ def test_container_env_stats():
                                "eab_kid": "",
                                "email": "",
                                "server": False,
-                               "retry_count": 60}
+                               "retry_count": 60,
+                               "preferred_challenges": "http",
+                               "manual_auth_hook": False}
                } == ContainerEnv.read()
     finally:
         del os.environ['HAPROXY_USERNAME']
@@ -118,7 +126,9 @@ def test_container_env_stats_password():
                                "eab_kid": "",
                                "email": "",
                                "server": False,
-                               "retry_count": 60}
+                               "retry_count": 60,
+                               "preferred_challenges": "http",
+                               "manual_auth_hook": False}
                } == ContainerEnv.read()
     finally:
         del os.environ['HAPROXY_PASSWORD']
@@ -148,7 +158,9 @@ def test_container_env_stats_password_2():
                                "eab_kid": "",
                                "email": "",
                                "server": False,
-                               "retry_count": 60}
+                               "retry_count": 60,
+                               "preferred_challenges": "http",
+                               "manual_auth_hook": False}
                } == ContainerEnv.read()
     finally:
         del os.environ['HAPROXY_USERNAME']
@@ -174,7 +186,9 @@ def test_container_env_certbot_email():
                        'eab_kid': "",
                        "email": "acme@example.org",
                        "server": False,
-                       "retry_count": 60
+                       "retry_count": 60,
+                       "preferred_challenges": "http",
+                       "manual_auth_hook": False
                    }
                } == ContainerEnv.read()
     finally:
@@ -187,6 +201,8 @@ def test_container_env_certbot_full():
     os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = 'eab_kid'
     os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = 'eab_hmac_key'
     os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT'] = "10"
+    os.environ['EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES'] = "dns"
+    os.environ['EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK'] = "something_manual_auth_hook"
     try:
         assert {
             "customerrors": False,
@@ -203,7 +219,9 @@ def test_container_env_certbot_full():
                "server": "schema://url/a",
                'eab_hmac_key': 'eab_hmac_key',
                'eab_kid': 'eab_kid',
-               'retry_count': 10
+               'retry_count': 10,
+               "preferred_challenges": "dns",
+               "manual_auth_hook": "something_manual_auth_hook"
            }
         } == ContainerEnv.read()
     finally:
@@ -212,6 +230,8 @@ def test_container_env_certbot_full():
         del os.environ['EASYHAPROXY_CERTBOT_EAB_KID']
         del os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY']
         del os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT']
+        del os.environ['EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES']
+        del os.environ['EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK']
 
 
 def test_container_log_level():
@@ -234,7 +254,9 @@ def test_container_log_level():
                'eab_kid': "",
                "email": "",
                "server": False,
-               "retry_count": 60
+               "retry_count": 60,
+               "preferred_challenges": "http",
+               "manual_auth_hook": False
            }
        } == ContainerEnv.read()
     finally: