badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Minor Fix Pre-Merge

Browse source
This commit is contained in:
Joao Gilberto Magalhaes 2023-07-03 14:59:17 -05:00
parent 812590d86c
commit 166b75cd75
16 changed files with 77 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/kubernetes.md
View file

@ -79,17 +79,14 @@ Notes:
## Kubernetes annotations ## Kubernetes annotations
| annotation | Description | Default | Example | | annotation | Description | Default | Example |
|----------------------------------|-----------------------------------------------------------------------------------------|--------------|---------------------------------------| |----------------------------------|-------------------------------------------------------------------------------------|--------------|---------------------------------------|
| kubernetes.io/ingress.class | (required) Activate EasyHAProxy. | **required** | easyhaproxy-ingress | | kubernetes.io/ingress.class | (required) Activate EasyHAProxy. | **required** | easyhaproxy-ingress |
| easyhaproxy.redirect_ssl | (optional) Boolean. Force redirect all endpoints to HTTPS. | false | true or false | | easyhaproxy.redirect_ssl | (optional) Boolean. Force redirect all endpoints to HTTPS. | false | true or false |
| easyhaproxy.letsencrypt | (optional) Boolean. It will request letsencrypt certificates for the ingresses domains. | false | true or false | | easyhaproxy.certbot | (optional) Boolean. It will request certbot certificates for the ingresses domains. | false | true or false |
| easyhaproxy.redirect | (optional) JSON. Key pair with a domain and its destination. | *empty* | {"domain":"redirect_url"} | | easyhaproxy.redirect | (optional) JSON. Key pair with a domain and its destination. | *empty* | {"domain":"redirect_url"} |
| easyhaproxy.mode | (optional) Set the HTTP mode for that connection. | http | http or tcp | | easyhaproxy.mode | (optional) Set the HTTP mode for that connection. | http | http or tcp |
| easyhaproxy.listen_port | (optional) Set the an additional port for that ingress | http | http or tcp | | easyhaproxy.listen_port | (optional) Set the an additional port for that ingress | http | http or tcp |
| easyhaproxt.logLevel.certbot | (optional) Certbot log level | DEBUG | TRACE,DEBUG,INFO,WARN,ERROR or FATAL |
| easyhaproxt.logLevel.eashhaproxy | (optional) EasyHAProxy log level | DEBUG | TRACE,DEBUG,INFO,WARN,ERROR or FATAL |
| easyhaproxt.logLevel.haproxy | (optional) HAProxy log level | INFO | TRACE,DEBUG,INFO,WARN,ERROR or FATAL |
**Important**: The annotations are per ingress and applied to all hosts in that ingress configuration. **Important**: The annotations are per ingress and applied to all hosts in that ingress configuration.

14
docs/volumes.md
View file

@ -2,13 +2,13 @@
You can map the following volumes: You can map the following volumes:
| Volume | Description | | Volume | Description |
|-----------------------------|----------------------------------------------------------------------------------------| |-----------------------------|-------------------------------------------------------------------------------------------------------------------------------|
| /etc/haproxy/static/ | The folder that will contain the [config.yml](static.md) file for static configuration | | /etc/haproxy/static/ | The folder that will contain the [config.yml](static.md) file for static configuration |
| /certs/haproxy/ | The folder that will contain the certificates (`PEM`) for the [SSL](ssl.md) | | /certs/haproxy/ | The folder that will contain the certificates (`PEM`) for the [SSL](ssl.md) |
| /certs/letsencrypt/ | The folder that will contain the certificates (`PEM`) for the SSL. Use this volume to cache the [letsencrypt](letsencrypt.md) certificate and avoid re-issue certificates between restarts. | | /certs/certbot/ | The folder that will contain the certificates (`PEM`) processed by Certbot (e.g. Let's Encrypt). More info: [acme](acme.md). |
| /etc/haproxy/conf.d/ | The folder that will contain the [custom configuration](other.md) files. | | /etc/haproxy/conf.d/ | The folder that will contain the [custom configuration](other.md) files. |
| /etc/haproxy/errors-custom/ | The folder that will contain the [custom error](other.md) html files. | | /etc/haproxy/errors-custom/ | The folder that will contain the [custom error](other.md) html files. |
---- ----
[Open source ByJG](http://opensource.byjg.com) [Open source ByJG](http://opensource.byjg.com)

4
examples/swarm/easyhaproxy.yml
View file

@ -11,7 +11,7 @@ services:
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
- ./certs:/certs/haproxy - ./certs:/certs/haproxy
- certs_letsencrypt:/certs/letsencrypt - certs_certbot:/certs/certbot
deploy: deploy:
replicas: 1 replicas: 1
environment: environment:
@ -34,7 +34,7 @@ networks:
external: true external: true
volumes: volumes:
certs_letsencrypt: certs_certbot:
# external: true # external: true
# certs_haproxy: # certs_haproxy:
# external: true # external: true

4
examples/swarm/portainer.yml
View file

@ -13,13 +13,13 @@ services:
replicas: 1 replicas: 1
labels: labels:
# easyhaproxy.http.redirect_ssl: true # easyhaproxy.http.redirect_ssl: true
# easyhaproxy.http.letsencrypt: true # easyhaproxy.http.certbot: true
easyhaproxy.http.host: portainer.local easyhaproxy.http.host: portainer.local
easyhaproxy.http.port: 80 easyhaproxy.http.port: 80
easyhaproxy.http.localport: 9000 easyhaproxy.http.localport: 9000
volumes: volumes:
certs_letsencrypt: certs_certbot:
external: true external: true
# certs_haproxy: # certs_haproxy:
# external: true # external: true

18
src/functions/__init__.py
View file

@ -27,6 +27,13 @@ class ContainerEnv:
env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv( env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv(
"EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy" "EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy"
env_vars["logLevel"] = {
"easyhaproxy": os.getenv("EASYHAPROXY_LOG_LEVEL") if os.getenv(
"EASYHAPROXY_LOG_LEVEL") else Functions.DEBUG,
"haproxy": os.getenv("HAPROXY_LOG_LEVEL") if os.getenv("HAPROXY_LOG_LEVEL") else Functions.INFO,
"certbot": os.getenv("CERTBOT_LOG_LEVEL") if os.getenv("CERTBOT_LOG_LEVEL") else Functions.DEBUG,
}
env_vars["certbot"] = { env_vars["certbot"] = {
"autoconfig": os.getenv("EASYHAPROXY_CERTBOT_AUTOCONFIG", ""), "autoconfig": os.getenv("EASYHAPROXY_CERTBOT_AUTOCONFIG", ""),
"email": os.getenv("EASYHAPROXY_CERTBOT_EMAIL", ""), "email": os.getenv("EASYHAPROXY_CERTBOT_EMAIL", ""),
@ -72,7 +79,7 @@ class ContainerEnv:
env_vars["certbot"]["eab_kid"] = os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = resp["eab_kid"] env_vars["certbot"]["eab_kid"] = os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = resp["eab_kid"]
env_vars["certbot"]["eab_hmac_key"] = os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = resp["eab_hmac_key"] env_vars["certbot"]["eab_hmac_key"] = os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = resp["eab_hmac_key"]
else: else:
os.environ["EASYHAPROXY_CERTBOT_EMAIL"] = "" del os.environ["EASYHAPROXY_CERTBOT_EMAIL"]
Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "Could not obtain ZeroSSL credentials " + resp["error"]["type"]) Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "Could not obtain ZeroSSL credentials " + resp["error"]["type"])
os.environ['EASYHAPROXY_CERTBOT_SERVER'] = env_vars["certbot"]["server"] os.environ['EASYHAPROXY_CERTBOT_SERVER'] = env_vars["certbot"]["server"]
@ -195,16 +202,17 @@ class DaemonizeHAProxy:
self.thread = Process(target=self.__start, args=()) self.thread = Process(target=self.__start, args=())
self.thread.start() self.thread.start()
def get_haproxy_command(self, action): def get_haproxy_command(self, action, pid_file="/run/haproxy.pid"):
custom_config_files = "" custom_config_files = ""
if len(list(self.get_custom_config_files().keys())) != 0: if len(list(self.get_custom_config_files().keys())) != 0:
custom_config_files = "-f %s" % (self.custom_config_folder) custom_config_files = "-f %s" % (self.custom_config_folder)
if action == "start": if action == "start":
return "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg %s -p /run/haproxy.pid -S /var/run/haproxy.sock" % (custom_config_files) return "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg %s -p %s -S /var/run/haproxy.sock" % (custom_config_files, pid_file)
else: else:
pid = "".join(Functions().run_bash(Functions.HAPROXY_LOG, "cat /run/haproxy.pid", log_output=False)) return_code, output = Functions().run_bash(Functions.HAPROXY_LOG, "cat %s" % pid_file, log_output=False)
return "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg %s -p /run/haproxy.pid -x /var/run/haproxy.sock -sf %s" % (custom_config_files, pid) pid = "".join(output)
return "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg %s -p %s -x /var/run/haproxy.sock -sf %s" % (custom_config_files, pid_file, pid)
def __prepare(self, command): def __prepare(self, command):
source = Functions.HAPROXY_LOG source = Functions.HAPROXY_LOG

2
src/processor/__init__.py
View file

@ -198,7 +198,7 @@ class Kubernetes(ProcessorInterface):
self.cert_cache = {} self.cert_cache = {}
super().__init__() super().__init__()
def _check_annotation(self, annotations, key, default = None): def _check_annotation(self, annotations, key, default=None):
if key not in annotations: if key not in annotations:
return default return default
return annotations[key] return annotations[key]

2
src/templates/bind.j2
View file

@ -1,5 +1,5 @@
{% if "ssl" in o %} {% if "ssl" in o %}
bind *:{{ o["port"] }} ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1 bind *:{{ o["port"] }} ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
{% elif "h2" in o and o["h2"] %} {% elif "h2" in o and o["h2"] %}
bind *:{{ o["port"] }} proto h2 bind *:{{ o["port"] }} proto h2
option http-use-htx option http-use-htx

2
src/tests/expected/docker.txt
View file

@ -36,7 +36,7 @@ backend srv_stats
server Local 127.0.0.1:1936 server Local 127.0.0.1:1936
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1 bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http mode http
acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local

2
src/tests/expected/services-letsencrypt.txt
View file

@ -74,7 +74,7 @@ backend srv_test2_example_org_80
server srv-0 83d57d592e26:8080 check weight 1 server srv-0 83d57d592e26:8080 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1 bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http mode http
acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org

2
src/tests/expected/services-redirect-ssl.txt
View file

@ -49,7 +49,7 @@ backend srv_host1_local_80
server srv-0 5b69bc7fea1b:80 check weight 1 server srv-0 5b69bc7fea1b:80 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1 bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http mode http
acl is_rule_host2_local_443_1 hdr(host) -i host2.local acl is_rule_host2_local_443_1 hdr(host) -i host2.local

2
src/tests/expected/services.txt
View file

@ -67,7 +67,7 @@ backend srv_node-exporter_quantum_example_org_31337
server srv-0 my-stack_node-exporter:9100 check weight 1 server srv-0 my-stack_node-exporter:9100 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1 bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }

2
src/tests/expected/static.txt
View file

@ -74,7 +74,7 @@ backend srv_host2_com_br_80
server srv-0 other:3000 check weight 1 server srv-0 other:3000 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1 bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http mode http
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br

37
src/tests/test_containerenv.py
View file

@ -13,7 +13,7 @@ def test_container_env_empty():
"haproxy": Functions.INFO, "haproxy": Functions.INFO,
"certbot": Functions.DEBUG, "certbot": Functions.DEBUG,
}, },
"certbot": {"autoconfig": "", "certbot": {"autoconfig": "",
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
@ -44,7 +44,7 @@ def test_container_env_customerrors():
"retry_count": 60} "retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_CUSTOMERRORS'] = '' del os.environ['HAPROXY_CUSTOMERRORS']
def test_container_env_sslmode(): def test_container_env_sslmode():
@ -67,7 +67,7 @@ def test_container_env_sslmode():
"retry_count": 60} "retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_SSL_MODE'] = '' del os.environ['EASYHAPROXY_SSL_MODE']
def test_container_env_stats(): def test_container_env_stats():
@ -91,8 +91,8 @@ def test_container_env_stats():
"retry_count": 60} "retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_USERNAME'] = '' del os.environ['HAPROXY_USERNAME']
os.environ['HAPROXY_STATS_PORT'] = '' del os.environ['HAPROXY_STATS_PORT']
def test_container_env_stats_password(): def test_container_env_stats_password():
@ -121,7 +121,7 @@ def test_container_env_stats_password():
"retry_count": 60} "retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_PASSWORD'] = '' del os.environ['HAPROXY_PASSWORD']
def test_container_env_stats_password_2(): def test_container_env_stats_password_2():
@ -151,9 +151,9 @@ def test_container_env_stats_password_2():
"retry_count": 60} "retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_USERNAME'] = '' del os.environ['HAPROXY_USERNAME']
os.environ['HAPROXY_STATS_PORT'] = '' del os.environ['HAPROXY_STATS_PORT']
os.environ['HAPROXY_PASSWORD'] = '' del os.environ['HAPROXY_PASSWORD']
def test_container_env_certbot_email(): def test_container_env_certbot_email():
@ -178,7 +178,7 @@ def test_container_env_certbot_email():
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = '' del os.environ['EASYHAPROXY_CERTBOT_EMAIL']
def test_container_env_certbot_full(): def test_container_env_certbot_full():
@ -192,10 +192,6 @@ def test_container_env_certbot_full():
"customerrors": False, "customerrors": False,
"ssl_mode": "default", "ssl_mode": "default",
"lookup_label": "easyhaproxy", "lookup_label": "easyhaproxy",
"letsencrypt": {
"email": "acme@example.org",
"server": True
},
"logLevel": { "logLevel": {
"easyhaproxy": Functions.DEBUG, "easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO, "haproxy": Functions.INFO,
@ -211,7 +207,12 @@ def test_container_env_certbot_full():
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' del os.environ['EASYHAPROXY_CERTBOT_EMAIL']
del os.environ['EASYHAPROXY_CERTBOT_SERVER']
del os.environ['EASYHAPROXY_CERTBOT_EAB_KID']
del os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY']
del os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT']
def test_container_log_level(): def test_container_log_level():
os.environ['CERTBOT_LOG_LEVEL'] = Functions.TRACE os.environ['CERTBOT_LOG_LEVEL'] = Functions.TRACE
@ -231,10 +232,12 @@ def test_container_log_level():
"autoconfig": "", "autoconfig": "",
'eab_hmac_key': "", 'eab_hmac_key': "",
'eab_kid': "", 'eab_kid': "",
"email": "acme@example.org", "email": "",
"server": False, "server": False,
"retry_count": 60 "retry_count": 60
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = '' del os.environ['CERTBOT_LOG_LEVEL']
del os.environ['EASYHAPROXY_LOG_LEVEL']
del os.environ['HAPROXY_LOG_LEVEL']

22
src/tests/test_daemonize.py
View file

@ -1,10 +1,7 @@
import json
import pytest
import os import os
import re
import random from functions import DaemonizeHAProxy, Functions
import string
from functions import DaemonizeHAProxy
def test_daemonize_haproxy(): def test_daemonize_haproxy():
daemon = DaemonizeHAProxy() daemon = DaemonizeHAProxy()
@ -38,7 +35,14 @@ def test_daemonize_haproxy_get_haproxy_command_start():
command = daemon.get_haproxy_command("start") command = daemon.get_haproxy_command("start")
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f %s -p /run/haproxy.pid -S /var/run/haproxy.sock" % (os.path.dirname(__file__) + "/fixtures") assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f %s -p /run/haproxy.pid -S /var/run/haproxy.sock" % (os.path.dirname(__file__) + "/fixtures")
def test_daemonize_haproxy_get_haproxy_command_reload(): def test_daemonize_haproxy_get_haproxy_command_reload():
daemon = DaemonizeHAProxy(os.path.abspath(os.path.dirname(__file__)) + '/fixtures') tmp_pid_file = "/tmp/tmp_pid.txt"
command = daemon.get_haproxy_command("reload") Functions.save(tmp_pid_file, "10")
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f %s -p /run/haproxy.pid -x /var/run/haproxy.sock -sf " % (os.path.dirname(__file__) + "/fixtures")
try:
daemon = DaemonizeHAProxy(os.path.abspath(os.path.dirname(__file__)) + '/fixtures')
command = daemon.get_haproxy_command("reload", tmp_pid_file)
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f %s -p %s -x /var/run/haproxy.sock -sf %s" % (os.path.dirname(__file__) + "/fixtures", tmp_pid_file, 10)
finally:
os.remove(tmp_pid_file)

2
src/tests/test_docker.py
View file

@ -100,7 +100,7 @@ def test_processor_docker():
'hostssl.local.pem': 'Some PEM Certificate' 'hostssl.local.pem': 'Some PEM Certificate'
} }
finally: finally:
os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = '' del os.environ['EASYHAPROXY_CERTBOT_EMAIL']
container.stop() container.stop()
container2.stop() container2.stop()

8
src/tests/test_functions.py
View file

@ -13,15 +13,15 @@ def test_functions_check_local_level():
os.environ['CERTBOT_LOG_LEVEL'] = 'warn' os.environ['CERTBOT_LOG_LEVEL'] = 'warn'
assert Functions.skip_log('CERTBOT', Functions.INFO) == True assert Functions.skip_log('CERTBOT', Functions.INFO) == True
os.environ['CERTBOT_LOG_LEVEL'] = '' del os.environ['CERTBOT_LOG_LEVEL']
os.environ['HAPROXY_LOG_LEVEL'] = 'warn' os.environ['HAPROXY_LOG_LEVEL'] = 'warn'
assert Functions.skip_log('HAPROXY', Functions.INFO) == True assert Functions.skip_log('HAPROXY', Functions.INFO) == True
os.environ['HAPROXY_LOG_LEVEL'] = '' del os.environ['HAPROXY_LOG_LEVEL']
os.environ['EASYHAPROXY_LOG_LEVEL'] = 'warn' os.environ['EASYHAPROXY_LOG_LEVEL'] = 'warn'
assert Functions.skip_log('EASYHAPROXY', Functions.INFO) == True assert Functions.skip_log('EASYHAPROXY', Functions.INFO) == True
os.environ['EASYHAPROXY_LOG_LEVEL'] = '' del os.environ['EASYHAPROXY_LOG_LEVEL']
def test_function_load_and_save(): def test_function_load_and_save():
@ -57,7 +57,7 @@ def test_functions_check_log_sanity():
assert len(Functions.debug_log) == 2 assert len(Functions.debug_log) == 2
finally: finally:
os.environ['EASYHAPROXY_LOG_LEVEL'] = '' del os.environ['EASYHAPROXY_LOG_LEVEL']
Functions.debug_log = None Functions.debug_log = None