First part letsencrypt
This commit is contained in:
Joao M
parent
08c38e5f8a
commit
10ed037d94
20 changed files with 222 additions and 45 deletions
|
|
@ -10,3 +10,6 @@ defaults
|
|||
timeout client 10s
|
||||
timeout server 10m
|
||||
|
||||
|
||||
backend letsencrypt_backend
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -27,3 +27,6 @@ backend srv_www_helloworld_com_19901_1
|
|||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 test_nginx.2.t5r94mjlced7m3t5orfjbowmm:80 check weight 1
|
||||
server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1
|
||||
|
||||
backend letsencrypt_backend
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -24,3 +24,6 @@ backend srv_agent_quantum_local_31339_1
|
|||
option tcp-check
|
||||
tcp-check connect ssl
|
||||
server srv-0 test_agent:9001 check weight 1 verify none
|
||||
|
||||
backend letsencrypt_backend
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -35,6 +35,8 @@ frontend http_in_31337_2
|
|||
|
||||
acl is_rule_node-exporter_quantum_example_org_31337_2_1 hdr(host) -i node-exporter.quantum.example.org
|
||||
acl is_rule_node-exporter_quantum_example_org_31337_2_2 hdr(host) -i node-exporter.quantum.example.org:31337
|
||||
acl is_letsencrypt_node-exporter_quantum_example_org_31337_2 path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if (is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_rule_node-exporter_quantum_example_org_31337_2_2) AND is_letsencrypt_node-exporter_quantum_example_org_31337_2
|
||||
use_backend srv_node-exporter_quantum_example_org_31337_2 if is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_rule_node-exporter_quantum_example_org_31337_2_2
|
||||
|
||||
backend srv_cadvisor_quantum_example_org_31337_2
|
||||
|
|
@ -93,3 +95,6 @@ backend srv_www_somehost_com_br_443_4
|
|||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 some-service:80 check weight 1
|
||||
|
||||
backend letsencrypt_backend
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -41,6 +41,8 @@ frontend http_in_80_1
|
|||
|
||||
acl is_rule_host1_com_br_80_1_1 hdr(host) -i host1.com.br
|
||||
acl is_rule_host1_com_br_80_1_2 hdr(host) -i host1.com.br:80
|
||||
acl is_letsencrypt_host1_com_br_80_1 path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if (is_rule_host1_com_br_80_1_1 OR is_rule_host1_com_br_80_1_2) AND is_letsencrypt_host1_com_br_80_1
|
||||
use_backend srv_host1_com_br_80_1 if is_rule_host1_com_br_80_1_1 OR is_rule_host1_com_br_80_1_2
|
||||
|
||||
acl is_rule_host2_com_br_80_1_1 hdr(host) -i host2.com.br
|
||||
|
|
@ -93,3 +95,6 @@ backend srv_host3_com_br_8080_3
|
|||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 domain:8181 check weight 1
|
||||
|
||||
backend letsencrypt_backend
|
||||
server certbot 127.0.0.1:2080
|
||||
2
tests/fixtures/services
vendored
2
tests/fixtures/services
vendored
|
|
@ -1,6 +1,6 @@
|
|||
portainer-agent_agent={"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"}
|
||||
my-stack_agent={"easyhaproxy.agent.host":"agent.quantum.example.org","easyhaproxy.agent.localport":"9001","easyhaproxy.agent.mode":"tcp","easyhaproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
my-stack_cadvisor={"easyhaproxy.cadvisor.host":"cadvisor.quantum.example.org","easyhaproxy.cadvisor.localport":"8080","easyhaproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
my-stack_node-exporter={"easyhaproxy.exp.host":"node-exporter.quantum.example.org","easyhaproxy.exp.localport":"9100","easyhaproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
my-stack_node-exporter={"easyhaproxy.exp.host":"node-exporter.quantum.example.org","easyhaproxy.exp.localport":"9100","easyhaproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","easyhaproxy.exp.letsencrypt":"true"}
|
||||
my-stack_reverse-proxy={"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
some-service={"easyhaproxy.http.port":"80","easyhaproxy.http.host":"www.somehost.com.br","easyhaproxy.http.localport":"80","easyhaproxy.http.redirect":"somehost.com.br--https://www.somehost.com.br,somehost.com--https://www.somehost.com.br,www.somehost.com--https://www.somehost.com.br,byjg.ca--https://www.somehost.com.br,www.byjg.ca--https://www.somehost.com.br","easyhaproxy.https.port":"443","easyhaproxy.https.host":"www.somehost.com.br","easyhaproxy.https.localport":"80","easyhaproxy.https.redirect":"somehost.com.br--https://www.somehost.com.br,somehost.com--https://www.somehost.com.br,www.somehost.com--https://www.somehost.com.br,byjg.ca--https://www.somehost.com.br,www.byjg.ca--https://www.somehost.com.br","easyhaproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}
|
||||
2
tests/fixtures/services-changed-label
vendored
2
tests/fixtures/services-changed-label
vendored
|
|
@ -1,6 +1,6 @@
|
|||
portainer-agent_agent={"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"}
|
||||
my-stack_agent={"haproxy.agent.host":"agent.quantum.example.org","haproxy.agent.localport":"9001","haproxy.agent.mode":"tcp","haproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
my-stack_cadvisor={"haproxy.cadvisor.host":"cadvisor.quantum.example.org","haproxy.cadvisor.localport":"8080","haproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
my-stack_node-exporter={"haproxy.exp.host":"node-exporter.quantum.example.org","haproxy.exp.localport":"9100","haproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
my-stack_node-exporter={"haproxy.exp.host":"node-exporter.quantum.example.org","haproxy.exp.localport":"9100","haproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","haproxy.exp.letsencrypt":"yes"}
|
||||
my-stack_reverse-proxy={"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}
|
||||
some-service={"haproxy.http.port":"80","haproxy.http.host":"www.somehost.com.br","haproxy.http.localport":"80","haproxy.http.redirect":"somehost.com.br--https://www.somehost.com.br,somehost.com--https://www.somehost.com.br,www.somehost.com--https://www.somehost.com.br,byjg.ca--https://www.somehost.com.br,www.byjg.ca--https://www.somehost.com.br","haproxy.https.port":"443","haproxy.https.host":"www.somehost.com.br","haproxy.https.localport":"80","haproxy.https.redirect":"somehost.com.br--https://www.somehost.com.br,somehost.com--https://www.somehost.com.br,www.somehost.com--https://www.somehost.com.br,byjg.ca--https://www.somehost.com.br,www.byjg.ca--https://www.somehost.com.br","haproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}
|
||||
16
tests/fixtures/static.yml
vendored
16
tests/fixtures/static.yml
vendored
|
|
@ -8,16 +8,24 @@ customerrors: true # Optional (default false)
|
|||
easymapping:
|
||||
- port: 80
|
||||
hosts:
|
||||
host1.com.br: container:5000
|
||||
host2.com.br: other:3000
|
||||
host1.com.br:
|
||||
containers:
|
||||
- container:5000
|
||||
letsencrypt: true
|
||||
host2.com.br:
|
||||
containers:
|
||||
- other:3000
|
||||
redirect:
|
||||
www.host1.com.br: http://host1.com.br
|
||||
|
||||
- port: 443
|
||||
ssl_cert: /etc/haproxy/certs/mycert.pem
|
||||
hosts:
|
||||
host1.com.br: container:80
|
||||
host1.com.br:
|
||||
containers:
|
||||
- container:80
|
||||
|
||||
- port: 8080
|
||||
hosts:
|
||||
host3.com.br: domain:8181
|
||||
host3.com.br:
|
||||
containers: [ "domain:8181" ]
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ def test_parser_doesnt_crash():
|
|||
path = os.path.dirname(os.path.realpath(__file__))
|
||||
with open(path + "/expected/no-services.txt", 'r') as expected_file:
|
||||
assert expected_file.read() == haproxy_config
|
||||
|
||||
assert [] == cfg.letsencrypt_hosts
|
||||
|
||||
def test_parser_finds_services():
|
||||
line_list = load_fixture("services")
|
||||
|
|
@ -50,6 +50,8 @@ def test_parser_finds_services():
|
|||
with open(cert_file, 'r') as expected_file:
|
||||
assert expected_file.read() == "Some PEM Certificate"
|
||||
|
||||
assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts
|
||||
|
||||
def test_parser_finds_services_changed_label():
|
||||
line_list = load_fixture("services-changed-label")
|
||||
|
||||
|
|
@ -73,6 +75,8 @@ def test_parser_finds_services_changed_label():
|
|||
with open(cert_file, 'r') as expected_file:
|
||||
assert expected_file.read() == "Some PEM Certificate"
|
||||
|
||||
assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts
|
||||
|
||||
def test_parser_finds_services_raw():
|
||||
line_list = load_fixture("services")
|
||||
|
||||
|
|
@ -92,9 +96,12 @@ def test_parser_finds_services_raw():
|
|||
"health-check":"",
|
||||
"port":"31339",
|
||||
"hosts":{
|
||||
"agent.quantum.example.org":[
|
||||
"my-stack_agent:9001"
|
||||
]
|
||||
"agent.quantum.example.org": {
|
||||
"containers": [
|
||||
"my-stack_agent:9001"
|
||||
],
|
||||
"letsencrypt": False
|
||||
}
|
||||
},
|
||||
"redirect":{
|
||||
|
||||
|
|
@ -105,12 +112,18 @@ def test_parser_finds_services_raw():
|
|||
"health-check":"",
|
||||
"port":"31337",
|
||||
"hosts":{
|
||||
"cadvisor.quantum.example.org":[
|
||||
"my-stack_cadvisor:8080"
|
||||
],
|
||||
"node-exporter.quantum.example.org":[
|
||||
"my-stack_node-exporter:9100"
|
||||
]
|
||||
"cadvisor.quantum.example.org":{
|
||||
"containers": [
|
||||
"my-stack_cadvisor:8080"
|
||||
],
|
||||
"letsencrypt": False
|
||||
},
|
||||
"node-exporter.quantum.example.org":{
|
||||
"containers": [
|
||||
"my-stack_node-exporter:9100"
|
||||
],
|
||||
"letsencrypt": True
|
||||
}
|
||||
},
|
||||
"redirect":{
|
||||
|
||||
|
|
@ -121,9 +134,12 @@ def test_parser_finds_services_raw():
|
|||
"health-check":"",
|
||||
"port":"80",
|
||||
"hosts":{
|
||||
"www.somehost.com.br":[
|
||||
"some-service:80"
|
||||
]
|
||||
"www.somehost.com.br":{
|
||||
"containers": [
|
||||
"some-service:80"
|
||||
],
|
||||
"letsencrypt": False
|
||||
}
|
||||
},
|
||||
"redirect":{
|
||||
"somehost.com.br":"https://www.somehost.com.br",
|
||||
|
|
@ -138,9 +154,12 @@ def test_parser_finds_services_raw():
|
|||
"health-check":"",
|
||||
"port":"443",
|
||||
"hosts":{
|
||||
"www.somehost.com.br":[
|
||||
"some-service:80"
|
||||
]
|
||||
"www.somehost.com.br":{
|
||||
"containers": [
|
||||
"some-service:80"
|
||||
],
|
||||
"letsencrypt": False
|
||||
}
|
||||
},
|
||||
"redirect":{
|
||||
"somehost.com.br":"https://www.somehost.com.br",
|
||||
|
|
@ -156,6 +175,7 @@ def test_parser_finds_services_raw():
|
|||
processed = list(cfg.parse(line_list))
|
||||
|
||||
assert parsed_object == processed
|
||||
assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts
|
||||
|
||||
|
||||
|
||||
|
|
@ -170,6 +190,66 @@ def test_parser_static():
|
|||
|
||||
with open(path + "/expected/static.txt", 'r') as expected_file:
|
||||
assert expected_file.read() == haproxy_config
|
||||
assert [] == cfg.letsencrypt_hosts
|
||||
|
||||
def test_parser_static_raw():
|
||||
path = os.path.dirname(os.path.realpath(__file__))
|
||||
with open(path + "/fixtures/static.yml", 'r') as content_file:
|
||||
parsed = yaml.load(content_file.read(), Loader=yaml.FullLoader)
|
||||
|
||||
expected = {
|
||||
"stats": {
|
||||
"username": "admin",
|
||||
"password": "test123",
|
||||
"port": 1936
|
||||
},
|
||||
"customerrors": True,
|
||||
"easymapping": [
|
||||
{
|
||||
"port": 80,
|
||||
"hosts": {
|
||||
"host1.com.br": {
|
||||
"containers": [
|
||||
"container:5000"
|
||||
],
|
||||
"letsencrypt": True
|
||||
},
|
||||
"host2.com.br": {
|
||||
"containers": [
|
||||
"other:3000"
|
||||
]
|
||||
}
|
||||
},
|
||||
"redirect": {
|
||||
"www.host1.com.br": "http://host1.com.br"
|
||||
}
|
||||
},
|
||||
{
|
||||
"port": 443,
|
||||
"ssl_cert": "/etc/haproxy/certs/mycert.pem",
|
||||
"hosts": {
|
||||
"host1.com.br": {
|
||||
"containers": [
|
||||
"container:80"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"port": 8080,
|
||||
"hosts": {
|
||||
"host3.com.br": {
|
||||
"containers": [
|
||||
"domain:8181"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
assert expected == parsed
|
||||
|
||||
|
||||
|
||||
def test_parser_tcp():
|
||||
|
|
@ -187,6 +267,7 @@ def test_parser_tcp():
|
|||
path = os.path.dirname(os.path.realpath(__file__))
|
||||
with open(path + "/expected/services-tcp.txt", 'r') as expected_file:
|
||||
assert expected_file.read() == haproxy_config
|
||||
assert [] == cfg.letsencrypt_hosts
|
||||
|
||||
def test_parser_multi_containers():
|
||||
line_list = load_fixture("services-multi-containers")
|
||||
|
|
@ -202,6 +283,7 @@ def test_parser_multi_containers():
|
|||
path = os.path.dirname(os.path.realpath(__file__))
|
||||
with open(path + "/expected/services-multi-containers.txt", 'r') as expected_file:
|
||||
assert expected_file.read() == haproxy_config
|
||||
assert [] == cfg.letsencrypt_hosts
|
||||
|
||||
|
||||
#test_parser_finds_services_raw()
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue