badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Added Retry Count

Browse source
This commit is contained in:
Joao Gilberto Magalhaes 2023-07-02 11:19:51 -05:00
parent ac1b84a842
commit 4bb1c7931d
4 changed files with 21 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/acme.md
View file

@ -13,6 +13,7 @@ To enable the ACME protocol we need to enable Certbot in EasyHAProxy by setting
- EASYHAPROXY_CERTBOT_SERVER (optional): The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below. - EASYHAPROXY_CERTBOT_SERVER (optional): The ACME Endpoint of your certificate authority. If you use AUTOCONFIG, it is set automatically. See table below.
- EASYHAPROXY_CERTBOT_EAB_KID (optional): External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below. - EASYHAPROXY_CERTBOT_EAB_KID (optional): External Account Binding (EAB) Key Identifier (KID) provided by your certificate authority. Some CA require it. See table below.
- EASYHAPROXY_CERTBOT_EAB_HMAC_KEY (optional): External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below. - EASYHAPROXY_CERTBOT_EAB_HMAC_KEY (optional): External Account Binding (EAB) HMAC Key provided by your certificate authority. Some CA require it. See table below.
- EASYHAPROXY_CERTBOT_RETRY_COUNT (optional): Wait 'n' requests before retrying issue invalid requests. Default 60.
Here are detailed instructions per Certificate Authority (CA). If anyone is missing, please let's know. Here are detailed instructions per Certificate Authority (CA). If anyone is missing, please let's know.

1
docs/docker-environment.md
View file

@ -8,6 +8,7 @@
| EASYHAPROXY_CERTBOT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld', if using other service than Letsencrypt. Might be necessary set EASYHAPROXY_CERTBOT_EAB_KID and EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | *empty* | | EASYHAPROXY_CERTBOT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld', if using other service than Letsencrypt. Might be necessary set EASYHAPROXY_CERTBOT_EAB_KID and EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | *empty* |
| EASYHAPROXY_CERTBOT_EAB_KID | (Optional) eab-kid configuration when required. | *empty* | | EASYHAPROXY_CERTBOT_EAB_KID | (Optional) eab-kid configuration when required. | *empty* |
| EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | (Optional) eab-kid-hmac-key configuration when required. | *empty* | | EASYHAPROXY_CERTBOT_EAB_HMAC_KEY | (Optional) eab-kid-hmac-key configuration when required. | *empty* |
| EASYHAPROXY_CERTBOT_RETRY_COUNT | (Optional) Wait 'n' requests before try re-issue invalid calls |
| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` | | EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` |
| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 | | EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | | EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |

4
src/functions/__init__.py
View file

@ -33,6 +33,7 @@ class ContainerEnv:
"server": os.getenv("EASYHAPROXY_CERTBOT_SERVER", False), "server": os.getenv("EASYHAPROXY_CERTBOT_SERVER", False),
"eab_kid": os.getenv("EASYHAPROXY_CERTBOT_EAB_KID", ""), "eab_kid": os.getenv("EASYHAPROXY_CERTBOT_EAB_KID", ""),
"eab_hmac_key": os.getenv("EASYHAPROXY_CERTBOT_EAB_HMAC_KEY", ""), "eab_hmac_key": os.getenv("EASYHAPROXY_CERTBOT_EAB_HMAC_KEY", ""),
"retry_count": int(os.getenv("EASYHAPROXY_CERTBOT_RETRY_COUNT", 60)),
} }
if env_vars["certbot"]["autoconfig"] != "" and not env_vars["certbot"]["server"] and env_vars["certbot"]["email"] != "": if env_vars["certbot"]["autoconfig"] != "" and not env_vars["certbot"]["server"] and env_vars["certbot"]["email"] != "":
@ -260,6 +261,7 @@ class Certbot:
self.eab_kid = self.set_eab_kid(env["certbot"]["eab_kid"]) self.eab_kid = self.set_eab_kid(env["certbot"]["eab_kid"])
self.eab_hmac_key = self.set_eab_hmac_key(env["certbot"]["eab_hmac_key"]) self.eab_hmac_key = self.set_eab_hmac_key(env["certbot"]["eab_hmac_key"])
self.freeze_issue = {} self.freeze_issue = {}
self.retry_count = env["certbot"]["retry_count"]
@staticmethod @staticmethod
def set_acme_server(acme_server): def set_acme_server(acme_server):
@ -395,5 +397,5 @@ class Certbot:
host = host[3:] host = host[3:]
cert_status = self.get_certificate_status(host) cert_status = self.get_certificate_status(host)
if cert_status != "ok": if cert_status != "ok":
self.freeze_issue[host] = 5 self.freeze_issue[host] = self.retry_count
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Freeze issuing ssl for %s due failure. The certificate is %s" % (host, cert_status)) Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Freeze issuing ssl for %s due failure. The certificate is %s" % (host, cert_status))

23
src/tests/test_containerenv.py
View file

@ -12,7 +12,8 @@ def test_container_env_empty():
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
"server": False} "server": False,
"retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
# os.environ['CERTBOT_LOG_LEVEL'] = 'warn' # os.environ['CERTBOT_LOG_LEVEL'] = 'warn'
@ -29,7 +30,8 @@ def test_container_env_customerrors():
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
"server": False} "server": False,
"retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_CUSTOMERRORS'] = '' os.environ['HAPROXY_CUSTOMERRORS'] = ''
@ -46,7 +48,8 @@ def test_container_env_sslmode():
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
"server": False} "server": False,
"retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_SSL_MODE'] = '' os.environ['EASYHAPROXY_SSL_MODE'] = ''
@ -64,7 +67,8 @@ def test_container_env_stats():
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
"server": False} "server": False,
"retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_USERNAME'] = '' os.environ['HAPROXY_USERNAME'] = ''
@ -88,7 +92,8 @@ def test_container_env_stats_password():
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
"server": False} "server": False,
"retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_PASSWORD'] = '' os.environ['HAPROXY_PASSWORD'] = ''
@ -112,7 +117,8 @@ def test_container_env_stats_password_2():
"eab_hmac_key": "", "eab_hmac_key": "",
"eab_kid": "", "eab_kid": "",
"email": "", "email": "",
"server": False} "server": False,
"retry_count": 60}
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['HAPROXY_USERNAME'] = '' os.environ['HAPROXY_USERNAME'] = ''
@ -132,7 +138,8 @@ def test_container_env_certbot_email():
'eab_hmac_key': "", 'eab_hmac_key': "",
'eab_kid': "", 'eab_kid': "",
"email": "acme@example.org", "email": "acme@example.org",
"server": False "server": False,
"retry_count": 60
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
@ -144,6 +151,7 @@ def test_container_env_certbot_full():
os.environ['EASYHAPROXY_CERTBOT_SERVER'] = 'schema://url/a' os.environ['EASYHAPROXY_CERTBOT_SERVER'] = 'schema://url/a'
os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = 'eab_kid' os.environ['EASYHAPROXY_CERTBOT_EAB_KID'] = 'eab_kid'
os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = 'eab_hmac_key' os.environ['EASYHAPROXY_CERTBOT_EAB_HMAC_KEY'] = 'eab_hmac_key'
os.environ['EASYHAPROXY_CERTBOT_RETRY_COUNT'] = "10"
try: try:
assert { assert {
"customerrors": False, "customerrors": False,
@ -155,6 +163,7 @@ def test_container_env_certbot_full():
"server": "schema://url/a", "server": "schema://url/a",
'eab_hmac_key': 'eab_hmac_key', 'eab_hmac_key': 'eab_hmac_key',
'eab_kid': 'eab_kid', 'eab_kid': 'eab_kid',
'retry_count': 10
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally: