badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Merge branch 'master' into issue/54

Browse source
This commit is contained in:
Joao Gilberto Magalhaes 2024-11-15 20:16:01 -06:00
commit 0ab73621d4
13 changed files with 191 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.github/FUNDING.yml vendored Normal file
View file

@ -0,0 +1,3 @@
# These are supported funding model platforms
github: byjg

37
.github/workflows/build.yml vendored
View file

@ -77,14 +77,39 @@ jobs:
result = []
tags.split("\n").forEach(function (item) {
short_tag = item.trim().split(":")[1];
if (short_tag != "latest") {
if (short_tag == "master" || short_tag == "main") {
result.push("latest");
} else if (short_tag != "latest") {
result.push(short_tag);
}
})
return result.join(",");
result-encoding: string
- name: Get result
run: echo "${{ steps.tags.outputs.result }}"
- name: Get Tags
run: |
echo "${{ steps.tags.outputs.result }}"
- uses: actions/github-script@v6
id: normalized
with:
script: |
tags = `${{ join(steps.meta.outputs.tags, ',') }}`
result = []
tags.split("\n").forEach(function (item) {
short_tag = item.trim().split(":")[1];
if (short_tag == "master" || short_tag == "main") {
result.push("${{ env.IMAGE_NAME }}:latest");
} else if (short_tag != "latest") {
result.push("${{ env.IMAGE_NAME }}:" + short_tag);
}
})
return result.join(",");
result-encoding: string
- name: Get Normalized Docker Image
run: |
echo "${{ steps.normalized.outputs.result }}"
# Build and push Docker image with Buildx (don't push on PR)
# https://github.com/docker/build-push-action
@ -97,7 +122,7 @@ jobs:
RELEASE_VERSION_ARG="${{ steps.tags.outputs.result }}"
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' || github.event.inputs.push == 'true' }}
tags: ${{ steps.meta.outputs.tags }}
tags: ${{ steps.normalized.outputs.result }}
labels: ${{ steps.meta.outputs.labels }}
outputs:
@ -136,7 +161,9 @@ jobs:
CURRENT_VERSION=$(grep "appVersion: " helm/easyhaproxy/Chart.yaml | sed 's#appVersion: "\(.*\)"#\1#g')
if [ "$TAG" = "$CURRENT_VERSION" ]; then
echo "Skipping update version..."
echo "Skipping version $CURRENT_VERSION..."
elif [ "$TAG" = "latest" ]; then
echo "Skipping latest version..."
else
sed -i "s#easy-haproxy:[a-zA-Z0-9\.-]*#easy-haproxy:$TAG#g" deploy/docker/docker-compose.yml
sed -i "s#version: \"[a-zA-Z0-9\.-]*\"#version: \"$TAG\"#g" deploy/kubernetes/easyhaproxy-*.yml

21
.run/pytest in tests.run.xml Normal file
View file

@ -0,0 +1,21 @@
<component name="ProjectRunConfigurationManager">
<configuration default="false" name="pytest in tests" type="tests" factoryName="py.test" nameIsGenerated="true">
<module name="docker-easy-haproxy" />
<option name="ENV_FILES" value="" />
<option name="INTERPRETER_OPTIONS" value="" />
<option name="PARENT_ENVS" value="true" />
<option name="SDK_HOME" value="" />
<option name="SDK_NAME" value="Python 3.12 (docker-easy-haproxy)" />
<option name="WORKING_DIRECTORY" value="$PROJECT_DIR$/src" />
<option name="IS_MODULE_SDK" value="false" />
<option name="ADD_CONTENT_ROOTS" value="true" />
<option name="ADD_SOURCE_ROOTS" value="true" />
<EXTENSION ID="PythonCoverageRunConfigurationExtension" runner="coverage.py" />
<option name="_new_keywords" value="&quot;&quot;" />
<option name="_new_parameters" value="&quot;&quot;" />
<option name="_new_additionalArguments" value="&quot;&quot;" />
<option name="_new_target" value="&quot;$PROJECT_DIR$/src/tests&quot;" />
<option name="_new_targetType" value="&quot;PATH&quot;" />
<method v="2" />
</configuration>
</component>

36
CONTRIBUTING.md Normal file
View file

@ -0,0 +1,36 @@
# Contributing to byjg/docker-easy-haproxy
First of all, thank you for taking the time to contribute!
## How to Contribute
### Issues
If you encounter any issues, have questions, or need clarification, please open an issue on our [Issues page](https://github.com/your-repo/issues). This helps us track and prioritize bug fixes and enhancements.
### Branches
We have three main branches in this project:
- **master**: Contains the latest code. It is generally stable, but we recommend using it with caution.
- **a.b**: Use this branch for creating PRs. The naming convention follows `a.b`, where `a` is the major release and `b` is the minor release of the current version. For example, if the current release is 4.9.2, use the branch `4.9` for your PR. You can also use `4.9.x-dev` in your composer for development purposes.
- **future release**: This branch is typically `(a+1).0`. For instance, if the current release is 4.9.2, the future release branch will be `5.0`.
### Code Style and Guidelines
- **Write Clear Commit Messages**: Use the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification.
- **Documentation**: Update the documentation for any new features or changes.
### Common Practices
- **Keep Pull Requests Small**: Smaller PRs are easier to review and merge. Focus on one feature or fix per PR.
- **Write Tests**: Ensure your changes are covered by tests. We aim for a high level of test coverage.
- **Respect Reviewers' Time**: Be responsive to feedback and willing to make necessary changes.
### Community
- **Be Respectful**.
- **Collaborate**: We encourage collaboration and open discussion. Don’t hesitate to ask for help or provide feedback.
Thank you for contributing to byjg/docker-easy-haproxy! Your help is appreciated and makes a big difference.

2
README.md
View file

@ -24,6 +24,7 @@ EasyHAProxy can detect and configure HAProxy automatically on the following plat
EasyHAProxy is part of some projects:
- Dokku
- MicroK8s
- DigitalOcean Marketplace
See detailed instructions on how to install below.
@ -70,6 +71,7 @@ Or you can install using tools:
[![Helm](docs/easyhaproxy_helm.png)](docs/helm.md)
[![MicroK8s](docs/easyhaproxy_microk8s.png)](docs/microk8s.md)
[![Dokku](docs/easyhaproxy_dokku.png)](docs/dokku.md)
[![DigitalOcean](docs/easyhaproxy_digitalocean.png)](docs/digitalocean.md)
## Special Topics

20
build/Dockerfile
View file

@ -1,20 +1,24 @@
FROM alpine:3.18
FROM alpine:3.20
ARG RELEASE_VERSION_ARG
ENV RELEASE_VERSION=$RELEASE_VERSION_ARG
ENV TZ="Etc/UTC"
RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml certbot openssl \
&& pip3 install --upgrade pip --break-system-packages
RUN openssl dhparam -out /etc/haproxy/dhparam 2048 \
&& openssl dhparam -out /etc/haproxy/dhparam-1024 1024
WORKDIR /scripts
COPY src/ /scripts/
COPY build/assets /
RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml certbot openssl \
&& pip3 install --upgrade pip \
&& pip install -r requirements.txt \
&& pytest -s -vv tests/ \
&& openssl dhparam -out /etc/haproxy/dhparam 2048 \
&& openssl dhparam -out /etc/haproxy/dhparam-1024 1024
COPY src/ /scripts/
RUN pip install -r requirements.txt --break-system-packages
RUN pytest -s -vv tests/
CMD ["/usr/bin/python", "-u", "/scripts/main.py" ]

