diff --git a/docs/acme.md b/docs/acme.md index 9de7088..5c24fdf 100644 --- a/docs/acme.md +++ b/docs/acme.md @@ -13,6 +13,7 @@ To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting - EASYHAPROXY_CERTBOT_SERVER (optional): The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below. - EASYHAPROXY_CERTBOT_EAB_KID (optional): External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below. - EASYHAPROXY_CERTBOT_EAB_HMAC_KEY (optional): External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below. +- EASYHAPROXY_CERTBOT_RETRY_COUNT (optional): Wait 'n' requests before retrying issue invalid requests. Default 60. Here are detailed instructions per Certificate Authority (CA). If anyone is missing, please let's know. diff --git a/docs/docker-environment.md b/docs/docker-environment.md index 54cb3e9..2415e82 100644 --- a/docs/docker-environment.md +++ b/docs/docker-environment.md @@ -8,6 +8,7 @@ | EASYHAPROXY_CERTBOT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld', if using other service than Letsencrypt. Might be necessary set EASYHAPROXY_CERTBOT_EAB_KID and EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | *empty* | | EASYHAPROXY_CERTBOT_EAB_KID | (Optional) eab-kid configuration when required. | *empty* | | EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | (Optional) eab-kid-hmac-key configuration when required. | *empty* | +| EASYHAPROXY_CERTBOT_RETRY_COUNT | (Optional) Wait 'n' requests before try re-issue invalid calls | | EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` | | EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 | | EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | diff --git a/src/functions/__init__.py b/src/functions/__init__.py index c5e8c99..a331697 100644 --- a/src/functions/__init__.py +++ b/src/functions/__init__.py @@ -33,6 +33,7 @@ class ContainerEnv: "server": os.getenv("EASYHAPROXY_CERTBOT_SERVER", False), "eab_kid": os.getenv("EASYHAPROXY_CERTBOT_EAB_KID", ""), "eab_hmac_key": os.getenv("EASYHAPROXY_CERTBOT_EAB_HMAC_KEY", ""), + "retry_count": int(os.getenv("EASYHAPROXY_CERTBOT_RETRY_COUNT", 60)), } if env_vars["certbot"]["autoconfig"] != "" and not env_vars["certbot"]["server"] and env_vars["certbot"]["email"] != "": @@ -260,6 +261,7 @@ class Certbot: self.eab_kid = self.set_eab_kid(env["certbot"]["eab_kid"]) self.eab_hmac_key = self.set_eab_hmac_key(env["certbot"]["eab_hmac_key"]) self.freeze_issue = {} + self.retry_count = env["certbot"]["retry_count"] @staticmethod def set_acme_server(acme_server): @@ -395,5 +397,5 @@ class Certbot: host = host[3:] cert_status = self.get_certificate_status(host) if cert_status != "ok": - self.freeze_issue[host] = 5 + self.freeze_issue[host] = self.retry_count Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Freeze issuing ssl for %s due failure. The certificate is %s" % (host, cert_status)) diff --git a/src/tests/test_containerenv.py b/src/tests/test_containerenv.py index 46df944..beac0c1 100644 --- a/src/tests/test_containerenv.py +++ b/src/tests/test_containerenv.py @@ -12,7 +12,8 @@ def test_container_env_empty(): "eab_hmac_key": "", "eab_kid": "", "email": "", - "server": False} + "server": False, + "retry_count": 60} } == ContainerEnv.read() # os.environ['CERTBOT_LOG_LEVEL'] = 'warn' @@ -29,7 +30,8 @@ def test_container_env_customerrors(): "eab_hmac_key": "", "eab_kid": "", "email": "", - "server": False} + "server": False, + "retry_count": 60} } == ContainerEnv.read() finally: os.environ['HAPROXY_CUSTOMERRORS'] = '' @@ -46,7 +48,8 @@ def test_container_env_sslmode(): "eab_hmac_key": "", "eab_kid": "", "email": "", - "server": False} + "server": False, + "retry_count": 60} } == ContainerEnv.read() finally: os.environ['EASYHAPROXY_SSL_MODE'] = '' @@ -64,7 +67,8 @@ def test_container_env_stats(): "eab_hmac_key": "", "eab_kid": "", "email": "", - "server": False} + "server": False, + "retry_count": 60} } == ContainerEnv.read() finally: os.environ['HAPROXY_USERNAME'] = '' @@ -88,7 +92,8 @@ def test_container_env_stats_password(): "eab_hmac_key": "", "eab_kid": "", "email": "", - "server": False} + "server": False, + "retry_count": 60} } == ContainerEnv.read() finally: os.environ['HAPROXY_PASSWORD'] = '' @@ -112,7 +117,8 @@ def test_container_env_stats_password_2(): "eab_hmac_key": "", "eab_kid": "", "email": "", - "server": False} + "server": False, + "retry_count": 60} } == ContainerEnv.read() finally: os.environ['HAPROXY_USERNAME'] = '' @@ -132,7 +138,8 @@ def test_container_env_certbot_email(): 'eab_hmac_key': "", 'eab_kid': "", "email": "acme@example.org", - "server": False + "server": False, + "retry_count": 60 } } == ContainerEnv.read() finally: @@ -144,6 +151,7 @@ def test_container_env_certbot_full(): os.environ['EASYHAPROXY_CERTBOT_SERVER'] = 'schema://url/a' os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = 'eab_kid' os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = 'eab_hmac_key' + os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT'] = "10" try: assert { "customerrors": False, @@ -155,6 +163,7 @@ def test_container_env_certbot_full(): "server": "schema://url/a", 'eab_hmac_key': 'eab_hmac_key', 'eab_kid': 'eab_kid', + 'retry_count': 10 } } == ContainerEnv.read() finally: