badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Renaming Letsencrypt to Certbot, since it will be more generic allowing other issuers.

Browse source
This commit is contained in:
Joao Gilberto Magalhaes 2023-07-01 16:05:53 -05:00
parent 55888752c9
commit 5dbe0a6d28
40 changed files with 188 additions and 184 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -23,7 +23,7 @@ EasyHAProxy can detect and configure HAProxy automatically on the following plat
EasyHAProxy will discover the services based on the Docker Tags of the containers running on a Docker host or Docker Swarm cluster and dynamically set up the `haproxy.cfg`. Below, EasyHAProxy main features: EasyHAProxy will discover the services based on the Docker Tags of the containers running on a Docker host or Docker Swarm cluster and dynamically set up the `haproxy.cfg`. Below, EasyHAProxy main features:
- Use Letsencrypt with HAProxy. - Automatic SSL Certificate issued by any ACME compatible service as Letsencrypt and ZeroSSL
- Set your custom SSL certificates - Set your custom SSL certificates
- Balance traffic between multiple replicas - Balance traffic between multiple replicas
- Set SSL with three different levels of validations and according to the most recent definitions. - Set SSL with three different levels of validations and according to the most recent definitions.

6
deploy/docker/docker-compose.yml
View file

@ -5,13 +5,13 @@ services:
image: byjg/easy-haproxy:4.3.1-rc1 image: byjg/easy-haproxy:4.3.1-rc1
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
- certs_letsencrypt:/certs/letsencrypt - certs_certbot:/certs/certbot
- certs_haproxy:/certs/haproxy - certs_haproxy:/certs/haproxy
environment: environment:
EASYHAPROXY_DISCOVER: docker EASYHAPROXY_DISCOVER: docker
EASYHAPROXY_LABEL_PREFIX: easyhaproxy EASYHAPROXY_LABEL_PREFIX: easyhaproxy
EASYHAPROXY_LETSENCRYPT_EMAIL: changeme@example.org EASYHAPROXY_CERTBOT_EMAIL: changeme@example.org
EASYHAPROXY_SSL_MODE: "default" EASYHAPROXY_SSL_MODE: "default"
HAPROXY_CUSTOMERRORS: "true" HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin HAPROXY_USERNAME: admin
@ -27,7 +27,7 @@ services:
- easyhaproxy - easyhaproxy
volumes: volumes:
certs_letsencrypt: certs_certbot:
external: true external: true
certs_haproxy: certs_haproxy:
external: true external: true

2
deploy/docker/install.sh
View file

@ -3,7 +3,7 @@
ASSETS_DIR="$(dirname "${BASH_SOURCE[0]}")"/../../build/assets/certs/haproxy ASSETS_DIR="$(dirname "${BASH_SOURCE[0]}")"/../../build/assets/certs/haproxy
docker network create easyhaproxy docker network create easyhaproxy
docker volume create certs_letsencrypt docker volume create certs_certbot
docker volume create certs_haproxy docker volume create certs_haproxy
docker run -d --rm --name easyhaproxy_install -v certs_haproxy:/certs alpine tail -f /dev/null docker run -d --rm --name easyhaproxy_install -v certs_haproxy:/certs alpine tail -f /dev/null

26
docs/container-labels.md
View file

@ -2,19 +2,19 @@
## Container (Docker or Swarm) labels ## Container (Docker or Swarm) labels
| Tag | Description | Default | Example | | Tag | Description | Default | Example |
|---------------------------------------|-------------------------------------------------------------------------------------------------------|----------------|--------------| |---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------|------------------------------------------------------------|
| easyhaproxy.[definition].host | Host(s) HAProxy is listening. More than one host use comma as delimiter | **required** | somehost.com OR host1.com,host2.com | | easyhaproxy.[definition].host | Host(s) HAProxy is listening. More than one host use comma as delimiter | **required** | somehost.com OR host1.com,host2.com |
| easyhaproxy.[definition].mode | (Optional) Is this `http` or `tcp` mode in HAProxy. | http | http or tcp | | easyhaproxy.[definition].mode | (Optional) Is this `http` or `tcp` mode in HAProxy. | http | http or tcp |
| easyhaproxy.[definition].port | (Optional) Port HAProxy will listen for the host. | 80 | 3000 | | easyhaproxy.[definition].port | (Optional) Port HAProxy will listen for the host. | 80 | 3000 |
| easyhaproxy.[definition].localport | (Optional) Port container is listening. | 80 | 8080 | | easyhaproxy.[definition].localport | (Optional) Port container is listening. | 80 | 8080 |
| easyhaproxy.[definition].redirect | (Optional) JSON containing key/value pair from host/to URL redirect. | *empty* | {"foo.com":"https://bla.com", "bar.com":"https://bar.org"} | | easyhaproxy.[definition].redirect | (Optional) JSON containing key/value pair from host/to URL redirect. | *empty* | {"foo.com":"https://bla.com", "bar.com":"https://bar.org"} |
| easyhaproxy.[definition].sslcert | (Optional) Cert PEM Base64 encoded. Do not use this if `letsencrypt` is enabled. | *empty* | base64 cert + key | | easyhaproxy.[definition].sslcert | (Optional) Cert PEM Base64 encoded. Do not use this if `certbot` is enabled. | *empty* | base64 cert + key |
| easyhaproxy.[definition].ssl | (Optional) If `true` you need to provide certificate as a file. See below. Do not use with `sslcert`. | false | true or false | | easyhaproxy.[definition].ssl | (Optional) If `true` you need to provide certificate as a file. See below. Do not use with `sslcert`. | false | true or false |
| easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` | *empty* | ssl | | easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` | *empty* | ssl |
| easyhaproxy.[definition].letsencrypt | (Optional) Generate certificate with letsencrypt. Do not use with `sslcert` parameter. | false | true OR false | | easyhaproxy.[definition].certbot | (Optional) Generate certificate with certbot. Do not use with `sslcert` parameter. | false | true OR false |
| easyhaproxy.[definition].redirect_ssl | (Optional) Redirect all requests to https | false | true OR false | | easyhaproxy.[definition].redirect_ssl | (Optional) Redirect all requests to https | false | true OR false |
| easyhaproxy.[definition].clone_to_ssl | (Optional) It copies the configuration to HTTPS(443) and disable SSL from the current config. **Do not use* this with `ssl` or `letsencrypt` parameters | false | true OR false | | easyhaproxy.[definition].clone_to_ssl | (Optional) It copies the configuration to HTTPS(443) and disable SSL from the current config. **Do not use* this with `ssl` or `certbot` parameters | false | true OR false |
The `definition` is a string that will group all configurations togethers. Different `definition` will create different configurations. The `definition` is a string that will group all configurations togethers. Different `definition` will create different configurations.

30
docs/docker-environment.md
View file

@ -1,20 +1,20 @@
# Docker environment variables # Docker environment variables
| Environment Variable | Description | Default | | Environment Variable | Description | Default |
|---------------------------------|-------------------------------------------------------------------------------------------------|------------------| |------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** | | EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` | | EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | *empty* | | EASYHAPROXY_CERTBOT_EMAIL | (Optional) The email will be used to request the certificate to Certbox | *empty* |
| EASYHAPROXY_LETSENCRYPT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld'. If set, will try to connect to the Letsencrypt test server | *empty* | | EASYHAPROXY_CERTBOT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld'. If set, will try to connect to the Certbot test server | *empty* |
| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`| | EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default` |
| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 | | EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | | EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | | CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG | | HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` | | HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` |
| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* | | HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` | | HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` |
| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` | | HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |

4
docs/docker.md
View file

@ -58,6 +58,10 @@ You can configure the behavior of the EasyHAProxy by setup specific environment
Follow [this link](letsencrypt.md) Follow [this link](letsencrypt.md)
## Setup certificates with ZeroSSL
Follow [this link](zerossl.md)
## Setup your own certificates ## Setup your own certificates
Follow [this link](ssl.md) Follow [this link](ssl.md)

2
docs/helm.md
View file

@ -51,7 +51,7 @@ easyhaproxy:
certbot: DEBUG certbot: DEBUG
easyhaproxy: DEBUG easyhaproxy: DEBUG
haproxy: DEBUG haproxy: DEBUG
letsencrypt: certbot:
email: "" email: ""
service: service:

20
docs/kubernetes.md
View file

@ -79,27 +79,27 @@ Caveats:
## Kubernetes annotations ## Kubernetes annotations
| annotation | Description | Default | Example | | annotation | Description | Default | Example |
|-----------------------------|-----------------------------------------------------------------------------------------|--------------|--------------| |-----------------------------|-------------------------------------------------------------------------------------|--------------|---------------------------|
| kubernetes.io/ingress.class | (required) Activate EasyHAProxy. | **required** | easyhaproxy-ingress | kubernetes.io/ingress.class | (required) Activate EasyHAProxy. | **required** | easyhaproxy-ingress |
| easyhaproxy.redirect_ssl | (optional) Boolean. Force redirect all endpoints to HTTPS. | false | true or false | easyhaproxy.redirect_ssl | (optional) Boolean. Force redirect all endpoints to HTTPS. | false | true or false |
| easyhaproxy.letsencrypt | (optional) Boolean. It will request letsencrypt certificates for the ingresses domains. | false | true or false | easyhaproxy.certbot | (optional) Boolean. It will request certbot certificates for the ingresses domains. | false | true or false |
| easyhaproxy.redirect | (optional) JSON. Key pair with a domain and its destination. | *empty* | {"domain":"redirect_url"} | easyhaproxy.redirect | (optional) JSON. Key pair with a domain and its destination. | *empty* | {"domain":"redirect_url"} |
| easyhaproxy.mode | (optional) Set the HTTP mode for that connection. | http | http or tcp | easyhaproxy.mode | (optional) Set the HTTP mode for that connection. | http | http or tcp |
| easyhaproxy.listen_port | (optional) Set the an additional port for that ingress | http | http or tcp | easyhaproxy.listen_port | (optional) Set the an additional port for that ingress | http | http or tcp |
**Important**: The annotations are per ingress and applied to all hosts in that ingress configuration. **Important**: The annotations are per ingress and applied to all hosts in that ingress configuration.
## Letsencrypt ## Letsencrypt
It is necessary add the annotation `easyhaproxy.letsencrypt` to the ingress configuration: It is necessary add the annotation `easyhaproxy.certbot` to the ingress configuration:
```yaml ```yaml
kind: Ingress kind: Ingress
metadata: metadata:
annotations: annotations:
kubernetes.io/ingress.class: easyhaproxy-ingress kubernetes.io/ingress.class: easyhaproxy-ingress
easyhaproxy.letsencrypt: 'true' easyhaproxy.certbot: 'true'
name: example-ingress name: example-ingress
namespace: example namespace: example
spec: spec:

10
docs/letsencrypt.md
View file

@ -9,17 +9,17 @@ Run the EasyHAProxy container:
```bash ```bash
docker run \ docker run \
... \ ... \
-e EASYHAPROXY_LETSENCRYPT_EMAIL=john@doe.com \ -e EASYHAPROXY_CERTBOT_EMAIL=john@doe.com \
-p 80:80 \ -p 80:80 \
-p 443:443 \ -p 443:443 \
-v /path/to/guest/lestencrypt/certs:/certs/letsencrypt \ -v /path/to/guest/certbot/certs:/certs/certbot \
... \ ... \
byjg/easy-haproxy byjg/easy-haproxy
``` ```
Notes: Notes:
- If you don't setup `EASYHAPROXY_LETSENCRYPT_EMAIL` environment variable, EasyHAProxy will fail silently and **will not request** a certificate. - If you don't setup `EASYHAPROXY_CERTBOT_EMAIL` environment variable, EasyHAProxy will fail silently and **will not request** a certificate.
- The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/) - The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/)
Be aware of Letsencrypt issue rate limits: Be aware of Letsencrypt issue rate limits:
@ -28,7 +28,7 @@ Be aware of Letsencrypt issue rate limits:
- https://letsencrypt.org/docs/rate-limits/ - https://letsencrypt.org/docs/rate-limits/
In order to avoid several certificate issuing, In order to avoid several certificate issuing,
**It is required you to persist the container folder `/certs/letsencrypt` outside the container.** **It is required you to persist the container folder `/certs/certbot` outside the container.**
You cannot delete or change it contents. You cannot delete or change it contents.
If you do not persist, or change/delete the contents, Let's encrypt will not work properly. If you do not persist, or change/delete the contents, Let's encrypt will not work properly.
@ -41,7 +41,7 @@ docker run \
--label easyhaproxy.express.port=80 \ --label easyhaproxy.express.port=80 \
--label easyhaproxy.express.localport=3000 \ --label easyhaproxy.express.localport=3000 \
--label easyhaproxy.express.host=example.org \ --label easyhaproxy.express.host=example.org \
--label easyhaproxy.express.letsencrypt=true \ --label easyhaproxy.express.certbot=true \
... \ ... \
some/myimage some/myimage
``` ```

8
docs/static.md
View file

@ -20,7 +20,7 @@ customerrors: true # Optional (default false)
ssl_mode: default ssl_mode: default
letsencrypt: { certbot: {
"email": "acme@example.org" "email": "acme@example.org"
} }
@ -30,7 +30,7 @@ easymapping:
host1.com.br: host1.com.br:
containers: containers:
- container:5000 - container:5000
letsencrypt: true certbot: true
redirect_ssl: true redirect_ssl: true
host2.com.br: host2.com.br:
containers: containers:
@ -83,7 +83,7 @@ customerrors: true # Optional (default false)
ssl_mode: default # Optional ssl_mode: default # Optional
letsencrypt: { # Optional. If you enable `letsencrypt` will need to setu0p this, certbot: { # Optional. If you enable `certbot` will need to setu0p this,
# otherwise the certificate will be issued # otherwise the certificate will be issued
"email": "acme@example.org" "email": "acme@example.org"
} }
@ -95,7 +95,7 @@ easymapping:
host1.com.br: # Hostname host1.com.br: # Hostname
containers: containers:
- container:5000 # Endpoints of the hostname above (ip, dns, container, etc) - container:5000 # Endpoints of the hostname above (ip, dns, container, etc)
letsencrypt: true # Optional. it will request a letsencrypt certiticate certbot: true # Optional. it will request a certbot certiticate
redirect_ssl: true # Optional. It will redirect this site to it SSL. redirect_ssl: true # Optional. It will redirect this site to it SSL.
ssl: true # Optional. Inform this port will listen to SSL, instead of HTTP ssl: true # Optional. Inform this port will listen to SSL, instead of HTTP
clone_to_ssl: true # Optional. Default False. You clone these hosts to its equivalent SSL. clone_to_ssl: true # Optional. Default False. You clone these hosts to its equivalent SSL.

2
examples/docker/docker-compose-portainer-app-example.yml
View file

@ -8,7 +8,7 @@ services:
easyhaproxy.http.host: test.xpto.us easyhaproxy.http.host: test.xpto.us
easyhaproxy.http.port: 80 easyhaproxy.http.port: 80
easyhaproxy.http.localport: 8080 easyhaproxy.http.localport: 8080
easyhaproxy.http.letsencrypt: true easyhaproxy.http.certbot: true
networks: networks:

10
examples/docker/docker-compose-portainer.yml
View file

@ -1,4 +1,4 @@
# docker volume create certs_letsencrypt # docker volume create certs_certbot
# docker volume create certs_haproxy # docker volume create certs_haproxy
# docker volume create portainer_data # docker volume create portainer_data
# docker network create easyhaproxy # docker network create easyhaproxy
@ -11,13 +11,13 @@ services:
image: byjg/easy-haproxy image: byjg/easy-haproxy
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
- certs_letsencrypt:/certs/letsencrypt - certs_certbot:/certs/certbot
# - certs_haproxy:/certs/haproxy # - certs_haproxy:/certs/haproxy
environment: environment:
EASYHAPROXY_DISCOVER: docker EASYHAPROXY_DISCOVER: docker
EASYHAPROXY_LABEL_PREFIX: easyhaproxy EASYHAPROXY_LABEL_PREFIX: easyhaproxy
EASYHAPROXY_LETSENCRYPT_EMAIL: changeme@example.org EASYHAPROXY_CERTBOT_EMAIL: changeme@example.org
EASYHAPROXY_SSL_MODE: "default" EASYHAPROXY_SSL_MODE: "default"
HAPROXY_CUSTOMERRORS: "true" HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin HAPROXY_USERNAME: admin
@ -36,14 +36,14 @@ services:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
labels: labels:
easyhaproxy.http.redirect_ssl: true easyhaproxy.http.redirect_ssl: true
easyhaproxy.http.letsencrypt: true easyhaproxy.http.certbot: true
easyhaproxy.http.host: portainer.xpto.us easyhaproxy.http.host: portainer.xpto.us
easyhaproxy.http.port: 80 easyhaproxy.http.port: 80
easyhaproxy.http.localport: 9000 easyhaproxy.http.localport: 9000
volumes: volumes:
certs_letsencrypt: certs_certbot:
external: true external: true
certs_haproxy: certs_haproxy:
external: true external: true

6
helm/easyhaproxy/templates/deployment.yaml
View file

@ -69,7 +69,7 @@ spec:
value: {{ .Values.easyhaproxy.logLevel.haproxy }} value: {{ .Values.easyhaproxy.logLevel.haproxy }}
- name: CERTBOT_LOG_LEVEL - name: CERTBOT_LOG_LEVEL
value: {{ .Values.easyhaproxy.logLevel.certbot }} value: {{ .Values.easyhaproxy.logLevel.certbot }}
{{- if .Values.easyhaproxy.letsencrypt.email }} {{- if .Values.easyhaproxy.certbot.email }}
- name: EASYHAPROXY_LETSENCRYPT_EMAIL - name: EASYHAPROXY_CERTBOT_EMAIL
value: {{ .Values.easyhaproxy.letsencrypt.email }} value: {{ .Values.easyhaproxy.certbot.email }}
{{ end }} {{ end }}

2
helm/easyhaproxy/values.yaml
View file

@ -69,7 +69,7 @@ easyhaproxy:
certbot: DEBUG certbot: DEBUG
easyhaproxy: DEBUG easyhaproxy: DEBUG
haproxy: DEBUG haproxy: DEBUG
letsencrypt: certbot:
email: "" email: ""
# Make sure to create this # Make sure to create this

20
src/easymapping/__init__.py
View file

@ -49,10 +49,10 @@ class HaproxyConfigGenerator:
def __init__(self, mapping): def __init__(self, mapping):
self.mapping = mapping self.mapping = mapping
self.mapping.setdefault("ssl_mode", 'default') self.mapping.setdefault("ssl_mode", 'default')
self.mapping.setdefault("letsencrypt", {"email": "", "staging": False}) self.mapping.setdefault("certbot", {"email": "", "staging": False})
self.mapping["ssl_mode"] = self.mapping["ssl_mode"].lower() self.mapping["ssl_mode"] = self.mapping["ssl_mode"].lower()
self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy") self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy")
self.letsencrypt_hosts = [] self.certbot_hosts = []
self.serving_hosts = [] self.serving_hosts = []
self.certs = {} self.certs = {}
@ -106,10 +106,10 @@ class HaproxyConfigGenerator:
"80" "80"
) )
letsencrypt = self.label.get_bool( certbot = self.label.get_bool(
self.label.create([definition, "letsencrypt"]), self.label.create([definition, "certbot"]),
False False
) and self.mapping["letsencrypt"]["email"] != "" ) and self.mapping["certbot"]["email"] != ""
clone_to_ssl = self.label.get_bool( clone_to_ssl = self.label.get_bool(
self.label.create([definition, "clone_to_ssl"]) self.label.create([definition, "clone_to_ssl"])
) )
@ -139,9 +139,9 @@ class HaproxyConfigGenerator:
self.serving_hosts.append("%s:%s" % (hostname, port)) self.serving_hosts.append("%s:%s" % (hostname, port))
easymapping[port]["hosts"].setdefault(hostname, {}) easymapping[port]["hosts"].setdefault(hostname, {})
easymapping[port]["hosts"][hostname].setdefault("containers", []) easymapping[port]["hosts"][hostname].setdefault("containers", [])
easymapping[port]["hosts"][hostname].setdefault("letsencrypt", False) easymapping[port]["hosts"][hostname].setdefault("certbot", False)
easymapping[port]["hosts"][hostname]["containers"] += ["{}:{}".format(container, ct_port)] easymapping[port]["hosts"][hostname]["containers"] += ["{}:{}".format(container, ct_port)]
easymapping[port]["hosts"][hostname]["letsencrypt"] = letsencrypt easymapping[port]["hosts"][hostname]["certbot"] = certbot
easymapping[port]["hosts"][hostname]["redirect_ssl"] = self.label.get_bool( easymapping[port]["hosts"][hostname]["redirect_ssl"] = self.label.get_bool(
self.label.create([definition, "redirect_ssl"]) self.label.create([definition, "redirect_ssl"])
) )
@ -150,7 +150,7 @@ class HaproxyConfigGenerator:
self.label.create([definition, "redirect"]) self.label.create([definition, "redirect"])
) )
if letsencrypt or clone_to_ssl: if certbot or clone_to_ssl:
if "443" not in easymapping: if "443" not in easymapping:
easymapping["443"] = { easymapping["443"] = {
"mode": "http", "mode": "http",
@ -160,10 +160,10 @@ class HaproxyConfigGenerator:
"redirect": dict(), "redirect": dict(),
} }
easymapping["443"]["hosts"][hostname] = dict(easymapping[port]["hosts"][hostname]) easymapping["443"]["hosts"][hostname] = dict(easymapping[port]["hosts"][hostname])
easymapping["443"]["hosts"][hostname]["letsencrypt"] = False easymapping["443"]["hosts"][hostname]["certbot"] = False
easymapping["443"]["hosts"][hostname]["redirect_ssl"] = False easymapping["443"]["hosts"][hostname]["redirect_ssl"] = False
easymapping["443"]["ssl"] = True easymapping["443"]["ssl"] = True
self.letsencrypt_hosts.append(hostname) if letsencrypt and hostname not in self.letsencrypt_hosts else self.letsencrypt_hosts self.certbot_hosts.append(hostname) if certbot and hostname not in self.certbot_hosts else self.certbot_hosts
# handle SSL # handle SSL

10
src/functions/__init__.py
View file

@ -102,7 +102,7 @@ class Functions:
class Consts: class Consts:
easyhaproxy_config = "/etc/haproxy/static/config.yml" easyhaproxy_config = "/etc/haproxy/static/config.yml"
haproxy_config = "/etc/haproxy/haproxy.cfg" haproxy_config = "/etc/haproxy/haproxy.cfg"
certs_letsencrypt = "/certs/letsencrypt" certs_certbot = "/certs/certbot"
certs_haproxy = "/certs/haproxy" certs_haproxy = "/certs/haproxy"
@ -259,11 +259,11 @@ class Certbot:
Functions.save(filename, cert + key) Functions.save(filename, cert + key)
def find_live_certificates(self): def find_live_certificates(self):
letsencrypt_certs = "/etc/letsencrypt/live/" certbot_certs = "/etc/letsencrypt/live/"
if not os.path.exists(letsencrypt_certs): if not os.path.exists(certbot_certs):
return return
for item in os.listdir(letsencrypt_certs): for item in os.listdir(certbot_certs):
path = os.path.join(letsencrypt_certs, item) path = os.path.join(certbot_certs, item)
if os.path.isdir(path): if os.path.isdir(path):
cert = Functions.load(os.path.join(path, "cert.pem")) cert = Functions.load(os.path.join(path, "cert.pem"))
key = Functions.load(os.path.join(path, "privkey.pem")) key = Functions.load(os.path.join(path, "privkey.pem"))

10
src/main.py
View file

@ -8,12 +8,12 @@ def start():
if processor_obj is None: if processor_obj is None:
exit(1) exit(1)
os.makedirs(Consts.certs_letsencrypt, exist_ok=True) os.makedirs(Consts.certs_certbot, exist_ok=True)
os.makedirs(Consts.certs_haproxy, exist_ok=True) os.makedirs(Consts.certs_haproxy, exist_ok=True)
processor_obj.save_config(Consts.haproxy_config) processor_obj.save_config(Consts.haproxy_config)
processor_obj.save_certs(Consts.certs_haproxy) processor_obj.save_certs(Consts.certs_haproxy)
letsencrypt_certs_found = processor_obj.get_letsencrypt_hosts() certbot_certs_found = processor_obj.get_certbot_hosts()
Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to run after save_config Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to run after save_config
Functions.log(Functions.EASYHAPROXY_LOG, Functions.TRACE, 'Object Found: %s' % (processor_obj.get_parsed_object())) Functions.log(Functions.EASYHAPROXY_LOG, Functions.TRACE, 'Object Found: %s' % (processor_obj.get_parsed_object()))
@ -22,7 +22,7 @@ def start():
haproxy.haproxy("start") haproxy.haproxy("start")
haproxy.sleep() haproxy.sleep()
certbot = Certbot(Consts.certs_letsencrypt, os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"), os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "").lower()) certbot = Certbot(Consts.certs_certbot, os.getenv("EASYHAPROXY_CERTBOT_EMAIL"), os.getenv("EASYHAPROXY_CERTBOT_SERVER", "").lower())
while True: while True:
if old_haproxy is not None: if old_haproxy is not None:
@ -31,12 +31,12 @@ def start():
try: try:
old_parsed = processor_obj.get_parsed_object() old_parsed = processor_obj.get_parsed_object()
processor_obj.refresh() processor_obj.refresh()
if certbot.check_certificates(letsencrypt_certs_found) or DeepDiff(old_parsed, processor_obj.get_parsed_object()) != {} or not haproxy.is_alive(): if certbot.check_certificates(certbot_certs_found) or DeepDiff(old_parsed, processor_obj.get_parsed_object()) != {} or not haproxy.is_alive():
Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'New configuration found. Reloading...') Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'New configuration found. Reloading...')
Functions.log(Functions.EASYHAPROXY_LOG, Functions.TRACE, 'Object Found: %s' % (processor_obj.get_parsed_object())) Functions.log(Functions.EASYHAPROXY_LOG, Functions.TRACE, 'Object Found: %s' % (processor_obj.get_parsed_object()))
processor_obj.save_config(Consts.haproxy_config) processor_obj.save_config(Consts.haproxy_config)
processor_obj.save_certs(Consts.certs_haproxy) processor_obj.save_certs(Consts.certs_haproxy)
letsencrypt_certs_found = processor_obj.get_letsencrypt_hosts() certbot_certs_found = processor_obj.get_certbot_hosts()
Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to after save_config Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to after save_config
old_haproxy = haproxy old_haproxy = haproxy
haproxy = DaemonizeHAProxy() haproxy = DaemonizeHAProxy()

22
src/processor/__init__.py
View file

@ -26,10 +26,10 @@ class ContainerEnv:
} }
env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv("EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy" env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv("EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy"
if (os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL")): if (os.getenv("EASYHAPROXY_CERTBOT_EMAIL")):
env_vars["letsencrypt"] = { env_vars["certbot"] = {
"email": os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"), "email": os.getenv("EASYHAPROXY_CERTBOT_EMAIL"),
"server": os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "false").lower() in ["true", "1", "yes"] "server": os.getenv("EASYHAPROXY_CERTBOT_SERVER", "false").lower() in ["true", "1", "yes"]
} }
return env_vars return env_vars
@ -57,7 +57,7 @@ class ProcessorInterface:
return None return None
def refresh(self): def refresh(self):
self.letsencrypt_hosts = None self.certbot_hosts = None
self.parsed_object = None self.parsed_object = None
self.cfg = None self.cfg = None
self.hosts = None self.hosts = None
@ -71,8 +71,8 @@ class ProcessorInterface:
def parse(self): def parse(self):
self.cfg = HaproxyConfigGenerator(ContainerEnv.read()) self.cfg = HaproxyConfigGenerator(ContainerEnv.read())
def get_letsencrypt_hosts(self): def get_certbot_hosts(self):
return self.letsencrypt_hosts return self.certbot_hosts
def get_hosts(self): def get_hosts(self):
return self.hosts return self.hosts
@ -88,7 +88,7 @@ class ProcessorInterface:
def get_haproxy_conf(self): def get_haproxy_conf(self):
conf = self.cfg.generate(self.parsed_object) conf = self.cfg.generate(self.parsed_object)
self.letsencrypt_hosts = self.cfg.letsencrypt_hosts self.certbot_hosts = self.cfg.certbot_hosts
self.hosts = self.cfg.serving_hosts self.hosts = self.cfg.serving_hosts
return conf return conf
@ -206,7 +206,7 @@ class Kubernetes(ProcessorInterface):
ssl_hosts = [] ssl_hosts = []
letsencrypt = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.letsencrypt") certbot = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.certbot")
redirect_ssl = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect_ssl") redirect_ssl = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect_ssl")
redirect = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect") redirect = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect")
mode = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.mode") mode = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.mode")
@ -252,8 +252,8 @@ class Kubernetes(ProcessorInterface):
rule_data["%s.clone_to_ssl" % (definition)] = 'true' rule_data["%s.clone_to_ssl" % (definition)] = 'true'
if redirect_ssl is not None: if redirect_ssl is not None:
rule_data["%s.redirect_ssl" % (definition)] = redirect_ssl rule_data["%s.redirect_ssl" % (definition)] = redirect_ssl
if letsencrypt is not None: if certbot is not None:
rule_data["%s.letsencrypt" % (definition)] = letsencrypt rule_data["%s.certbot" % (definition)] = certbot
if redirect is not None: if redirect is not None:
rule_data["%s.redirect" % (definition)] = redirect rule_data["%s.redirect" % (definition)] = redirect
if mode is not None: if mode is not None:

2
src/templates/bind.j2
View file

@ -1,5 +1,5 @@
{% if "ssl" in o %} {% if "ssl" in o %}
bind *:{{ o["port"] }} ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 bind *:{{ o["port"] }} ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
{% elif "h2" in o and o["h2"] %} {% elif "h2" in o and o["h2"] %}
bind *:{{ o["port"] }} proto h2 bind *:{{ o["port"] }} proto h2
option http-use-htx option http-use-htx

10
src/templates/frontend-mode-http.j2
View file

@ -5,16 +5,16 @@
{%- for k in o["hosts"] %} {%- for k in o["hosts"] %}
{% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %} {% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
{% set letsencrypt = o["hosts"][k]["letsencrypt"] %} {% set certbot = o["hosts"][k]["certbot"] %}
acl is_rule_{{ host }}_1 hdr(host) -i {{ k }} acl is_rule_{{ host }}_1 hdr(host) -i {{ k }}
acl is_rule_{{ host }}_2 hdr(host) -i {{ k }}:{{ o["port"] }} acl is_rule_{{ host }}_2 hdr(host) -i {{ k }}:{{ o["port"] }}
{% if letsencrypt %} {% if certbot %}
acl is_letsencrypt_{{ host }} path_beg /.well-known/acme-challenge/ acl is_certbot_{{ host }} path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_{{ host }} is_rule_{{ host }}_1 OR is_letsencrypt_{{ host }} is_rule_{{ host }}_2 use_backend certbot_backend if is_certbot_{{ host }} is_rule_{{ host }}_1 OR is_certbot_{{ host }} is_rule_{{ host }}_2
{% endif %} {% endif %}
{% if o["hosts"][k]["redirect_ssl"] %} {% if o["hosts"][k]["redirect_ssl"] %}
http-request redirect scheme https code 301 if {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_1 OR {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_2 http-request redirect scheme https code 301 if {% if certbot %}!is_certbot_{{ host }} {% endif %}is_rule_{{ host }}_1 OR {% if certbot %}!is_certbot_{{ host }} {% endif %}is_rule_{{ host }}_2
{% else %} {% else %}
use_backend srv_{{ host }} if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2 use_backend srv_{{ host }} if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2
{% endif %} {% endif %}

2
src/templates/haproxy.cfg.j2
View file

@ -75,7 +75,7 @@ backend srv_{{ host }}
{% endfor %} {% endfor %}
{% endfor %} {% endfor %}
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

8
src/tests/expected/docker.txt
View file

@ -36,7 +36,7 @@ backend srv_stats
server Local 127.0.0.1:1936 server Local 127.0.0.1:1936
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
mode http mode http
acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local
@ -84,8 +84,8 @@ frontend http_in_90
acl is_rule_host2_local_90_1 hdr(host) -i host2.local acl is_rule_host2_local_90_1 hdr(host) -i host2.local
acl is_rule_host2_local_90_2 hdr(host) -i host2.local:90 acl is_rule_host2_local_90_2 hdr(host) -i host2.local:90
acl is_letsencrypt_host2_local_90 path_beg /.well-known/acme-challenge/ acl is_certbot_host2_local_90 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_host2_local_90 is_rule_host2_local_90_1 OR is_letsencrypt_host2_local_90 is_rule_host2_local_90_2 use_backend certbot_backend if is_certbot_host2_local_90 is_rule_host2_local_90_1 OR is_certbot_host2_local_90 is_rule_host2_local_90_2
use_backend srv_host2_local_90 if is_rule_host2_local_90_1 OR is_rule_host2_local_90_2 use_backend srv_host2_local_90 if is_rule_host2_local_90_1 OR is_rule_host2_local_90_2
backend srv_host2_local_90 backend srv_host2_local_90
@ -96,6 +96,6 @@ backend srv_host2_local_90
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 test_processor_docker:9000 check weight 1 server srv-0 test_processor_docker:9000 check weight 1
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/expected/no-services.txt
View file

@ -23,6 +23,6 @@ defaults
timeout server 10m timeout server 10m
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

10
src/tests/expected/services-letsencrypt.txt
View file

@ -49,9 +49,9 @@ frontend http_in_80
acl is_rule_test_example_org_80_1 hdr(host) -i test.example.org acl is_rule_test_example_org_80_1 hdr(host) -i test.example.org
acl is_rule_test_example_org_80_2 hdr(host) -i test.example.org:80 acl is_rule_test_example_org_80_2 hdr(host) -i test.example.org:80
acl is_letsencrypt_test_example_org_80 path_beg /.well-known/acme-challenge/ acl is_certbot_test_example_org_80 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_1 OR is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_2 use_backend certbot_backend if is_certbot_test_example_org_80 is_rule_test_example_org_80_1 OR is_certbot_test_example_org_80 is_rule_test_example_org_80_2
http-request redirect scheme https code 301 if !is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_1 OR !is_letsencrypt_test_example_org_80 is_rule_test_example_org_80_2 http-request redirect scheme https code 301 if !is_certbot_test_example_org_80 is_rule_test_example_org_80_1 OR !is_certbot_test_example_org_80 is_rule_test_example_org_80_2
acl is_rule_test2_example_org_80_1 hdr(host) -i test2.example.org acl is_rule_test2_example_org_80_1 hdr(host) -i test2.example.org
acl is_rule_test2_example_org_80_2 hdr(host) -i test2.example.org:80 acl is_rule_test2_example_org_80_2 hdr(host) -i test2.example.org:80
@ -74,7 +74,7 @@ backend srv_test2_example_org_80
server srv-0 83d57d592e26:8080 check weight 1 server srv-0 83d57d592e26:8080 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
mode http mode http
acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org
@ -90,6 +90,6 @@ backend srv_test_example_org_443
server srv-0 f5c645a0dfc6:80 check weight 1 verify none server srv-0 f5c645a0dfc6:80 check weight 1 verify none
server srv-1 b63438410b6a:80 check weight 1 verify none server srv-1 b63438410b6a:80 check weight 1 verify none
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/expected/services-multi-containers.txt
View file

@ -40,6 +40,6 @@ backend srv_www_helloworld_com_19901
server srv-0 test_nginx.2.t5r94mjlced7m3t5orfjbowmm:80 check weight 1 server srv-0 test_nginx.2.t5r94mjlced7m3t5orfjbowmm:80 check weight 1
server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1 server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/expected/services-multiple-hosts.txt
View file

@ -73,6 +73,6 @@ backend srv_hello_com_19901
server srv-0 3e63154954b0:80 check weight 1 server srv-0 3e63154954b0:80 check weight 1
server srv-1 eb294c110eb1:80 check weight 1 server srv-1 eb294c110eb1:80 check weight 1
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

4
src/tests/expected/services-redirect-ssl.txt
View file

@ -49,7 +49,7 @@ backend srv_host1_local_80
server srv-0 5b69bc7fea1b:80 check weight 1 server srv-0 5b69bc7fea1b:80 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
mode http mode http
acl is_rule_host2_local_443_1 hdr(host) -i host2.local acl is_rule_host2_local_443_1 hdr(host) -i host2.local
@ -75,6 +75,6 @@ backend srv_host1_local_443
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 5b69bc7fea1b:8080 check weight 1 server srv-0 5b69bc7fea1b:8080 check weight 1
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/expected/services-tcp.txt
View file

@ -37,6 +37,6 @@ backend srv_agent_quantum_local_31339
tcp-check connect ssl tcp-check connect ssl
server srv-0 test_agent:9001 check weight 1 verify none server srv-0 test_agent:9001 check weight 1 verify none
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

8
src/tests/expected/services.txt
View file

@ -47,8 +47,8 @@ frontend http_in_31337
acl is_rule_node-exporter_quantum_example_org_31337_1 hdr(host) -i node-exporter.quantum.example.org acl is_rule_node-exporter_quantum_example_org_31337_1 hdr(host) -i node-exporter.quantum.example.org
acl is_rule_node-exporter_quantum_example_org_31337_2 hdr(host) -i node-exporter.quantum.example.org:31337 acl is_rule_node-exporter_quantum_example_org_31337_2 hdr(host) -i node-exporter.quantum.example.org:31337
acl is_letsencrypt_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/ acl is_certbot_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2 use_backend certbot_backend if is_certbot_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_certbot_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2
use_backend srv_node-exporter_quantum_example_org_31337 if is_rule_node-exporter_quantum_example_org_31337_1 OR is_rule_node-exporter_quantum_example_org_31337_2 use_backend srv_node-exporter_quantum_example_org_31337 if is_rule_node-exporter_quantum_example_org_31337_1 OR is_rule_node-exporter_quantum_example_org_31337_2
backend srv_cadvisor_quantum_example_org_31337 backend srv_cadvisor_quantum_example_org_31337
@ -67,7 +67,7 @@ backend srv_node-exporter_quantum_example_org_31337
server srv-0 my-stack_node-exporter:9100 check weight 1 server srv-0 my-stack_node-exporter:9100 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
mode http mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
@ -119,6 +119,6 @@ backend srv_www_somehost_com_br_80
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 some-service:80 check weight 1 server srv-0 some-service:80 check weight 1
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/expected/ssl-loose.txt
View file

@ -33,6 +33,6 @@ backend srv_stats
mode http mode http
server Local 127.0.0.1:1936 server Local 127.0.0.1:1936
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/expected/ssl-strict.txt
View file

@ -18,6 +18,6 @@ defaults
timeout server 10m timeout server 10m
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

8
src/tests/expected/static.txt
View file

@ -50,8 +50,8 @@ frontend http_in_80
acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80 acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80
acl is_letsencrypt_host1_com_br_80 path_beg /.well-known/acme-challenge/ acl is_certbot_host1_com_br_80 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_2 use_backend certbot_backend if is_certbot_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_certbot_host1_com_br_80 is_rule_host1_com_br_80_2
use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2 use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2
acl is_rule_host2_com_br_80_1 hdr(host) -i host2.com.br acl is_rule_host2_com_br_80_1 hdr(host) -i host2.com.br
@ -74,7 +74,7 @@ backend srv_host2_com_br_80
server srv-0 other:3000 check weight 1 server srv-0 other:3000 check weight 1
frontend http_in_443 frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1 bind *:443 ssl crt /certs/certbot/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
mode http mode http
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
@ -105,6 +105,6 @@ backend srv_host3_com_br_8080
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 domain:8181 check weight 1 server srv-0 domain:8181 check weight 1
backend letsencrypt_backend backend certbot_backend
mode http mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

2
src/tests/fixtures/services vendored
View file

@ -1,6 +1,6 @@
{"portainer-agent_agent": {"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"}, {"portainer-agent_agent": {"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"},
"my-stack_agent": {"easyhaproxy.agent.host":"agent.quantum.example.org","easyhaproxy.agent.localport":"9001","easyhaproxy.agent.mode":"tcp","easyhaproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_agent": {"easyhaproxy.agent.host":"agent.quantum.example.org","easyhaproxy.agent.localport":"9001","easyhaproxy.agent.mode":"tcp","easyhaproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"},
"my-stack_cadvisor": {"easyhaproxy.cadvisor.host":"cadvisor.quantum.example.org","easyhaproxy.cadvisor.localport":"8080","easyhaproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_cadvisor": {"easyhaproxy.cadvisor.host":"cadvisor.quantum.example.org","easyhaproxy.cadvisor.localport":"8080","easyhaproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"},
"my-stack_node-exporter": {"easyhaproxy.exp.host":"node-exporter.quantum.example.org","easyhaproxy.exp.localport":"9100","easyhaproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","easyhaproxy.exp.letsencrypt":"true"}, "my-stack_node-exporter": {"easyhaproxy.exp.host":"node-exporter.quantum.example.org","easyhaproxy.exp.localport":"9100","easyhaproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","easyhaproxy.exp.certbot":"true"},
"my-stack_reverse-proxy": {"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_reverse-proxy": {"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"},
"some-service": {"easyhaproxy.http.port":"80","easyhaproxy.http.host":"www.somehost.com.br","easyhaproxy.http.localport":"80","easyhaproxy.http.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","easyhaproxy.https.port":"443","easyhaproxy.https.host":"www.somehost.com.br","easyhaproxy.https.localport":"80","easyhaproxy.https.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","easyhaproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}} "some-service": {"easyhaproxy.http.port":"80","easyhaproxy.http.host":"www.somehost.com.br","easyhaproxy.http.localport":"80","easyhaproxy.http.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","easyhaproxy.https.port":"443","easyhaproxy.https.host":"www.somehost.com.br","easyhaproxy.https.localport":"80","easyhaproxy.https.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","easyhaproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}}

2
src/tests/fixtures/services-changed-label vendored
View file

@ -1,6 +1,6 @@
{"portainer-agent_agent": {"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"}, {"portainer-agent_agent": {"com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"portainer-agent"},
"my-stack_agent": {"haproxy.agent.host":"agent.quantum.example.org","haproxy.agent.localport":"9001","haproxy.agent.mode":"tcp","haproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_agent": {"haproxy.agent.host":"agent.quantum.example.org","haproxy.agent.localport":"9001","haproxy.agent.mode":"tcp","haproxy.agent.port":"31339","com.docker.stack.image":"portainer/agent:1.5.1","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"},
"my-stack_cadvisor": {"haproxy.cadvisor.host":"cadvisor.quantum.example.org","haproxy.cadvisor.localport":"8080","haproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_cadvisor": {"haproxy.cadvisor.host":"cadvisor.quantum.example.org","haproxy.cadvisor.localport":"8080","haproxy.cadvisor.port":"31337","com.docker.stack.image":"gcr.io/google-containers/cadvisor:v0.34.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"},
"my-stack_node-exporter": {"haproxy.exp.host":"node-exporter.quantum.example.org","haproxy.exp.localport":"9100","haproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","haproxy.exp.letsencrypt":"yes"}, "my-stack_node-exporter": {"haproxy.exp.host":"node-exporter.quantum.example.org","haproxy.exp.localport":"9100","haproxy.exp.port":"31337","com.docker.stack.image":"stefanprodan/swarmprom-node-exporter:v0.16.0","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring","haproxy.exp.certbot":"yes"},
"my-stack_reverse-proxy": {"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"}, "my-stack_reverse-proxy": {"com.docker.stack.image":"quay.io/pngmbh/easy-haproxy:tcp-mode","com.docker.stack.namespace":"my-stack","com.planetary-quantum":"monitoring"},
"some-service": {"haproxy.http.port":"80","haproxy.http.host":"www.somehost.com.br","haproxy.http.localport":"80","haproxy.http.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","haproxy.https.port":"443","haproxy.https.host":"www.somehost.com.br","haproxy.https.localport":"80","haproxy.https.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","haproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}} "some-service": {"haproxy.http.port":"80","haproxy.http.host":"www.somehost.com.br","haproxy.http.localport":"80","haproxy.http.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","haproxy.https.port":"443","haproxy.https.host":"www.somehost.com.br","haproxy.https.localport":"80","haproxy.https.redirect":"{\"somehost.com.br\":\"https://www.somehost.com.br\",\"somehost.com\":\"https://www.somehost.com.br\",\"www.somehost.com\":\"https://www.somehost.com.br\",\"byjg.ca\":\"https://www.somehost.com.br\",\"www.byjg.ca\":\"https://www.somehost.com.br\"}","haproxy.https.sslcert":"U29tZSBQRU0gQ2VydGlmaWNhdGU="}}

4
src/tests/fixtures/services-letsencrypt vendored
View file

@ -1,4 +1,4 @@
{"f5c645a0dfc6": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.letsencrypt":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"}, {"f5c645a0dfc6": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.certbot":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"},
"bbd4d1854155": {"com.docker.compose.config-hash":"3dc790bf2bea944359c75a40c45655bd868f1d85beb599d1ca797e8ea2c95ee4","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:0fd95b1512c207048ab3fcc74032354f38143fbb8235ac2a47da903c98a58205","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"haproxy","com.docker.compose.version":"2.8.0"}, "bbd4d1854155": {"com.docker.compose.config-hash":"3dc790bf2bea944359c75a40c45655bd868f1d85beb599d1ca797e8ea2c95ee4","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:0fd95b1512c207048ab3fcc74032354f38143fbb8235ac2a47da903c98a58205","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"haproxy","com.docker.compose.version":"2.8.0"},
"b63438410b6a": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.letsencrypt":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"}, "b63438410b6a": {"com.docker.compose.config-hash":"b95ebc27d0e61caa418cdfa632e05a656da9bbc3ea0d4603651971015f10a1f0","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test.example.org","easyhaproxy.http.certbot":"true","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"80","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}","easyhaproxy.http.redirect_ssl":"true"},
"83d57d592e26": {"com.docker.compose.config-hash":"8c5871144f1e8a3aeca037207c02f011ab2c6e6c311a3773602b63541762dab5","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:c4232396c715f3d568816c666e6d9b4a68ef6c36f6243b4007c4ee1d8335fd65","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"static","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test2.example.org","easyhaproxy.http.localport":"8080","easyhaproxy.http.port":"80","io.buildah.version":"1.21.0"}} "83d57d592e26": {"com.docker.compose.config-hash":"8c5871144f1e8a3aeca037207c02f011ab2c6e6c311a3773602b63541762dab5","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:c4232396c715f3d568816c666e6d9b4a68ef6c36f6243b4007c4ee1d8335fd65","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-test.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"static","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"test2.example.org","easyhaproxy.http.localport":"8080","easyhaproxy.http.port":"80","io.buildah.version":"1.21.0"}}

2
src/tests/fixtures/static.yml vendored
View file

@ -11,7 +11,7 @@ easymapping:
host1.com.br: host1.com.br:
containers: containers:
- container:5000 - container:5000
letsencrypt: true certbot: true
host2.com.br: host2.com.br:
containers: containers:
- other:3000 - other:3000

16
src/tests/test_containerenv.py
View file

@ -87,32 +87,32 @@ def test_container_env_stats_password():
def test_container_env_stats_password(): def test_container_env_stats_password():
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'acme@example.org' os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = 'acme@example.org'
try: try:
assert { assert {
"customerrors": False, "customerrors": False,
"ssl_mode": "default", "ssl_mode": "default",
"lookup_label": "easyhaproxy", "lookup_label": "easyhaproxy",
"letsencrypt": { "certbot": {
"email": "acme@example.org", "email": "acme@example.org",
"server": False "server": False
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = ''
def test_container_env_letsencrypt(): def test_container_env_certbot():
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'acme@example.org' os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = 'acme@example.org'
os.environ['EASYHAPROXY_LETSENCRYPT_SERVER'] = 'true' os.environ['EASYHAPROXY_CERTBOT_SERVER'] = 'true'
try: try:
assert { assert {
"customerrors": False, "customerrors": False,
"ssl_mode": "default", "ssl_mode": "default",
"lookup_label": "easyhaproxy", "lookup_label": "easyhaproxy",
"letsencrypt": { "certbot": {
"email": "acme@example.org", "email": "acme@example.org",
"server": True "server": True
} }
} == ContainerEnv.read() } == ContainerEnv.read()
finally: finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = ''

12
src/tests/test_docker.py
View file

@ -46,7 +46,7 @@ def test_processor_docker():
"easyhaproxy.http2.port": "90", "easyhaproxy.http2.port": "90",
"easyhaproxy.http2.localport": "9000", "easyhaproxy.http2.localport": "9000",
"easyhaproxy.http2.host": "host2.local", "easyhaproxy.http2.host": "host2.local",
"easyhaproxy.http2.letsencrypt": "true", "easyhaproxy.http2.certbot": "true",
}) })
container2 = client.containers.run("byjg/static-httpserver", container2 = client.containers.run("byjg/static-httpserver",
name="test2_processor_docker", name="test2_processor_docker",
@ -62,10 +62,10 @@ def test_processor_docker():
try: try:
time.sleep(1) time.sleep(1)
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'docker@example.org' os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = 'docker@example.org'
static = ProcessorInterface.factory("docker") static = ProcessorInterface.factory("docker")
assert static.get_letsencrypt_hosts() is None assert static.get_certbot_hosts() is None
assert { assert {
'easyhaproxy.http.host': 'host1.local', 'easyhaproxy.http.host': 'host1.local',
@ -74,7 +74,7 @@ def test_processor_docker():
'easyhaproxy.http2.host': 'host2.local', 'easyhaproxy.http2.host': 'host2.local',
'easyhaproxy.http2.localport': '9000', 'easyhaproxy.http2.localport': '9000',
'easyhaproxy.http2.port': '90', 'easyhaproxy.http2.port': '90',
'easyhaproxy.http2.letsencrypt': 'true', 'easyhaproxy.http2.certbot': 'true',
} == _get_hydrated_object(static.get_parsed_object(), "easyhaproxy.http") } == _get_hydrated_object(static.get_parsed_object(), "easyhaproxy.http")
assert { assert {
'easyhaproxy.ssl.host': 'hostssl.local', 'easyhaproxy.ssl.host': 'hostssl.local',
@ -90,7 +90,7 @@ def test_processor_docker():
assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/docker.txt")).replace("test_processor_docker", _get_ip_host( assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/docker.txt")).replace("test_processor_docker", _get_ip_host(
static.get_parsed_object(), "easyhaproxy.http")).replace("test2_processor_docker", _get_ip_host(static.get_parsed_object(), "easyhaproxy.ssl")) static.get_parsed_object(), "easyhaproxy.http")).replace("test2_processor_docker", _get_ip_host(static.get_parsed_object(), "easyhaproxy.ssl"))
assert static.get_letsencrypt_hosts() == ['host2.local'] assert static.get_certbot_hosts() == ['host2.local']
assert static.get_hosts() == [ assert static.get_hosts() == [
'hostssl.local:443', 'hostssl.local:443',
'host1.local:80', 'host1.local:80',
@ -100,7 +100,7 @@ def test_processor_docker():
'hostssl.local.pem': 'Some PEM Certificate' 'hostssl.local.pem': 'Some PEM Certificate'
} }
finally: finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = '' os.environ['EASYHAPROXY_CERTBOT_EMAIL'] = ''
container.stop() container.stop()
container2.stop() container2.stop()

72
src/tests/test_parser.py
View file

@ -6,7 +6,7 @@ import json
CERTS_FOLDER="/tmp/certs" CERTS_FOLDER="/tmp/certs"
CERT_FILE="/tmp/certs/haproxy/www.somehost.com.br.pem" CERT_FILE="/tmp/certs/haproxy/www.somehost.com.br.pem"
LETSENCRYPT_EMAIL="some@email.com" CERTBOT_EMAIL="some@email.com"
def load_fixture(file): def load_fixture(file):
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
@ -33,15 +33,15 @@ def test_parser_doesnt_crash():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/no-services.txt", 'r') as expected_file: with open(path + "/expected/no-services.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_finds_services(): def test_parser_finds_services():
line_list = load_fixture("services") line_list = load_fixture("services")
result = { result = {
"customerrors": False, "customerrors": False,
"letsencrypt": { "certbot": {
"email": LETSENCRYPT_EMAIL "email": CERTBOT_EMAIL
}, },
"stats": { "stats": {
"port": 0 "port": 0
@ -58,7 +58,7 @@ def test_parser_finds_services():
assert {"www.somehost.com.br.pem":"Some PEM Certificate"} == cfg.certs assert {"www.somehost.com.br.pem":"Some PEM Certificate"} == cfg.certs
assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts assert ['node-exporter.quantum.example.org'] == cfg.certbot_hosts
def test_parser_finds_services_changed_label(): def test_parser_finds_services_changed_label():
line_list = load_fixture("services-changed-label") line_list = load_fixture("services-changed-label")
@ -66,8 +66,8 @@ def test_parser_finds_services_changed_label():
result = { result = {
"customerrors": False, "customerrors": False,
"lookup_label": "haproxy", "lookup_label": "haproxy",
"letsencrypt": { "certbot": {
"email": LETSENCRYPT_EMAIL "email": CERTBOT_EMAIL
}, },
"stats": { "stats": {
"port": 0 "port": 0
@ -87,15 +87,15 @@ def test_parser_finds_services_changed_label():
assert {"www.somehost.com.br.pem":"Some PEM Certificate"} == cfg.certs assert {"www.somehost.com.br.pem":"Some PEM Certificate"} == cfg.certs
assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts assert ['node-exporter.quantum.example.org'] == cfg.certbot_hosts
def test_parser_finds_services_raw(): def test_parser_finds_services_raw():
line_list = load_fixture("services") line_list = load_fixture("services")
result = { result = {
"customerrors": False, "customerrors": False,
"letsencrypt": { "certbot": {
"email": LETSENCRYPT_EMAIL "email": CERTBOT_EMAIL
}, },
"stats": { "stats": {
"port": 0 "port": 0
@ -117,7 +117,7 @@ def test_parser_finds_services_raw():
"containers": [ "containers": [
"my-stack_agent:9001" "my-stack_agent:9001"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
} }
}, },
@ -134,14 +134,14 @@ def test_parser_finds_services_raw():
"containers": [ "containers": [
"my-stack_cadvisor:8080" "my-stack_cadvisor:8080"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
}, },
"node-exporter.quantum.example.org":{ "node-exporter.quantum.example.org":{
"containers": [ "containers": [
"my-stack_node-exporter:9100" "my-stack_node-exporter:9100"
], ],
"letsencrypt": True, "certbot": True,
"redirect_ssl": False "redirect_ssl": False
} }
}, },
@ -158,14 +158,14 @@ def test_parser_finds_services_raw():
"containers": [ "containers": [
"my-stack_node-exporter:9100" "my-stack_node-exporter:9100"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
}, },
"www.somehost.com.br":{ "www.somehost.com.br":{
"containers": [ "containers": [
"some-service:80" "some-service:80"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
} }
}, },
@ -187,7 +187,7 @@ def test_parser_finds_services_raw():
"containers": [ "containers": [
"some-service:80" "some-service:80"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
} }
}, },
@ -204,7 +204,7 @@ def test_parser_finds_services_raw():
processed = list(cfg.parse(line_list)) processed = list(cfg.parse(line_list))
assert parsed_object == processed assert parsed_object == processed
assert ['node-exporter.quantum.example.org'] == cfg.letsencrypt_hosts assert ['node-exporter.quantum.example.org'] == cfg.certbot_hosts
@ -219,7 +219,7 @@ def test_parser_static():
with open(path + "/expected/static.txt", 'r') as expected_file: with open(path + "/expected/static.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_static_raw(): def test_parser_static_raw():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
@ -241,7 +241,7 @@ def test_parser_static_raw():
"containers": [ "containers": [
"container:5000" "container:5000"
], ],
"letsencrypt": True "certbot": True
}, },
"host2.com.br": { "host2.com.br": {
"containers": [ "containers": [
@ -299,7 +299,7 @@ def test_parser_tcp():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/services-tcp.txt", 'r') as expected_file: with open(path + "/expected/services-tcp.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_multi_containers(): def test_parser_multi_containers():
line_list = load_fixture("services-multi-containers") line_list = load_fixture("services-multi-containers")
@ -318,7 +318,7 @@ def test_parser_multi_containers():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/services-multi-containers.txt", 'r') as expected_file: with open(path + "/expected/services-multi-containers.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_multiple_hosts(): def test_parser_multiple_hosts():
@ -340,7 +340,7 @@ def test_parser_multiple_hosts():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/services-multiple-hosts.txt", 'r') as expected_file: with open(path + "/expected/services-multiple-hosts.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_redirect_ssl(): def test_parser_redirect_ssl():
@ -361,7 +361,7 @@ def test_parser_redirect_ssl():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/services-redirect-ssl.txt", 'r') as expected_file: with open(path + "/expected/services-redirect-ssl.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_ssl_strict(): def test_parser_ssl_strict():
@ -382,7 +382,7 @@ def test_parser_ssl_strict():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/ssl-strict.txt", 'r') as expected_file: with open(path + "/expected/ssl-strict.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_ssl_loose(): def test_parser_ssl_loose():
line_list = load_fixture("no-services") line_list = load_fixture("no-services")
@ -399,7 +399,7 @@ def test_parser_ssl_loose():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/ssl-loose.txt", 'r') as expected_file: with open(path + "/expected/ssl-loose.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
def test_parser_ssl_letsencrypt(): def test_parser_ssl_letsencrypt():
line_list = load_fixture("services-letsencrypt") line_list = load_fixture("services-letsencrypt")
@ -409,8 +409,8 @@ def test_parser_ssl_letsencrypt():
"stats": { "stats": {
"password": "password" "password": "password"
}, },
"letsencrypt": { "certbot": {
"email": LETSENCRYPT_EMAIL "email": CERTBOT_EMAIL
} }
} }
@ -421,7 +421,7 @@ def test_parser_ssl_letsencrypt():
path = os.path.dirname(os.path.realpath(__file__)) path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/services-letsencrypt.txt", 'r') as expected_file: with open(path + "/expected/services-letsencrypt.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config assert expected_file.read() == haproxy_config
assert ["test.example.org"] == cfg.letsencrypt_hosts assert ["test.example.org"] == cfg.certbot_hosts
def test_parser_finds_services_clone_to_ssl_raw(): def test_parser_finds_services_clone_to_ssl_raw():
@ -429,8 +429,8 @@ def test_parser_finds_services_clone_to_ssl_raw():
result = { result = {
"customerrors": False, "customerrors": False,
"letsencrypt": { "certbot": {
"email": LETSENCRYPT_EMAIL "email": CERTBOT_EMAIL
}, },
"stats": { "stats": {
"port": 0 "port": 0
@ -450,21 +450,21 @@ def test_parser_finds_services_clone_to_ssl_raw():
"containers":[ "containers":[
"10.152.183.215:8080" "10.152.183.215:8080"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
}, },
"valida.me":{ "valida.me":{
"containers":[ "containers":[
"10.152.183.62:8080" "10.152.183.62:8080"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
}, },
"www.valida.me":{ "www.valida.me":{
"containers":[ "containers":[
"10.152.183.62:8080" "10.152.183.62:8080"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
} }
}, },
@ -481,7 +481,7 @@ def test_parser_finds_services_clone_to_ssl_raw():
"containers":[ "containers":[
"10.152.183.215:8080" "10.152.183.215:8080"
], ],
"letsencrypt": False, "certbot": False,
"redirect_ssl": False "redirect_ssl": False
} }
}, },
@ -496,12 +496,12 @@ def test_parser_finds_services_clone_to_ssl_raw():
processed = list(cfg.parse(line_list)) processed = list(cfg.parse(line_list))
assert parsed_object == processed assert parsed_object == processed
assert [] == cfg.letsencrypt_hosts assert [] == cfg.certbot_hosts
#test_parser_finds_services_raw() #test_parser_finds_services_raw()
#test_parser_tcp() #test_parser_tcp()
#test_parser_multiple_hosts() #test_parser_multiple_hosts()
#test_parser_ssl_letsencrypt() #test_parser_ssl_certbot()
#test_parser_finds_services() #test_parser_finds_services()

6
src/tests/test_static.py
View file

@ -15,7 +15,7 @@ def test_processor_static():
"containers":[ "containers":[
"container:5000" "container:5000"
], ],
"letsencrypt": True "certbot": True
}, },
"host2.com.br":{ "host2.com.br":{
"containers":[ "containers":[
@ -57,7 +57,7 @@ def test_processor_static():
'host3.com.br:8080' 'host3.com.br:8080'
] ]
assert static.get_letsencrypt_hosts() is None assert static.get_certbot_hosts() is None
assert static.get_parsed_object() == parsed_object assert static.get_parsed_object() == parsed_object
assert static.get_hosts() == hosts assert static.get_hosts() == hosts
@ -66,7 +66,7 @@ def test_processor_static():
assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/static.txt")) assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/static.txt"))
# @todo: Static doesnt populate this fields # @todo: Static doesnt populate this fields
assert static.get_letsencrypt_hosts() == [] assert static.get_certbot_hosts() == []
assert static.get_parsed_object() == parsed_object assert static.get_parsed_object() == parsed_object
assert static.get_hosts() == hosts assert static.get_hosts() == hosts