22
docs/acme.md
View file

@ -8,21 +8,25 @@ Most of the issuers offers Automatic Issuing free of cost.
## Environment Variables
To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting up to 4 environment variables:
To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting up to the following environment variables:
| Environment Variable | Required? | Description |
|----------------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------|
| EASYHAPROXY_CERTBOT_EMAIL | YES | Your email in the certificate authority. |
| EASYHAPROXY_CERTBOT_AUTOCONFIG | - | Will use pre-sets for your Certificate Authority (CA). See table below. |
| EASYHAPROXY_CERTBOT_SERVER | - | The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below. |
| EASYHAPROXY_CERTBOT_EAB_KID | - | External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below. |
| EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | - | External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below. |
| EASYHAPROXY_CERTBOT_RETRY_COUNT | - | Wait 'n' requests before retrying issue invalid requests. Default 60. |
| Environment Variable | Required? | Description |
|------------------------------------------|-----------|----------------------------------------------------------------------------------------------------------------------------------|
| EASYHAPROXY_CERTBOT_EMAIL | YES | Your email in the certificate authority. |
| EASYHAPROXY_CERTBOT_AUTOCONFIG | - | Will use pre-sets for your Certificate Authority (CA). See table below. |
| EASYHAPROXY_CERTBOT_SERVER | - | The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below. |
| EASYHAPROXY_CERTBOT_EAB_KID | - | External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below. |
| EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | - | External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below. |
| EASYHAPROXY_CERTBOT_RETRY_COUNT | - | Wait 'n' requests before retrying issue invalid requests. Default 60. |
| EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES | - | The preferred challenges for Certbot. Available: `http` |
| EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK | - | The path to a script that will be executed (default: None) |
## Auto Config Certificate Authority (CA)
Here are detailed instructions per Certificate Authority (CA). If anyone is missing, please let's know.
Possible values for: `EASYHAPROXY_CERTBOT_AUTOCONFIG`
| CA | Auto Config | Free? | Account Required? | EAB KID? | EAB HMAC Key? | More Info |
|----------------------|------------------|-------|--------------------|----------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Let's Encrypt | - | Yes | No | No | No | - |

11
docs/digitalocean.md Normal file
View file

@ -0,0 +1,11 @@
# DigitalOcean
DigitalOcean is a cloud infrastructure provider focused on simplifying web infrastructure for software developers.
EasyHAProxy is available on DigitalOcean Marketplace.
You can install it with a few clicks directly from the DigitalOcean dashboard.
## Installing EasyHAProxy on DigitalOcean
Please refer the [EasyHAProxy page on DigitalOcean Marketplace](https://marketplace.digitalocean.com/apps/easyhaproxy-ingress-controller).

BIN
docs/easyhaproxy_digitalocean.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 7.7 KiB

28
docs/environment-variable.md
View file

@ -1,19 +1,19 @@
# Docker environment variables
| Environment Variable | Description | Default |
|----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md) | *empty* |
| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` |
| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` |
| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` |
| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |
| Environment Variable | Description | Default |
|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md) | *empty* |
| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` |
| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | INFO |
| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` |
| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` |
| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |
----

17
src/functions/__init__.py
View file

@ -41,6 +41,8 @@ class ContainerEnv:
"eab_kid": os.getenv("EASYHAPROXY_CERTBOT_EAB_KID", ""),
"eab_hmac_key": os.getenv("EASYHAPROXY_CERTBOT_EAB_HMAC_KEY", ""),
"retry_count": int(os.getenv("EASYHAPROXY_CERTBOT_RETRY_COUNT", 60)),
"preferred_challenges": os.getenv("EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES", "http"),
"manual_auth_hook": os.getenv("EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK", False),
}
if env_vars["certbot"]["autoconfig"] != "" and not env_vars["certbot"]["server"] and env_vars["certbot"]["email"] != "":
@ -285,6 +287,8 @@ class Certbot:
self.eab_hmac_key = self.set_eab_hmac_key(env["certbot"]["eab_hmac_key"])
self.freeze_issue = {}
self.retry_count = env["certbot"]["retry_count"]
self.certbot_preferred_challenges = env["certbot"]["preferred_challenges"]
self.certbot_manual_auth_hook = env["certbot"]["manual_auth_hook"]
@staticmethod
def set_acme_server(acme_server):
@ -337,9 +341,7 @@ class Certbot:
renew_certs.append(host_arg)
certbot_certonly = ('/usr/bin/certbot certonly {acme_server}'
' --standalone'
' --preferred-challenges http'
' --http-01-port 2080'
' --preferred-challenges {challenge}'
' --agree-tos'
' --issuance-timeout 90'
' --no-eff-email'
@ -350,9 +352,18 @@ class Certbot:
eab_hmac_key=self.eab_hmac_key,
certs=' '.join(request_certs),
email=self.email,
challenge=self.certbot_preferred_challenges,
acme_server=self.acme_server)
)
if 'http' in self.certbot_preferred_challenges:
certbot_certonly += (' --http-01-port 2080'
' --standalone'
)
if self.certbot_manual_auth_hook:
certbot_certonly += ' --manual --manual-auth-hook \'{hook}\''.format(hook=self.certbot_manual_auth_hook)
ret_reload = False
return_code_issue = 0
return_code_renew = 0

4
src/main.py
View file

@ -63,8 +63,8 @@ def main():
Functions.log(Functions.INIT_LOG, Functions.INFO, " _ ")
Functions.log(Functions.INIT_LOG, Functions.INFO, " ___ __ _ ____ _ ___| |_ __ _ _ __ _ _ _____ ___ _ ")
Functions.log(Functions.INIT_LOG, Functions.INFO, "/ -_) _` (_-< || |___| ' \/ _` | '_ \ '_/ _ \ \ / || |")
Functions.log(Functions.INIT_LOG, Functions.INFO, "\___\__,_/__/\_, | |_||_\__,_| .__/_| \___/_\_\\_, |")
Functions.log(Functions.INIT_LOG, Functions.INFO, "/ -_) _` (_-< || |___| ' \\/ _` | '_ \\ '_/ _ \\ \\ / || |")
Functions.log(Functions.INIT_LOG, Functions.INFO, "\\___\\__,_/__/\\_, | |_||_\\__,_| .__/_| \\___/_\\_\\_, |")
Functions.log(Functions.INIT_LOG, Functions.INFO, " |__/ |_| |__/ ")
Functions.log(Functions.INIT_LOG, Functions.INFO, "Release: %s" % (os.getenv("RELEASE_VERSION")))

40
src/tests/test_containerenv.py
View file

@ -18,7 +18,9 @@ def test_container_env_empty():
"eab_kid": "",
"email": "",
"server": False,
"retry_count": 60}
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False}
} == ContainerEnv.read()
# os.environ['CERTBOT_LOG_LEVEL'] = 'warn'
@ -41,7 +43,9 @@ def test_container_env_customerrors():
"eab_kid": "",
"email": "",
"server": False,
"retry_count": 60}
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False}
} == ContainerEnv.read()
finally:
del os.environ['HAPROXY_CUSTOMERRORS']
@ -64,7 +68,9 @@ def test_container_env_sslmode():
"eab_kid": "",
"email": "",
"server": False,
"retry_count": 60}
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False}
} == ContainerEnv.read()
finally:
del os.environ['EASYHAPROXY_SSL_MODE']
@ -88,7 +94,9 @@ def test_container_env_stats():
"eab_kid": "",
"email": "",
"server": False,
"retry_count": 60}
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False}
} == ContainerEnv.read()
finally:
del os.environ['HAPROXY_USERNAME']
@ -118,7 +126,9 @@ def test_container_env_stats_password():
"eab_kid": "",
"email": "",
"server": False,
"retry_count": 60}
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False}
} == ContainerEnv.read()
finally:
del os.environ['HAPROXY_PASSWORD']
@ -148,7 +158,9 @@ def test_container_env_stats_password_2():
"eab_kid": "",
"email": "",
"server": False,
"retry_count": 60}
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False}
} == ContainerEnv.read()
finally:
del os.environ['HAPROXY_USERNAME']
@ -174,7 +186,9 @@ def test_container_env_certbot_email():
'eab_kid': "",
"email": "acme@example.org",
"server": False,
"retry_count": 60
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False
}
} == ContainerEnv.read()
finally:
@ -187,6 +201,8 @@ def test_container_env_certbot_full():
os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = 'eab_kid'
os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = 'eab_hmac_key'
os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT'] = "10"
os.environ['EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES'] = "dns"
os.environ['EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK'] = "something_manual_auth_hook"
try:
assert {
"customerrors": False,
@ -203,7 +219,9 @@ def test_container_env_certbot_full():
"server": "schema://url/a",
'eab_hmac_key': 'eab_hmac_key',
'eab_kid': 'eab_kid',
'retry_count': 10
'retry_count': 10,
"preferred_challenges": "dns",
"manual_auth_hook": "something_manual_auth_hook"
}
} == ContainerEnv.read()
finally:
@ -212,6 +230,8 @@ def test_container_env_certbot_full():
del os.environ['EASYHAPROXY_CERTBOT_EAB_KID']
del os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY']
del os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT']
del os.environ['EASYHAPROXY_CERTBOT_PREFERRED_CHALLENGES']
del os.environ['EASYHAPROXY_CERTBOT_MANUAL_AUTH_HOOK']
def test_container_log_level():
@ -234,7 +254,9 @@ def test_container_log_level():
'eab_kid': "",
"email": "",
"server": False,
"retry_count": 60
"retry_count": 60,
"preferred_challenges": "http",
"manual_auth_hook": False
}
} == ContainerEnv.read()
finally: