diff --git a/README.md b/README.md index ac4d522..0c9380e 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ EasyHAProxy can detect and configure HAProxy automatically on the following plat EasyHAProxy will discover the services based on the Docker Tags of the containers running on a Docker host or Docker Swarm cluster and dynamically set up the `haproxy.cfg`. Below, EasyHAProxy main features: -- Use Letsencrypt with HAProxy. +- Automatic SSL Certificate issued by any ACME compatible service as Letsencrypt and ZeroSSL - Set your custom SSL certificates - Balance traffic between multiple replicas - Set SSL with three different levels of validations and according to the most recent definitions. diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml index 2586815..2c3284f 100644 --- a/deploy/docker/docker-compose.yml +++ b/deploy/docker/docker-compose.yml @@ -5,13 +5,13 @@ services: image: byjg/easy-haproxy:4.3.1-rc1 volumes: - /var/run/docker.sock:/var/run/docker.sock - - certs_letsencrypt:/certs/letsencrypt + - certs_certbot:/certs/certbot - certs_haproxy:/certs/haproxy environment: EASYHAPROXY_DISCOVER: docker EASYHAPROXY_LABEL_PREFIX: easyhaproxy - EASYHAPROXY_LETSENCRYPT_EMAIL: changeme@example.org + EASYHAPROXY_CERTBOT_EMAIL: changeme@example.org EASYHAPROXY_SSL_MODE: "default" HAPROXY_CUSTOMERRORS: "true" HAPROXY_USERNAME: admin @@ -27,7 +27,7 @@ services: - easyhaproxy volumes: - certs_letsencrypt: + certs_certbot: external: true certs_haproxy: external: true diff --git a/deploy/docker/install.sh b/deploy/docker/install.sh index d5ab2ff..366b146 100755 --- a/deploy/docker/install.sh +++ b/deploy/docker/install.sh @@ -3,7 +3,7 @@ ASSETS_DIR="$(dirname "${BASH_SOURCE[0]}")"/../../build/assets/certs/haproxy docker network create easyhaproxy -docker volume create certs_letsencrypt +docker volume create certs_certbot docker volume create certs_haproxy docker run -d --rm --name easyhaproxy_install -v certs_haproxy:/certs alpine tail -f /dev/null diff --git a/docs/container-labels.md b/docs/container-labels.md index b71cecb..56b5a1f 100644 --- a/docs/container-labels.md +++ b/docs/container-labels.md @@ -2,19 +2,19 @@ ## Container (Docker or Swarm) labels -| Tag | Description | Default | Example | -|---------------------------------------|-------------------------------------------------------------------------------------------------------|----------------|--------------| -| easyhaproxy.[definition].host | Host(s) HAProxy is listening. More than one host use comma as delimiter | **required** | somehost.com OR host1.com,host2.com | -| easyhaproxy.[definition].mode | (Optional) Is this `http` or `tcp` mode in HAProxy. | http | http or tcp | -| easyhaproxy.[definition].port | (Optional) Port HAProxy will listen for the host. | 80 | 3000 | -| easyhaproxy.[definition].localport | (Optional) Port container is listening. | 80 | 8080 | -| easyhaproxy.[definition].redirect | (Optional) JSON containing key/value pair from host/to URL redirect. | *empty* | {"foo.com":"https://bla.com", "bar.com":"https://bar.org"} | -| easyhaproxy.[definition].sslcert | (Optional) Cert PEM Base64 encoded. Do not use this if `letsencrypt` is enabled. | *empty* | base64 cert + key | -| easyhaproxy.[definition].ssl | (Optional) If `true` you need to provide certificate as a file. See below. Do not use with `sslcert`. | false | true or false | -| easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` | *empty* | ssl | -| easyhaproxy.[definition].letsencrypt | (Optional) Generate certificate with letsencrypt. Do not use with `sslcert` parameter. | false | true OR false | -| easyhaproxy.[definition].redirect_ssl | (Optional) Redirect all requests to https | false | true OR false | -| easyhaproxy.[definition].clone_to_ssl | (Optional) It copies the configuration to HTTPS(443) and disable SSL from the current config. **Do not use* this with `ssl` or `letsencrypt` parameters | false | true OR false | +| Tag | Description | Default | Example | +|---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------|------------------------------------------------------------| +| easyhaproxy.[definition].host | Host(s) HAProxy is listening. More than one host use comma as delimiter | **required** | somehost.com OR host1.com,host2.com | +| easyhaproxy.[definition].mode | (Optional) Is this `http` or `tcp` mode in HAProxy. | http | http or tcp | +| easyhaproxy.[definition].port | (Optional) Port HAProxy will listen for the host. | 80 | 3000 | +| easyhaproxy.[definition].localport | (Optional) Port container is listening. | 80 | 8080 | +| easyhaproxy.[definition].redirect | (Optional) JSON containing key/value pair from host/to URL redirect. | *empty* | {"foo.com":"https://bla.com", "bar.com":"https://bar.org"} | +| easyhaproxy.[definition].sslcert | (Optional) Cert PEM Base64 encoded. Do not use this if `certbot` is enabled. | *empty* | base64 cert + key | +| easyhaproxy.[definition].ssl | (Optional) If `true` you need to provide certificate as a file. See below. Do not use with `sslcert`. | false | true or false | +| easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` | *empty* | ssl | +| easyhaproxy.[definition].certbot | (Optional) Generate certificate with certbot. Do not use with `sslcert` parameter. | false | true OR false | +| easyhaproxy.[definition].redirect_ssl | (Optional) Redirect all requests to https | false | true OR false | +| easyhaproxy.[definition].clone_to_ssl | (Optional) It copies the configuration to HTTPS(443) and disable SSL from the current config. **Do not use* this with `ssl` or `certbot` parameters | false | true OR false | The `definition` is a string that will group all configurations togethers. Different `definition` will create different configurations. diff --git a/docs/docker-environment.md b/docs/docker-environment.md index 0b9ec11..b78e829 100644 --- a/docs/docker-environment.md +++ b/docs/docker-environment.md @@ -1,20 +1,20 @@ # Docker environment variables -| Environment Variable | Description | Default | -|---------------------------------|-------------------------------------------------------------------------------------------------|------------------| -| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** | -| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` | -| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | *empty* | -| EASYHAPROXY_LETSENCRYPT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld'. If set, will try to connect to the Letsencrypt test server | *empty* | -| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`| -| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 | -| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | -| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | -| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | -| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` | -| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* | -| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` | -| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` | +| Environment Variable | Description | Default | +|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------| +| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** | +| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` | +| EASYHAPROXY_CERTBOT_EMAIL | (Optional) The email will be used to request the certificate to Certbox | *empty* | +| EASYHAPROXY_CERTBOT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld'. If set, will try to connect to the Certbot test server | *empty* | +| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` | +| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 | +| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | +| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | +| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | +| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` | +| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* | +| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` | +| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` | diff --git a/docs/docker.md b/docs/docker.md index e8d85e4..edf9fc6 100644 --- a/docs/docker.md +++ b/docs/docker.md @@ -58,6 +58,10 @@ You can configure the behavior of the EasyHAProxy by setup specific environment Follow [this link](letsencrypt.md) +## Setup certificates with ZeroSSL + +Follow [this link](zerossl.md) + ## Setup your own certificates Follow [this link](ssl.md) diff --git a/docs/helm.md b/docs/helm.md index 376d5ff..ae35f59 100644 --- a/docs/helm.md +++ b/docs/helm.md @@ -51,7 +51,7 @@ easyhaproxy: certbot: DEBUG easyhaproxy: DEBUG haproxy: DEBUG - letsencrypt: + certbot: email: "" service: diff --git a/docs/kubernetes.md b/docs/kubernetes.md index 8b65f6f..005687d 100644 --- a/docs/kubernetes.md +++ b/docs/kubernetes.md @@ -79,27 +79,27 @@ Caveats: ## Kubernetes annotations -| annotation | Description | Default | Example | -|-----------------------------|-----------------------------------------------------------------------------------------|--------------|--------------| -| kubernetes.io/ingress.class | (required) Activate EasyHAProxy. | **required** | easyhaproxy-ingress -| easyhaproxy.redirect_ssl | (optional) Boolean. Force redirect all endpoints to HTTPS. | false | true or false -| easyhaproxy.letsencrypt | (optional) Boolean. It will request letsencrypt certificates for the ingresses domains. | false | true or false -| easyhaproxy.redirect | (optional) JSON. Key pair with a domain and its destination. | *empty* | {"domain":"redirect_url"} -| easyhaproxy.mode | (optional) Set the HTTP mode for that connection. | http | http or tcp -| easyhaproxy.listen_port | (optional) Set the an additional port for that ingress | http | http or tcp +| annotation | Description | Default | Example | +|-----------------------------|-------------------------------------------------------------------------------------|--------------|---------------------------| +| kubernetes.io/ingress.class | (required) Activate EasyHAProxy. | **required** | easyhaproxy-ingress | +| easyhaproxy.redirect_ssl | (optional) Boolean. Force redirect all endpoints to HTTPS. | false | true or false | +| easyhaproxy.certbot | (optional) Boolean. It will request certbot certificates for the ingresses domains. | false | true or false | +| easyhaproxy.redirect | (optional) JSON. Key pair with a domain and its destination. | *empty* | {"domain":"redirect_url"} | +| easyhaproxy.mode | (optional) Set the HTTP mode for that connection. | http | http or tcp | +| easyhaproxy.listen_port | (optional) Set the an additional port for that ingress | http | http or tcp | **Important**: The annotations are per ingress and applied to all hosts in that ingress configuration. ## Letsencrypt -It is necessary add the annotation `easyhaproxy.letsencrypt` to the ingress configuration: +It is necessary add the annotation `easyhaproxy.certbot` to the ingress configuration: ```yaml kind: Ingress metadata: annotations: kubernetes.io/ingress.class: easyhaproxy-ingress - easyhaproxy.letsencrypt: 'true' + easyhaproxy.certbot: 'true' name: example-ingress namespace: example spec: diff --git a/docs/letsencrypt.md b/docs/letsencrypt.md index d44c87b..acecae0 100644 --- a/docs/letsencrypt.md +++ b/docs/letsencrypt.md @@ -9,17 +9,17 @@ Run the EasyHAProxy container: ```bash docker run \ ... \ - -e EASYHAPROXY_LETSENCRYPT_EMAIL=john@doe.com \ + -e EASYHAPROXY_CERTBOT_EMAIL=john@doe.com \ -p 80:80 \ -p 443:443 \ - -v /path/to/guest/lestencrypt/certs:/certs/letsencrypt \ + -v /path/to/guest/certbot/certs:/certs/certbot \ ... \ byjg/easy-haproxy ``` Notes: -- If you don't setup `EASYHAPROXY_LETSENCRYPT_EMAIL` environment variable, EasyHAProxy will fail silently and **will not request** a certificate. +- If you don't setup `EASYHAPROXY_CERTBOT_EMAIL` environment variable, EasyHAProxy will fail silently and **will not request** a certificate. - The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/) Be aware of Letsencrypt issue rate limits: @@ -28,7 +28,7 @@ Be aware of Letsencrypt issue rate limits: - https://letsencrypt.org/docs/rate-limits/ In order to avoid several certificate issuing, -**It is required you to persist the container folder `/certs/letsencrypt` outside the container.** +**It is required you to persist the container folder `/certs/certbot` outside the container.** You cannot delete or change it contents. If you do not persist, or change/delete the contents, Let's encrypt will not work properly. @@ -41,7 +41,7 @@ docker run \ --label easyhaproxy.express.port=80 \ --label easyhaproxy.express.localport=3000 \ --label easyhaproxy.express.host=example.org \ - --label easyhaproxy.express.letsencrypt=true \ + --label easyhaproxy.express.certbot=true \ ... \ some/myimage ``` diff --git a/docs/static.md b/docs/static.md index 6a35bda..bf7b76e 100644 --- a/docs/static.md +++ b/docs/static.md @@ -20,7 +20,7 @@ customerrors: true # Optional (default false) ssl_mode: default -letsencrypt: { +certbot: { "email": "acme@example.org" } @@ -30,7 +30,7 @@ easymapping: host1.com.br: containers: - container:5000 - letsencrypt: true + certbot: true redirect_ssl: true host2.com.br: containers: @@ -83,7 +83,7 @@ customerrors: true # Optional (default false) ssl_mode: default # Optional -letsencrypt: { # Optional. If you enable `letsencrypt` will need to setu0p this, +certbot: { # Optional. If you enable `certbot` will need to setu0p this, # otherwise the certificate will be issued "email": "acme@example.org" } @@ -95,7 +95,7 @@ easymapping: host1.com.br: # Hostname containers: - container:5000 # Endpoints of the hostname above (ip, dns, container, etc) - letsencrypt: true # Optional. it will request a letsencrypt certiticate + certbot: true # Optional. it will request a certbot certiticate redirect_ssl: true # Optional. It will redirect this site to it SSL. ssl: true # Optional. Inform this port will listen to SSL, instead of HTTP clone_to_ssl: true # Optional. Default False. You clone these hosts to its equivalent SSL. diff --git a/examples/docker/docker-compose-portainer-app-example.yml b/examples/docker/docker-compose-portainer-app-example.yml index 70f6290..99c9ed1 100644 --- a/examples/docker/docker-compose-portainer-app-example.yml +++ b/examples/docker/docker-compose-portainer-app-example.yml @@ -8,7 +8,7 @@ services: easyhaproxy.http.host: test.xpto.us easyhaproxy.http.port: 80 easyhaproxy.http.localport: 8080 - easyhaproxy.http.letsencrypt: true + easyhaproxy.http.certbot: true networks: diff --git a/examples/docker/docker-compose-portainer.yml b/examples/docker/docker-compose-portainer.yml index ba4a7a9..9263b50 100644 --- a/examples/docker/docker-compose-portainer.yml +++ b/examples/docker/docker-compose-portainer.yml @@ -1,4 +1,4 @@ -# docker volume create certs_letsencrypt +# docker volume create certs_certbot # docker volume create certs_haproxy # docker volume create portainer_data # docker network create easyhaproxy @@ -11,13 +11,13 @@ services: image: byjg/easy-haproxy volumes: - /var/run/docker.sock:/var/run/docker.sock - - certs_letsencrypt:/certs/letsencrypt + - certs_certbot:/certs/certbot # - certs_haproxy:/certs/haproxy environment: EASYHAPROXY_DISCOVER: docker EASYHAPROXY_LABEL_PREFIX: easyhaproxy - EASYHAPROXY_LETSENCRYPT_EMAIL: changeme@example.org + EASYHAPROXY_CERTBOT_EMAIL: changeme@example.org EASYHAPROXY_SSL_MODE: "default" HAPROXY_CUSTOMERRORS: "true" HAPROXY_USERNAME: admin @@ -36,14 +36,14 @@ services: - /var/run/docker.sock:/var/run/docker.sock labels: easyhaproxy.http.redirect_ssl: true - easyhaproxy.http.letsencrypt: true + easyhaproxy.http.certbot: true easyhaproxy.http.host: portainer.xpto.us easyhaproxy.http.port: 80 easyhaproxy.http.localport: 9000 volumes: - certs_letsencrypt: + certs_certbot: external: true certs_haproxy: external: true diff --git a/helm/easyhaproxy/templates/deployment.yaml b/helm/easyhaproxy/templates/deployment.yaml index ecaa538..07cae85 100644 --- a/helm/easyhaproxy/templates/deployment.yaml +++ b/helm/easyhaproxy/templates/deployment.yaml @@ -69,7 +69,7 @@ spec: value: {{ .Values.easyhaproxy.logLevel.haproxy }} - name: CERTBOT_LOG_LEVEL value: {{ .Values.easyhaproxy.logLevel.certbot }} - {{- if .Values.easyhaproxy.letsencrypt.email }} - - name: EASYHAPROXY_LETSENCRYPT_EMAIL - value: {{ .Values.easyhaproxy.letsencrypt.email }} + {{- if .Values.easyhaproxy.certbot.email }} + - name: EASYHAPROXY_CERTBOT_EMAIL + value: {{ .Values.easyhaproxy.certbot.email }} {{ end }} diff --git a/helm/easyhaproxy/values.yaml b/helm/easyhaproxy/values.yaml index c3bb6a6..2ed4dfd 100644 --- a/helm/easyhaproxy/values.yaml +++ b/helm/easyhaproxy/values.yaml @@ -69,7 +69,7 @@ easyhaproxy: certbot: DEBUG easyhaproxy: DEBUG haproxy: DEBUG - letsencrypt: + certbot: email: "" # Make sure to create this diff --git a/src/easymapping/__init__.py b/src/easymapping/__init__.py index c2626a6..e17dcf5 100644 --- a/src/easymapping/__init__.py +++ b/src/easymapping/__init__.py @@ -49,10 +49,10 @@ class HaproxyConfigGenerator: def __init__(self, mapping): self.mapping = mapping self.mapping.setdefault("ssl_mode", 'default') - self.mapping.setdefault("letsencrypt", {"email": "", "staging": False}) + self.mapping.setdefault("certbot", {"email": "", "staging": False}) self.mapping["ssl_mode"] = self.mapping["ssl_mode"].lower() self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy") - self.letsencrypt_hosts = [] + self.certbot_hosts = [] self.serving_hosts = [] self.certs = {} @@ -106,10 +106,10 @@ class HaproxyConfigGenerator: "80" ) - letsencrypt = self.label.get_bool( - self.label.create([definition, "letsencrypt"]), + certbot = self.label.get_bool( + self.label.create([definition, "certbot"]), False - ) and self.mapping["letsencrypt"]["email"] != "" + ) and self.mapping["certbot"]["email"] != "" clone_to_ssl = self.label.get_bool( self.label.create([definition, "clone_to_ssl"]) ) @@ -139,9 +139,9 @@ class HaproxyConfigGenerator: self.serving_hosts.append("%s:%s" % (hostname, port)) easymapping[port]["hosts"].setdefault(hostname, {}) easymapping[port]["hosts"][hostname].setdefault("containers", []) - easymapping[port]["hosts"][hostname].setdefault("letsencrypt", False) + easymapping[port]["hosts"][hostname].setdefault("certbot", False) easymapping[port]["hosts"][hostname]["containers"] += ["{}:{}".format(container, ct_port)] - easymapping[port]["hosts"][hostname]["letsencrypt"] = letsencrypt + easymapping[port]["hosts"][hostname]["certbot"] = certbot easymapping[port]["hosts"][hostname]["redirect_ssl"] = self.label.get_bool( self.label.create([definition, "redirect_ssl"]) ) @@ -150,7 +150,7 @@ class HaproxyConfigGenerator: self.label.create([definition, "redirect"]) ) - if letsencrypt or clone_to_ssl: + if certbot or clone_to_ssl: if "443" not in easymapping: easymapping["443"] = { "mode": "http", @@ -160,10 +160,10 @@ class HaproxyConfigGenerator: "redirect": dict(), } easymapping["443"]["hosts"][hostname] = dict(easymapping[port]["hosts"][hostname]) - easymapping["443"]["hosts"][hostname]["letsencrypt"] = False + easymapping["443"]["hosts"][hostname]["certbot"] = False easymapping["443"]["hosts"][hostname]["redirect_ssl"] = False easymapping["443"]["ssl"] = True - self.letsencrypt_hosts.append(hostname) if letsencrypt and hostname not in self.letsencrypt_hosts else self.letsencrypt_hosts + self.certbot_hosts.append(hostname) if certbot and hostname not in self.certbot_hosts else self.certbot_hosts # handle SSL diff --git a/src/functions/__init__.py b/src/functions/__init__.py index 087a862..09b37d3 100644 --- a/src/functions/__init__.py +++ b/src/functions/__init__.py @@ -102,7 +102,7 @@ class Functions: class Consts: easyhaproxy_config = "/etc/haproxy/static/config.yml" haproxy_config = "/etc/haproxy/haproxy.cfg" - certs_letsencrypt = "/certs/letsencrypt" + certs_certbot = "/certs/certbot" certs_haproxy = "/certs/haproxy" @@ -259,11 +259,11 @@ class Certbot: Functions.save(filename, cert + key) def find_live_certificates(self): - letsencrypt_certs = "/etc/letsencrypt/live/" - if not os.path.exists(letsencrypt_certs): + certbot_certs = "/etc/letsencrypt/live/" + if not os.path.exists(certbot_certs): return - for item in os.listdir(letsencrypt_certs): - path = os.path.join(letsencrypt_certs, item) + for item in os.listdir(certbot_certs): + path = os.path.join(certbot_certs, item) if os.path.isdir(path): cert = Functions.load(os.path.join(path, "cert.pem")) key = Functions.load(os.path.join(path, "privkey.pem")) diff --git a/src/main.py b/src/main.py index 34e29d8..d251843 100644 --- a/src/main.py +++ b/src/main.py @@ -8,12 +8,12 @@ def start(): if processor_obj is None: exit(1) - os.makedirs(Consts.certs_letsencrypt, exist_ok=True) + os.makedirs(Consts.certs_certbot, exist_ok=True) os.makedirs(Consts.certs_haproxy, exist_ok=True) processor_obj.save_config(Consts.haproxy_config) processor_obj.save_certs(Consts.certs_haproxy) - letsencrypt_certs_found = processor_obj.get_letsencrypt_hosts() + certbot_certs_found = processor_obj.get_certbot_hosts() Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to run after save_config Functions.log(Functions.EASYHAPROXY_LOG, Functions.TRACE, 'Object Found: %s' % (processor_obj.get_parsed_object())) @@ -22,7 +22,7 @@ def start(): haproxy.haproxy("start") haproxy.sleep() - certbot = Certbot(Consts.certs_letsencrypt, os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"), os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "").lower()) + certbot = Certbot(Consts.certs_certbot, os.getenv("EASYHAPROXY_CERTBOT_EMAIL"), os.getenv("EASYHAPROXY_CERTBOT_SERVER", "").lower()) while True: if old_haproxy is not None: @@ -31,12 +31,12 @@ def start(): try: old_parsed = processor_obj.get_parsed_object() processor_obj.refresh() - if certbot.check_certificates(letsencrypt_certs_found) or DeepDiff(old_parsed, processor_obj.get_parsed_object()) != {} or not haproxy.is_alive(): + if certbot.check_certificates(certbot_certs_found) or DeepDiff(old_parsed, processor_obj.get_parsed_object()) != {} or not haproxy.is_alive(): Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'New configuration found. Reloading...') Functions.log(Functions.EASYHAPROXY_LOG, Functions.TRACE, 'Object Found: %s' % (processor_obj.get_parsed_object())) processor_obj.save_config(Consts.haproxy_config) processor_obj.save_certs(Consts.certs_haproxy) - letsencrypt_certs_found = processor_obj.get_letsencrypt_hosts() + certbot_certs_found = processor_obj.get_certbot_hosts() Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to after save_config old_haproxy = haproxy haproxy = DaemonizeHAProxy() diff --git a/src/processor/__init__.py b/src/processor/__init__.py index 748ad1e..96e347d 100644 --- a/src/processor/__init__.py +++ b/src/processor/__init__.py @@ -26,10 +26,10 @@ class ContainerEnv: } env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv("EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy" - if (os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL")): - env_vars["letsencrypt"] = { - "email": os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"), - "server": os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "false").lower() in ["true", "1", "yes"] + if (os.getenv("EASYHAPROXY_CERTBOT_EMAIL")): + env_vars["certbot"] = { + "email": os.getenv("EASYHAPROXY_CERTBOT_EMAIL"), + "server": os.getenv("EASYHAPROXY_CERTBOT_SERVER", "false").lower() in ["true", "1", "yes"] } return env_vars @@ -57,7 +57,7 @@ class ProcessorInterface: return None def refresh(self): - self.letsencrypt_hosts = None + self.certbot_hosts = None self.parsed_object = None self.cfg = None self.hosts = None @@ -71,8 +71,8 @@ class ProcessorInterface: def parse(self): self.cfg = HaproxyConfigGenerator(ContainerEnv.read()) - def get_letsencrypt_hosts(self): - return self.letsencrypt_hosts + def get_certbot_hosts(self): + return self.certbot_hosts def get_hosts(self): return self.hosts @@ -88,7 +88,7 @@ class ProcessorInterface: def get_haproxy_conf(self): conf = self.cfg.generate(self.parsed_object) - self.letsencrypt_hosts = self.cfg.letsencrypt_hosts + self.certbot_hosts = self.cfg.certbot_hosts self.hosts = self.cfg.serving_hosts return conf @@ -206,7 +206,7 @@ class Kubernetes(ProcessorInterface): ssl_hosts = [] - letsencrypt = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.letsencrypt") + certbot = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.certbot") redirect_ssl = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect_ssl") redirect = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect") mode = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.mode") @@ -252,8 +252,8 @@ class Kubernetes(ProcessorInterface): rule_data["%s.clone_to_ssl" % (definition)] = 'true' if redirect_ssl is not None: rule_data["%s.redirect_ssl" % (definition)] = redirect_ssl - if letsencrypt is not None: - rule_data["%s.letsencrypt" % (definition)] = letsencrypt + if certbot is not None: + rule_data["%s.certbot" % (definition)] = certbot if redirect is not None: rule_data["%s.redirect" % (definition)] = redirect if mode is not None: diff --git a/src/templates/bind.j2 b/src/templates/bind.j2 index d33d4bd..ba947f4 100644 --- a/src/templates/bind.j2 +++ b/src/templates/bind.j2 @@ -1,5 +1,5 @@ {% if "ssl" in o %} - bind *:{{ o["port"] }} ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 + bind *:{{ o["port"] }} ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 {% elif "h2" in o and o["h2"] %} bind *:{{ o["port"] }} proto h2 option http-use-htx diff --git a/src/templates/frontend-mode-http.j2 b/src/templates/frontend-mode-http.j2 index a3ed56d..5f9b0b0 100644 --- a/src/templates/frontend-mode-http.j2 +++ b/src/templates/frontend-mode-http.j2 @@ -5,16 +5,16 @@ {%- for k in o["hosts"] %} {% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %} - {% set letsencrypt = o["hosts"][k]["letsencrypt"] %} + {% set certbot = o["hosts"][k]["certbot"] %} acl is_rule_{{ host }}_1 hdr(host) -i {{ k }} acl is_rule_{{ host }}_2 hdr(host) -i {{ k }}:{{ o["port"] }} - {% if letsencrypt %} - acl is_letsencrypt_{{ host }} path_beg /.well-known/acme-challenge/ - use_backend letsencrypt_backend if is_letsencrypt_{{ host }} is_rule_{{ host }}_1 OR is_letsencrypt_{{ host }} is_rule_{{ host }}_2 + {% if certbot %} + acl is_certbot_{{ host }} path_beg /.well-known/acme-challenge/ + use_backend certbot_backend if is_certbot_{{ host }} is_rule_{{ host }}_1 OR is_certbot_{{ host }} is_rule_{{ host }}_2 {% endif %} {% if o["hosts"][k]["redirect_ssl"] %} - http-request redirect scheme https code 301 if {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_1 OR {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_2 + http-request redirect scheme https code 301 if {% if certbot %}!is_certbot_{{ host }} {% endif %}is_rule_{{ host }}_1 OR {% if certbot %}!is_certbot_{{ host }} {% endif %}is_rule_{{ host }}_2 {% else %} use_backend srv_{{ host }} if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2 {% endif %} diff --git a/src/templates/haproxy.cfg.j2 b/src/templates/haproxy.cfg.j2 index a1842b1..5639b25 100644 --- a/src/templates/haproxy.cfg.j2 +++ b/src/templates/haproxy.cfg.j2 @@ -75,7 +75,7 @@ backend srv_{{ host }} {% endfor %} {% endfor %} -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/docker.txt b/src/tests/expected/docker.txt index 7bcdedc..0775f93 100644 --- a/src/tests/expected/docker.txt +++ b/src/tests/expected/docker.txt @@ -36,7 +36,7 @@ backend srv_stats server Local 127.0.0.1:1936 frontend http_in_443 - bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 + bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 mode http acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local @@ -84,8 +84,8 @@ frontend http_in_90 acl is_rule_host2_local_90_1 hdr(host) -i host2.local acl is_rule_host2_local_90_2 hdr(host) -i host2.local:90 - acl is_letsencrypt_host2_local_90 path_beg /.well-known/acme-challenge/ - use_backend letsencrypt_backend if is_letsencrypt_host2_local_90 is_rule_host2_local_90_1 OR is_letsencrypt_host2_local_90 is_rule_host2_local_90_2 + acl is_certbot_host2_local_90 path_beg /.well-known/acme-challenge/ + use_backend certbot_backend if is_certbot_host2_local_90 is_rule_host2_local_90_1 OR is_certbot_host2_local_90 is_rule_host2_local_90_2 use_backend srv_host2_local_90 if is_rule_host2_local_90_1 OR is_rule_host2_local_90_2 backend srv_host2_local_90 @@ -96,6 +96,6 @@ backend srv_host2_local_90 http-request add-header X-Forwarded-Proto https if { ssl_fc } server srv-0 test_processor_docker:9000 check weight 1 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/no-services.txt b/src/tests/expected/no-services.txt index a95c434..7624237 100644 --- a/src/tests/expected/no-services.txt +++ b/src/tests/expected/no-services.txt @@ -23,6 +23,6 @@ defaults timeout server 10m -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/services-letsencrypt.txt b/src/tests/expected/services-letsencrypt.txt index 3e2eafb..c72e401 100644 --- a/src/tests/expected/services-letsencrypt.txt +++ b/src/tests/expected/services-letsencrypt.txt @@ -49,9 +49,9 @@ frontend http_in_80 acl is_rule_test_example_org_80_1 hdr(host) -i test.example.org acl is_rule_test_example_org_80_2 hdr(host) -i test.example.org:80 - acl is_letsencrypt_test_example_org_80 path_beg /.well-known/acme-challenge/ - use_backend letsencrypt_backend if is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_1 OR is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_2 - http-request redirect scheme https code 301 if !is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_1 OR !is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_2 + acl is_certbot_test_example_org_80 path_beg /.well-known/acme-challenge/ + use_backend certbot_backend if is_certbot_test_example_org_80 is_rule_test_example_org_80_1 OR is_certbot_test_example_org_80 is_rule_test_example_org_80_2 + http-request redirect scheme https code 301 if !is_certbot_test_example_org_80 is_rule_test_example_org_80_1 OR !is_certbot_test_example_org_80 is_rule_test_example_org_80_2 acl is_rule_test2_example_org_80_1 hdr(host) -i test2.example.org acl is_rule_test2_example_org_80_2 hdr(host) -i test2.example.org:80 @@ -74,7 +74,7 @@ backend srv_test2_example_org_80 server srv-0 83d57d592e26:8080 check weight 1 frontend http_in_443 - bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 + bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 mode http acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org @@ -90,6 +90,6 @@ backend srv_test_example_org_443 server srv-0 f5c645a0dfc6:80 check weight 1 verify none server srv-1 b63438410b6a:80 check weight 1 verify none -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/services-multi-containers.txt b/src/tests/expected/services-multi-containers.txt index 5910691..3b1644d 100644 --- a/src/tests/expected/services-multi-containers.txt +++ b/src/tests/expected/services-multi-containers.txt @@ -40,6 +40,6 @@ backend srv_www_helloworld_com_19901 server srv-0 test_nginx.2.t5r94mjlced7m3t5orfjbowmm:80 check weight 1 server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/services-multiple-hosts.txt b/src/tests/expected/services-multiple-hosts.txt index 954dde1..e5caf4b 100644 --- a/src/tests/expected/services-multiple-hosts.txt +++ b/src/tests/expected/services-multiple-hosts.txt @@ -73,6 +73,6 @@ backend srv_hello_com_19901 server srv-0 3e63154954b0:80 check weight 1 server srv-1 eb294c110eb1:80 check weight 1 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/services-redirect-ssl.txt b/src/tests/expected/services-redirect-ssl.txt index 077123b..ce59c19 100644 --- a/src/tests/expected/services-redirect-ssl.txt +++ b/src/tests/expected/services-redirect-ssl.txt @@ -49,7 +49,7 @@ backend srv_host1_local_80 server srv-0 5b69bc7fea1b:80 check weight 1 frontend http_in_443 - bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 + bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 mode http acl is_rule_host2_local_443_1 hdr(host) -i host2.local @@ -75,6 +75,6 @@ backend srv_host1_local_443 http-request add-header X-Forwarded-Proto https if { ssl_fc } server srv-0 5b69bc7fea1b:8080 check weight 1 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/services-tcp.txt b/src/tests/expected/services-tcp.txt index fa8fd7a..2c19128 100644 --- a/src/tests/expected/services-tcp.txt +++ b/src/tests/expected/services-tcp.txt @@ -37,6 +37,6 @@ backend srv_agent_quantum_local_31339 tcp-check connect ssl server srv-0 test_agent:9001 check weight 1 verify none -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/services.txt b/src/tests/expected/services.txt index bf2cecd..81a4c99 100644 --- a/src/tests/expected/services.txt +++ b/src/tests/expected/services.txt @@ -47,8 +47,8 @@ frontend http_in_31337 acl is_rule_node-exporter_quantum_example_org_31337_1 hdr(host) -i node-exporter.quantum.example.org acl is_rule_node-exporter_quantum_example_org_31337_2 hdr(host) -i node-exporter.quantum.example.org:31337 - acl is_letsencrypt_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/ - use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2 + acl is_certbot_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/ + use_backend certbot_backend if is_certbot_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_certbot_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2 use_backend srv_node-exporter_quantum_example_org_31337 if is_rule_node-exporter_quantum_example_org_31337_1 OR is_rule_node-exporter_quantum_example_org_31337_2 backend srv_cadvisor_quantum_example_org_31337 @@ -67,7 +67,7 @@ backend srv_node-exporter_quantum_example_org_31337 server srv-0 my-stack_node-exporter:9100 check weight 1 frontend http_in_443 - bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 + bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 mode http redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com } @@ -119,6 +119,6 @@ backend srv_www_somehost_com_br_80 http-request add-header X-Forwarded-Proto https if { ssl_fc } server srv-0 some-service:80 check weight 1 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/ssl-loose.txt b/src/tests/expected/ssl-loose.txt index 45ac853..e4a6322 100644 --- a/src/tests/expected/ssl-loose.txt +++ b/src/tests/expected/ssl-loose.txt @@ -33,6 +33,6 @@ backend srv_stats mode http server Local 127.0.0.1:1936 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/ssl-strict.txt b/src/tests/expected/ssl-strict.txt index f4e00b4..7c3306f 100644 --- a/src/tests/expected/ssl-strict.txt +++ b/src/tests/expected/ssl-strict.txt @@ -18,6 +18,6 @@ defaults timeout server 10m -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/expected/static.txt b/src/tests/expected/static.txt index ea0362f..c582286 100644 --- a/src/tests/expected/static.txt +++ b/src/tests/expected/static.txt @@ -50,8 +50,8 @@ frontend http_in_80 acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80 - acl is_letsencrypt_host1_com_br_80 path_beg /.well-known/acme-challenge/ - use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_2 + acl is_certbot_host1_com_br_80 path_beg /.well-known/acme-challenge/ + use_backend certbot_backend if is_certbot_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_certbot_host1_com_br_80 is_rule_host1_com_br_80_2 use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2 acl is_rule_host2_com_br_80_1 hdr(host) -i host2.com.br @@ -74,7 +74,7 @@ backend srv_host2_com_br_80 server srv-0 other:3000 check weight 1 frontend http_in_443 - bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 + bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 mode http acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br @@ -105,6 +105,6 @@ backend srv_host3_com_br_8080 http-request add-header X-Forwarded-Proto https if { ssl_fc } server srv-0 domain:8181 check weight 1 -backend letsencrypt_backend +backend certbot_backend mode http server certbot 127.0.0.1:2080 diff --git a/src/tests/fixtures/services b/src/tests/fixtures/services index 56ef60a..5c0aa68 100644 --- a/src/tests/fixtures/services +++ b/src/tests/fixtures/services @@ -1,6 +1,6 @@ {"portainer-agent_agent": {"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"}, "my-stack_agent": {"easyhaproxy.agent.host":"agent.quantum.example.org","easyhaproxy.agent.localport":"9001","easyhaproxy.agent.mode":"tcp","easyhaproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_cadvisor": {"easyhaproxy.cadvisor.host":"cadvisor.quantum.example.org","easyhaproxy.cadvisor.localport":"8080","easyhaproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, -"my-stack_node-exporter": {"easyhaproxy.exp.host":"node-exporter.quantum.example.org","easyhaproxy.exp.localport":"9100","easyhaproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","easyhaproxy.exp.letsencrypt":"true"}, +"my-stack_node-exporter": {"easyhaproxy.exp.host":"node-exporter.quantum.example.org","easyhaproxy.exp.localport":"9100","easyhaproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","easyhaproxy.exp.certbot":"true"}, "my-stack_reverse-proxy": {"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "some-service": {"easyhaproxy.http.port":"80","easyhaproxy.http.host":"www.somehost.com.br","easyhaproxy.http.localport":"80","easyhaproxy.http.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","easyhaproxy.https.port":"443","easyhaproxy.https.host":"www.somehost.com.br","easyhaproxy.https.localport":"80","easyhaproxy.https.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","easyhaproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}} \ No newline at end of file diff --git a/src/tests/fixtures/services-changed-label b/src/tests/fixtures/services-changed-label index 2a23c24..af934de 100644 --- a/src/tests/fixtures/services-changed-label +++ b/src/tests/fixtures/services-changed-label @@ -1,6 +1,6 @@ {"portainer-agent_agent": {"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"}, "my-stack_agent": {"haproxy.agent.host":"agent.quantum.example.org","haproxy.agent.localport":"9001","haproxy.agent.mode":"tcp","haproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_cadvisor": {"haproxy.cadvisor.host":"cadvisor.quantum.example.org","haproxy.cadvisor.localport":"8080","haproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, -"my-stack_node-exporter": {"haproxy.exp.host":"node-exporter.quantum.example.org","haproxy.exp.localport":"9100","haproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","haproxy.exp.letsencrypt":"yes"}, +"my-stack_node-exporter": {"haproxy.exp.host":"node-exporter.quantum.example.org","haproxy.exp.localport":"9100","haproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","haproxy.exp.certbot":"yes"}, "my-stack_reverse-proxy": {"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "some-service": {"haproxy.http.port":"80","haproxy.http.host":"www.somehost.com.br","haproxy.http.localport":"80","haproxy.http.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","haproxy.https.port":"443","haproxy.https.host":"www.somehost.com.br","haproxy.https.localport":"80","haproxy.https.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","haproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}} \ No newline at end of file diff --git a/src/tests/fixtures/services-letsencrypt b/src/tests/fixtures/services-letsencrypt index 9c83781..ca1d03a 100644 --- a/src/tests/fixtures/services-letsencrypt +++ b/src/tests/fixtures/services-letsencrypt @@ -1,4 +1,4 @@ -{"f5c645a0dfc6": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.letsencrypt":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"}, +{"f5c645a0dfc6": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.certbot":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"}, "bbd4d1854155": {"com.docker.compose.config-hash":"3dc790bf2bea944359c75a40c45655bd868f1d85beb599d1ca797e8ea2c95ee4","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:0fd95b1512c207048ab3fcc74032354f38143fbb8235ac2a47da903c98a58205","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"haproxy","com.docker.compose.version":"2.8.0"}, -"b63438410b6a": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.letsencrypt":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"}, +"b63438410b6a": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.certbot":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"}, "83d57d592e26": {"com.docker.compose.config-hash":"8c5871144f1e8a3aeca037207c02f011ab2c6e6c311a3773602b63541762dab5","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:c4232396c715f3d568816c666e6d9b4a68ef6c36f6243b4007c4ee1d8335fd65","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"static","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test2.example.org","easyhaproxy.http.localport":"8080","easyhaproxy.http.port":"80","io.buildah.version":"1.21.0"}} \ No newline at end of file diff --git a/src/tests/fixtures/static.yml b/src/tests/fixtures/static.yml index c83d61c..53d3705 100644 --- a/src/tests/fixtures/static.yml +++ b/src/tests/fixtures/static.yml @@ -11,7 +11,7 @@ easymapping: host1.com.br: containers: - container:5000 - letsencrypt: true + certbot: true host2.com.br: containers: - other:3000 diff --git a/src/tests/test_containerenv.py b/src/tests/test_containerenv.py index c338871..b583198 100644 --- a/src/tests/test_containerenv.py +++ b/src/tests/test_containerenv.py @@ -87,32 +87,32 @@ def test_container_env_stats_password(): def test_container_env_stats_password(): - os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'acme@example.org' + os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = 'acme@example.org' try: assert { "customerrors": False, "ssl_mode": "default", "lookup_label": "easyhaproxy", - "letsencrypt": { + "certbot": { "email": "acme@example.org", "server": False } } == ContainerEnv.read() finally: - os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' + os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = '' -def test_container_env_letsencrypt(): - os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'acme@example.org' - os.environ['EASYHAPROXY_LETSENCRYPT_SERVER'] = 'true' +def test_container_env_certbot(): + os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = 'acme@example.org' + os.environ['EASYHAPROXY_CERTBOT_SERVER'] = 'true' try: assert { "customerrors": False, "ssl_mode": "default", "lookup_label": "easyhaproxy", - "letsencrypt": { + "certbot": { "email": "acme@example.org", "server": True } } == ContainerEnv.read() finally: - os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' \ No newline at end of file + os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = '' \ No newline at end of file diff --git a/src/tests/test_docker.py b/src/tests/test_docker.py index da0c60d..6aaaf61 100644 --- a/src/tests/test_docker.py +++ b/src/tests/test_docker.py @@ -46,7 +46,7 @@ def test_processor_docker(): "easyhaproxy.http2.port": "90", "easyhaproxy.http2.localport": "9000", "easyhaproxy.http2.host": "host2.local", - "easyhaproxy.http2.letsencrypt": "true", + "easyhaproxy.http2.certbot": "true", }) container2 = client.containers.run("byjg/static-httpserver", name="test2_processor_docker", @@ -62,10 +62,10 @@ def test_processor_docker(): try: time.sleep(1) - os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'docker@example.org' + os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = 'docker@example.org' static = ProcessorInterface.factory("docker") - assert static.get_letsencrypt_hosts() is None + assert static.get_certbot_hosts() is None assert { 'easyhaproxy.http.host': 'host1.local', @@ -74,7 +74,7 @@ def test_processor_docker(): 'easyhaproxy.http2.host': 'host2.local', 'easyhaproxy.http2.localport': '9000', 'easyhaproxy.http2.port': '90', - 'easyhaproxy.http2.letsencrypt': 'true', + 'easyhaproxy.http2.certbot': 'true', } == _get_hydrated_object(static.get_parsed_object(), "easyhaproxy.http") assert { 'easyhaproxy.ssl.host': 'hostssl.local', @@ -90,7 +90,7 @@ def test_processor_docker(): assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/docker.txt")).replace("test_processor_docker", _get_ip_host( static.get_parsed_object(), "easyhaproxy.http")).replace("test2_processor_docker", _get_ip_host(static.get_parsed_object(), "easyhaproxy.ssl")) - assert static.get_letsencrypt_hosts() == ['host2.local'] + assert static.get_certbot_hosts() == ['host2.local'] assert static.get_hosts() == [ 'hostssl.local:443', 'host1.local:80', @@ -100,7 +100,7 @@ def test_processor_docker(): 'hostssl.local.pem': 'Some PEM Certificate' } finally: - os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' + os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = '' container.stop() container2.stop() diff --git a/src/tests/test_parser.py b/src/tests/test_parser.py index a3d35f0..c5ef3df 100644 --- a/src/tests/test_parser.py +++ b/src/tests/test_parser.py @@ -6,7 +6,7 @@ import json CERTS_FOLDER="/tmp/certs" CERT_FILE="/tmp/certs/haproxy/www.somehost.com.br.pem" -LETSENCRYPT_EMAIL="some@email.com" +CERTBOT_EMAIL="some@email.com" def load_fixture(file): path = os.path.dirname(os.path.realpath(__file__)) @@ -33,15 +33,15 @@ def test_parser_doesnt_crash(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/no-services.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_finds_services(): line_list = load_fixture("services") result = { "customerrors": False, - "letsencrypt": { - "email": LETSENCRYPT_EMAIL + "certbot": { + "email": CERTBOT_EMAIL }, "stats": { "port": 0 @@ -58,7 +58,7 @@ def test_parser_finds_services(): assert {"www.somehost.com.br.pem":"Some PEM Certificate"} == cfg.certs - assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts + assert ['node-exporter.quantum.example.org'] == cfg.certbot_hosts def test_parser_finds_services_changed_label(): line_list = load_fixture("services-changed-label") @@ -66,8 +66,8 @@ def test_parser_finds_services_changed_label(): result = { "customerrors": False, "lookup_label": "haproxy", - "letsencrypt": { - "email": LETSENCRYPT_EMAIL + "certbot": { + "email": CERTBOT_EMAIL }, "stats": { "port": 0 @@ -87,15 +87,15 @@ def test_parser_finds_services_changed_label(): assert {"www.somehost.com.br.pem":"Some PEM Certificate"} == cfg.certs - assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts + assert ['node-exporter.quantum.example.org'] == cfg.certbot_hosts def test_parser_finds_services_raw(): line_list = load_fixture("services") result = { "customerrors": False, - "letsencrypt": { - "email": LETSENCRYPT_EMAIL + "certbot": { + "email": CERTBOT_EMAIL }, "stats": { "port": 0 @@ -117,7 +117,7 @@ def test_parser_finds_services_raw(): "containers": [ "my-stack_agent:9001" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False } }, @@ -134,14 +134,14 @@ def test_parser_finds_services_raw(): "containers": [ "my-stack_cadvisor:8080" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False }, "node-exporter.quantum.example.org":{ "containers": [ "my-stack_node-exporter:9100" ], - "letsencrypt": True, + "certbot": True, "redirect_ssl": False } }, @@ -158,14 +158,14 @@ def test_parser_finds_services_raw(): "containers": [ "my-stack_node-exporter:9100" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False }, "www.somehost.com.br":{ "containers": [ "some-service:80" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False } }, @@ -187,7 +187,7 @@ def test_parser_finds_services_raw(): "containers": [ "some-service:80" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False } }, @@ -204,7 +204,7 @@ def test_parser_finds_services_raw(): processed = list(cfg.parse(line_list)) assert parsed_object == processed - assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts + assert ['node-exporter.quantum.example.org'] == cfg.certbot_hosts @@ -219,7 +219,7 @@ def test_parser_static(): with open(path + "/expected/static.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_static_raw(): path = os.path.dirname(os.path.realpath(__file__)) @@ -241,7 +241,7 @@ def test_parser_static_raw(): "containers": [ "container:5000" ], - "letsencrypt": True + "certbot": True }, "host2.com.br": { "containers": [ @@ -299,7 +299,7 @@ def test_parser_tcp(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/services-tcp.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_multi_containers(): line_list = load_fixture("services-multi-containers") @@ -318,7 +318,7 @@ def test_parser_multi_containers(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/services-multi-containers.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_multiple_hosts(): @@ -340,7 +340,7 @@ def test_parser_multiple_hosts(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/services-multiple-hosts.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_redirect_ssl(): @@ -361,7 +361,7 @@ def test_parser_redirect_ssl(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/services-redirect-ssl.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_ssl_strict(): @@ -382,7 +382,7 @@ def test_parser_ssl_strict(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/ssl-strict.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_ssl_loose(): line_list = load_fixture("no-services") @@ -399,7 +399,7 @@ def test_parser_ssl_loose(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/ssl-loose.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts def test_parser_ssl_letsencrypt(): line_list = load_fixture("services-letsencrypt") @@ -409,8 +409,8 @@ def test_parser_ssl_letsencrypt(): "stats": { "password": "password" }, - "letsencrypt": { - "email": LETSENCRYPT_EMAIL + "certbot": { + "email": CERTBOT_EMAIL } } @@ -421,7 +421,7 @@ def test_parser_ssl_letsencrypt(): path = os.path.dirname(os.path.realpath(__file__)) with open(path + "/expected/services-letsencrypt.txt", 'r') as expected_file: assert expected_file.read() == haproxy_config - assert ["test.example.org"] == cfg.letsencrypt_hosts + assert ["test.example.org"] == cfg.certbot_hosts def test_parser_finds_services_clone_to_ssl_raw(): @@ -429,8 +429,8 @@ def test_parser_finds_services_clone_to_ssl_raw(): result = { "customerrors": False, - "letsencrypt": { - "email": LETSENCRYPT_EMAIL + "certbot": { + "email": CERTBOT_EMAIL }, "stats": { "port": 0 @@ -450,21 +450,21 @@ def test_parser_finds_services_clone_to_ssl_raw(): "containers":[ "10.152.183.215:8080" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False }, "valida.me":{ "containers":[ "10.152.183.62:8080" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False }, "www.valida.me":{ "containers":[ "10.152.183.62:8080" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False } }, @@ -481,7 +481,7 @@ def test_parser_finds_services_clone_to_ssl_raw(): "containers":[ "10.152.183.215:8080" ], - "letsencrypt": False, + "certbot": False, "redirect_ssl": False } }, @@ -496,12 +496,12 @@ def test_parser_finds_services_clone_to_ssl_raw(): processed = list(cfg.parse(line_list)) assert parsed_object == processed - assert [] == cfg.letsencrypt_hosts + assert [] == cfg.certbot_hosts #test_parser_finds_services_raw() #test_parser_tcp() #test_parser_multiple_hosts() -#test_parser_ssl_letsencrypt() +#test_parser_ssl_certbot() #test_parser_finds_services() \ No newline at end of file diff --git a/src/tests/test_static.py b/src/tests/test_static.py index c21593c..f8800ac 100644 --- a/src/tests/test_static.py +++ b/src/tests/test_static.py @@ -15,7 +15,7 @@ def test_processor_static(): "containers":[ "container:5000" ], - "letsencrypt": True + "certbot": True }, "host2.com.br":{ "containers":[ @@ -57,7 +57,7 @@ def test_processor_static(): 'host3.com.br:8080' ] - assert static.get_letsencrypt_hosts() is None + assert static.get_certbot_hosts() is None assert static.get_parsed_object() == parsed_object assert static.get_hosts() == hosts @@ -66,7 +66,7 @@ def test_processor_static(): assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/static.txt")) # @todo: Static doesnt populate this fields - assert static.get_letsencrypt_hosts() == [] + assert static.get_certbot_hosts() == [] assert static.get_parsed_object() == parsed_object assert static.get_hosts() == hosts