diff --git a/docs/environment-variable.md b/docs/environment-variable.md index 68ad738..5b4a7e5 100644 --- a/docs/environment-variable.md +++ b/docs/environment-variable.md @@ -4,21 +4,22 @@ sidebar_position: 12 # Docker environment variables -| Environment Variable | Description | Default | -|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------| -| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** | -| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` | -| EASYHAPROXY_BASE_PATH | (Optional) Base directory for all EasyHAProxy files. All paths (config, certs, plugins, www) are constructed relative to this base. | `/etc/easyhaproxy` | -| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md) | *empty* | -| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` | -| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 | -| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | -| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | -| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | INFO | -| HAPROXY_USERNAME | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set). | `admin` | -| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined. | *empty* | -| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined. | `1936` | -| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` | +| Environment Variable | Description | Default | +|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------| +| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** | +| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` | +| EASYHAPROXY_BASE_PATH | (Optional) Base directory for all EasyHAProxy files. All paths (config, certs, plugins, www) are constructed relative to this base. | `/etc/easyhaproxy` | +| EASYHAPROXY_CERTBOT_* | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](acme.md) | *empty* | +| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` | +| EASYHAPROXY_REFRESH_CONF | (Optional) Check for new containers/services every N seconds. | 10 | +| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | +| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | +| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | INFO | +| HAPROXY_USERNAME | (Optional) The HAProxy username for the statistics endpoint (used only when `HAPROXY_PASSWORD` is set). | `admin` | +| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics endpoint. Stats are **disabled** unless this is defined. | *empty* | +| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics. Only applies when `HAPROXY_PASSWORD` is defined. | `1936` | +| HAPROXY_STATS_CORS_ORIGIN | (Optional) Enable CORS for the HAProxy stats dashboard by specifying the allowed origin (e.g., `http://localhost:3000`). Only applies when `HAPROXY_PASSWORD` is defined. | *empty* | +| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` | :::tip HAProxy Stats Statistics are only configured when `HAPROXY_PASSWORD` is set. Without a password, the stats section is not generated. diff --git a/pyproject.toml b/pyproject.toml index 07f707a..ac56447 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -68,6 +68,7 @@ markers = [ "custom_label: marks tests for custom label prefix functionality", "static: marks tests for static configuration mode", "acme: marks tests for certbot/acme", + "proxy_headers: marks tests for proxy headers", ] [tool.ruff] diff --git a/src/functions/__init__.py b/src/functions/__init__.py index 3547061..7030186 100644 --- a/src/functions/__init__.py +++ b/src/functions/__init__.py @@ -39,6 +39,7 @@ class ContainerEnv: "username": os.getenv("HAPROXY_USERNAME") if os.getenv("HAPROXY_USERNAME") else "admin", "password": os.getenv("HAPROXY_PASSWORD"), "port": os.getenv("HAPROXY_STATS_PORT") if os.getenv("HAPROXY_STATS_PORT") else "1936", + "cors_origin": os.getenv("HAPROXY_STATS_CORS_ORIGIN", ""), } env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv( @@ -149,6 +150,8 @@ class ContainerEnv: os.environ['HAPROXY_PASSWORD'] = str(stats['password']) if 'port' in stats: os.environ['HAPROXY_STATS_PORT'] = str(stats['port']) + if 'cors_origin' in stats: + os.environ['HAPROXY_STATS_CORS_ORIGIN'] = str(stats['cors_origin']) # Convert logLevel if 'logLevel' in yaml_config: @@ -333,10 +336,12 @@ class DaemonizeHAProxy: self.custom_config_folder = custom_config_folder if custom_config_folder is not None else Consts.custom_config_folder def haproxy(self, action): - self.__prepare(self.get_haproxy_command(action)) + error = self.__prepare(self.get_haproxy_command(action), action) - if self.process is None: - return + if error or self.process is None: + logger_haproxy.fatal(f"Failed to start HAProxy ({action}). Exiting.") + import sys + sys.exit(1) self.thread = Process(target=self.__start, args=()) self.thread.start() @@ -360,10 +365,42 @@ class DaemonizeHAProxy: ) return self.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START, pid_file) - def __prepare(self, command): + def __validate_config(self): + """Validate HAProxy configuration before starting.""" + validation_cmd = ["haproxy", "-c", "-f", Consts.haproxy_config] + + # Add custom config files if they exist + for config_file in self.get_custom_config_files().keys(): + validation_cmd.extend(["-f", config_file]) + + try: + result = subprocess.run( + validation_cmd, + capture_output=True, + text=True, + timeout=10 + ) + + if result.returncode != 0: + return result.stderr if result.stderr else result.stdout + return None + + except subprocess.TimeoutExpired: + return "HAProxy configuration validation timed out" + except Exception as e: + return f"Error validating configuration: {e}" + + def __prepare(self, command, action=None): if not isinstance(command, (list, tuple)): command = shlex.split(command) + # Validate HAProxy config before starting (but not on reload - HAProxy validates itself during reload) + if action == DaemonizeHAProxy.HAPROXY_START: + validation_error = self.__validate_config() + if validation_error: + logger_haproxy.fatal(f"HAProxy configuration validation failed:\n{validation_error}") + return validation_error + try: logger_haproxy.debug(f"HAPROXY command: {command}") self.process = subprocess.Popen(command, @@ -372,9 +409,12 @@ class DaemonizeHAProxy: stderr=subprocess.PIPE, bufsize=-1, universal_newlines=True) + return None except Exception as e: - logger_haproxy.error(f"{e}") + error_msg = f"Failed to start HAProxy process: {e}" + logger_haproxy.error(error_msg) + return error_msg def __start(self): try: diff --git a/src/templates/haproxy.cfg.j2 b/src/templates/haproxy.cfg.j2 index f2ef363..0096549 100644 --- a/src/templates/haproxy.cfg.j2 +++ b/src/templates/haproxy.cfg.j2 @@ -62,6 +62,23 @@ frontend stats bind *:{{ data_stats["port"] | default(1936) }} mode http http-request use-service prometheus-exporter if { path /metrics } +{%- if data_stats["cors_origin"] | default("") != "" %} + + # CORS for stats dashboard (only for configured origin) + acl from_ui hdr(Origin) -i {{ data_stats["cors_origin"] }} + acl preflight method OPTIONS + + # Preflight response + http-request return status 204 hdr "Access-Control-Allow-Origin" "%[req.hdr(Origin)]" hdr "Access-Control-Allow-Methods" "GET, OPTIONS" hdr "Access-Control-Allow-Headers" "Authorization, Content-Type" hdr "Access-Control-Max-Age" "86400" hdr "Vary" "Origin" if from_ui preflight + + # Actual response headers + http-after-response set-header Access-Control-Allow-Origin "{{ data_stats["cors_origin"] }}" + http-after-response set-header Access-Control-Allow-Methods "GET, OPTIONS" + http-after-response set-header Access-Control-Allow-Headers "Authorization, Content-Type" + http-after-response set-header Access-Control-Expose-Headers "X-Request-ID" + http-after-response set-header Vary "Origin" +{% endif %} + stats enable stats hide-version stats realm Haproxy\ Statistics diff --git a/tests/expected/static-cors.txt b/tests/expected/static-cors.txt new file mode 100644 index 0000000..b6f6304 --- /dev/null +++ b/tests/expected/static-cors.txt @@ -0,0 +1,77 @@ +global + log stdout format raw local0 info + maxconn 2000 + tune.ssl.default-dh-param 2048 + + # intermediate configuration + ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 + ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + + ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 + ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + + ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam + +defaults + log global + unique-id-format %{+X}o\ %ci:%cp_%fi:%fp_%Ts_%rt:%pid + unique-id-header X-Edge-Request-ID + option httplog + + timeout connect 3s + timeout client 10s + timeout server 10m + + +frontend stats + bind *:1936 + mode http + http-request use-service prometheus-exporter if { path /metrics } + # CORS for stats dashboard (only for configured origin) + acl from_ui hdr(Origin) -i http://localhost:3000 + acl preflight method OPTIONS + + # Preflight response + http-request return status 204 hdr "Access-Control-Allow-Origin" "%[req.hdr(Origin)]" hdr "Access-Control-Allow-Methods" "GET, OPTIONS" hdr "Access-Control-Allow-Headers" "Authorization, Content-Type" hdr "Access-Control-Max-Age" "86400" hdr "Vary" "Origin" if from_ui preflight + + # Actual response headers + http-after-response set-header Access-Control-Allow-Origin "http://localhost:3000" + http-after-response set-header Access-Control-Allow-Methods "GET, OPTIONS" + http-after-response set-header Access-Control-Allow-Headers "Authorization, Content-Type" + http-after-response set-header Access-Control-Expose-Headers "X-Request-ID" + http-after-response set-header Vary "Origin" + + stats enable + stats hide-version + stats realm Haproxy\ Statistics + stats uri / + stats auth admin:test123 + default_backend srv_stats + +backend srv_stats + mode http + server Local 127.0.0.1:1936 + +frontend http_in_80 + bind *:80 + mode http + + acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br + acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80 + use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2 + +backend srv_host1_com_br_80 + balance roundrobin + mode http + option forwardfor + http-request set-header X-Forwarded-Port %[dst_port] + http-request add-header X-Forwarded-Proto https if { ssl_fc } + http-request set-header X-Forwarded-Host %[req.hdr(Host)] + http-request set-header X-Request-ID %[uuid()] + server srv-0 container:5000 check weight 1 + +backend certbot_backend + mode http + server certbot 127.0.0.1:2080 diff --git a/tests/fixtures/static_cors.yml b/tests/fixtures/static_cors.yml new file mode 100644 index 0000000..a252ec0 --- /dev/null +++ b/tests/fixtures/static_cors.yml @@ -0,0 +1,11 @@ +stats: + username: admin + password: test123 + port: 1936 + cors_origin: http://localhost:3000 + +customerrors: false + +containers: + "host1.com.br:80": + ip: ["container:5000"] \ No newline at end of file diff --git a/tests/test_containerenv.py b/tests/test_containerenv.py index 41016d1..e80e602 100644 --- a/tests/test_containerenv.py +++ b/tests/test_containerenv.py @@ -149,8 +149,8 @@ def test_container_env_stats_password(): "stats": { "username": "admin", "password": "xyz", - "port": "1936" - + "port": "1936", + "cors_origin": "" }, "logLevel": { "easyhaproxy": Functions.DEBUG, @@ -191,7 +191,8 @@ def test_container_env_stats_password_2(): "stats": { "username": "abc", "password": "xyz", - "port": "2101" + "port": "2101", + "cors_origin": "" }, "logLevel": { "easyhaproxy": Functions.DEBUG, diff --git a/tests/test_static.py b/tests/test_static.py index 486b908..a885783 100644 --- a/tests/test_static.py +++ b/tests/test_static.py @@ -90,4 +90,36 @@ def test_processor_static_multiple_domains_same_container(): # Both should point to the same container assert haproxy_cfg.count('server srv-0 webapp:8080') == 2 + +def test_processor_static_with_cors(): + """Test that CORS configuration is properly generated when cors_origin is set""" + ProcessorInterface.static_file = os.path.join( + os.path.dirname(os.path.realpath(__file__)), + "./fixtures/static_cors.yml" + ) + static = ProcessorInterface.factory(ProcessorInterface.STATIC) + + haproxy_cfg = static.get_haproxy_conf() + + # Verify CORS configuration is present in stats frontend + assert '# CORS for stats dashboard (only for configured origin)' in haproxy_cfg + assert 'acl from_ui hdr(Origin) -i http://localhost:3000' in haproxy_cfg + assert 'acl preflight method OPTIONS' in haproxy_cfg + + # Verify preflight response + assert 'http-request return status 204' in haproxy_cfg + assert 'hdr "Access-Control-Allow-Origin"' in haproxy_cfg + assert 'hdr "Access-Control-Allow-Methods" "GET, OPTIONS"' in haproxy_cfg + assert 'hdr "Access-Control-Allow-Headers" "Authorization, Content-Type"' in haproxy_cfg + assert 'if from_ui preflight' in haproxy_cfg + + # Verify actual response headers (no ACL condition in response phase) + assert 'http-after-response set-header Access-Control-Allow-Origin "http://localhost:3000"' in haproxy_cfg + assert 'http-after-response set-header Access-Control-Expose-Headers "X-Request-ID"' in haproxy_cfg + assert 'http-after-response set-header Vary "Origin"' in haproxy_cfg + + # Verify the full config matches expected + assert haproxy_cfg == Functions.load( + os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/static-cors.txt")) + # test_processor_static()