Merge pull request #23 from byjg/multiple-hosts

Multiple Hosts

README.md

@@ -42,11 +42,11 @@ The environment variables will setup the HAProxy.
 |-------------------------------|-------------------------------------------------------------------------------|
 | EASYHAPROXY_DISCOVER          | How `haproxy.cfg` will be created: `static`, `docker` or `swarm`              |
 | EASYHAPROXY_LABEL_PREFIX      | (Optional) The key will search to match resources. Default: `easyhaproxy`.    |
-[ EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request certificate to letsencrypt       |      
+| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request certificate to letsencrypt       |      
 | HAPROXY_USERNAME              | (Optional) The HAProxy username to the statistics. Default: `admin`           |
 | HAPROXY_PASSWORD              | The HAProxy password to the statistics. If not set disable stats.             |
 | HAPROXY_STATS_PORT            | (Optional) The HAProxy port to the statistics. Default: `1936`                |
-| HAPROXY_CUSTOMERRORS.         | (Optional) If HAProxy will use custom HTML errors. true/false. Default: false |
+| HAPROXY_CUSTOMERRORS          | (Optional) If HAProxy will use custom HTML errors. true/false. Default: false |
 
 The environment variable `EASYHAPROXY_DISCOVER` will define where is located your containers (see below more details):
 
@@ -89,14 +89,14 @@ Important: easyhaproxy needs to be in the same network of the containers or othe
 
 | Tag                                   | Description                                                                                             | Example      |
 |---------------------------------------|---------------------------------------------------------------------------------------------------------|--------------|
-| easyhaproxy.[definition].host         | Host HAProxy is listening                                                                               | somehost.com |
+| easyhaproxy.[definition].host         | Host(s) HAProxy is listening. More than one host use comma as delimiter                                 | somehost.com OR host1.com,host2.com |
 | easyhaproxy.[definition].mode         | (Optional) Is this `http` or `tcp` mode in HAProxy. (Defaults to http)                                  | http         |
 | easyhaproxy.[definition].port         | (Optional) Port HAProxy will listen for the host. (Defaults to 80)                                      | 80           |
 | easyhaproxy.[definition].localport    | (Optional) Port container is listening. (Defaults to 80)                                                | 8080         |
 | easyhaproxy.[definition].redirect     | (Optional) JSON containing key/value pair from host/to url redirect.                                    | {"foo.com":"https://bla.com", "bar.com":"https://bar.org"} |
 | easyhaproxy.[definition].sslcert      | (Optional) Cert PEM Base64 encoded. Do not use this if letsencrypt is enabled.                          |              |
 | easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` (Defaults to "empty")                       |              |
-| easyhaproxy.[definition].letsencrypt  | (Optional) Generate certificate with letsencrypt. Do not use with sslcert                               | true, yes    |
+| easyhaproxy.[definition].letsencrypt  | (Optional) Generate certificate with letsencrypt. Do not use with sslcert                               | true OR yes OR false OR no    |
 
 ### Defining the labels in Docker Swarm
 
@@ -153,7 +153,7 @@ docker run \
 
 ```bash
 docker run \
-    -l easyhaproxy.[definition].redirect=www.byjg.com.br--http://byjg.com.br,byjg.com--http://byjg.com.br
+    -l easyhaproxy.[definition].redirect='{"www.byjg.com.br":"http://byjg.com.br","byjg.com":"http://byjg.com.br"}'
 ```
 
 ## EASYHAPROXY_DISCOVER: static
@@ -230,10 +230,29 @@ docker run \
 Caveats:
 
 - Your container **must** listen to the port 80. Besides no error, the certificate won't be issued if in a different port.
-- The port 2080 is reserved for the certbot
+- The port 2080 is reserved for the certbot and should not be exposed.
 - You cannot set the port 443 for the container with the Letsencrypt. EasyHAProxy will handle this automatically once the certificate is issued. 
 - If you don't run the EasyHAProxy with the parameter `EASYHAPROXY_LETSENCRYPT_EMAIL` no certificate will be issued. 
+- Be aware about the issue limits - https://letsencrypt.org/docs/rate-limits/
 
+## Exposing Ports
+
+- You need to expose at least the ports `80` and `443` when you run the `byjg/easy-haproxy` image. 
+- If you enable the HAProxy statistics you must also expose the port defined in `HAPROXY_STATS_PORT` environment variable. 
+- Every port defined in `easyhaproxy.[definitions].port` also should be enabel. 
+
+e.g.
+
+```bash
+docker run \
+    /* other parameters */
+    -p 80:80 \
+    -p 443:443 \
+    -p 1936:1936 \
+    -d byjg/easy-haproxy
+```
+
+Also, you need to expose these ports in the firewall. 
 
 ## Mapping custom .cfg files
 

assets/scripts/swarm.py

@@ -2,7 +2,7 @@ import os
 from easymapping import HaproxyConfigGenerator
 
 with open("/tmp/.docker_data", 'r') as content_file:
-    lineList = content_file.readlines()
+    line_list = content_file.readlines()
 
 result = {
     "customerrors": True if os.getenv("HAPROXY_CUSTOMERRORS") == "true" else False
@@ -18,7 +18,7 @@ if os.getenv("HAPROXY_PASSWORD"):
 result["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv("EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy"
 
 cfg = HaproxyConfigGenerator(result)
-print(cfg.generate(lineList))
+print(cfg.generate(line_list))
 
 path = os.path.dirname(os.path.realpath(__file__))
 with open(path + "/letsencrypt_hosts.txt", 'w') as fp:

easymapping/__init__.py

@@ -114,7 +114,6 @@ class HaproxyConfigGenerator:
                     self.label.create([definition, "letsencrypt"]),
                     False
                 ) and self.letsencrypt_email != "" 
-                self.letsencrypt_hosts.append(d[host_label]) if letsencrypt and d[host_label] not in self.letsencrypt_hosts else self.letsencrypt_hosts
 
                 if port not in easymapping:
                     easymapping[port] = {
@@ -136,41 +135,42 @@ class HaproxyConfigGenerator:
                     ""
                 )
 
-                easymapping[port]["hosts"].setdefault(d[host_label], {})
+                for hostname in d[host_label].split(","):
-                easymapping[port]["hosts"][d[host_label]].setdefault("containers", [])
+                    hostname = hostname.strip()
-                easymapping[port]["hosts"][d[host_label]].setdefault("letsencrypt", False)
+                    easymapping[port]["hosts"].setdefault(hostname, {})
-                easymapping[port]["hosts"][d[host_label]]["containers"] += ["{}:{}".format(container, ct_port)]
+                    easymapping[port]["hosts"][hostname].setdefault("containers", [])
-                easymapping[port]["hosts"][d[host_label]]["letsencrypt"] = letsencrypt
+                    easymapping[port]["hosts"][hostname].setdefault("letsencrypt", False)
-
+                    easymapping[port]["hosts"][hostname]["containers"] += ["{}:{}".format(container, ct_port)]
-                if letsencrypt:
+                    easymapping[port]["hosts"][hostname]["letsencrypt"] = letsencrypt
-                    if "443" not in easymapping:
+                    easymapping[port]["redirect"] = self.label.get_json(
-                        easymapping["443"] = {
+                        self.label.create([definition, "redirect"])
-                            "mode": "http",
-                            "health-check": "ssl",
-                            "port": "443",
-                            "hosts": dict(),
-                            "redirect": dict(),
-                        }
-                    easymapping["443"]["hosts"][d[host_label]] = dict(easymapping[port]["hosts"][d[host_label]])
-                    easymapping["443"]["hosts"][d[host_label]]["letsencrypt"] = False
-                    easymapping["443"]["ssl_cert"] = "/etc/haproxy/certs"
-                    
-
-                # handle SSL
-                ssl_label = self.label.create([definition, "sslcert"])
-                if self.label.has_label(ssl_label):
-                    filename = "{}/{}.pem".format(
-                        self.ssl_cert_folder, d[host_label]
                     )
-                    easymapping[port]["ssl_cert"] = filename
-                    with open(filename, 'wb') as file:
-                        file.write(
-                            base64.b64decode(d[ssl_label])
-                        )
 
-                # handle redirects
+                    if letsencrypt:
-                easymapping[port]["redirect"] = self.label.get_json(
+                        if "443" not in easymapping:
-                    self.label.create([definition, "redirect"])
+                            easymapping["443"] = {
-                )
+                                "mode": "http",
+                                "health-check": "ssl",
+                                "port": "443",
+                                "hosts": dict(),
+                                "redirect": dict(),
+                            }
+                        easymapping["443"]["hosts"][hostname] = dict(easymapping[port]["hosts"][hostname])
+                        easymapping["443"]["hosts"][hostname]["letsencrypt"] = False
+                        easymapping["443"]["ssl_cert"] = "/etc/haproxy/certs"
+                        self.letsencrypt_hosts.append(hostname) if hostname not in self.letsencrypt_hosts else self.letsencrypt_hosts
+                        
+
+                    # handle SSL
+                    ssl_label = self.label.create([definition, "sslcert"])
+                    if self.label.has_label(ssl_label):
+                        filename = "{}/{}.pem".format(
+                            self.ssl_cert_folder, d[host_label]
+                        )
+                        easymapping[port]["ssl_cert"] = filename
+                        with open(filename, 'wb') as file:
+                            file.write(
+                                base64.b64decode(d[ssl_label])
+                            )
 
         return easymapping.values()

tests/expected/services-multiple-hosts.txt

@@ -0,0 +1,80 @@
+global
+    log stdout  format raw  local0  info
+    maxconn 2000
+    tune.ssl.default-dh-param 2048
+
+    # intermediate configuration
+    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+
+    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+    ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+
+    ssl-dh-param-file /etc/haproxy/dhparam
+
+defaults
+    log global
+
+    timeout connect    3s
+    timeout client    10s
+    timeout server    10m
+    errorfile 400 /etc/haproxy/errors-custom/400.http
+    errorfile 403 /etc/haproxy/errors-custom/403.http
+    errorfile 408 /etc/haproxy/errors-custom/408.http
+    errorfile 500 /etc/haproxy/errors-custom/500.http
+    errorfile 502 /etc/haproxy/errors-custom/502.http
+    errorfile 503 /etc/haproxy/errors-custom/503.http
+    errorfile 504 /etc/haproxy/errors-custom/504.http
+
+frontend stats
+    bind *:1937
+    mode http
+    stats enable
+    stats hide-version
+    stats realm Haproxy\ Statistics
+    stats uri /
+    stats auth joe:s3cr3t
+#    acl is_proxystats hdr(host) -i some.host.com
+#    default_backend srv_stats
+#    use_backend srv_stats if is_proxystats
+    default_backend srv_stats
+
+backend srv_stats
+    mode http
+    server Local 127.0.0.1:1937
+
+frontend http_in_19901
+    bind *:19901
+    mode http
+    redirect prefix www.google.com code 301 if { hdr(host) -i google.helloworld.com }
+
+    acl is_rule_hello_com_19901_1 hdr(host) -i hello.com
+    acl is_rule_hello_com_19901_2 hdr(host) -i hello.com:19901
+    use_backend srv_hello_com_19901 if is_rule_hello_com_19901_1 OR is_rule_hello_com_19901_2
+
+    acl is_rule_www_helloworld_com_19901_1 hdr(host) -i www.helloworld.com
+    acl is_rule_www_helloworld_com_19901_2 hdr(host) -i www.helloworld.com:19901
+    use_backend srv_www_helloworld_com_19901 if is_rule_www_helloworld_com_19901_1 OR is_rule_www_helloworld_com_19901_2
+
+backend srv_hello_com_19901
+    balance roundrobin
+    mode http
+    option forwardfor
+    http-request set-header X-Forwarded-Port %[dst_port]
+    http-request add-header X-Forwarded-Proto https if { ssl_fc }
+    server srv-0 3e63154954b0:80 check weight 1
+    server srv-1 eb294c110eb1:80 check weight 1
+backend srv_www_helloworld_com_19901
+    balance roundrobin
+    mode http
+    option forwardfor
+    http-request set-header X-Forwarded-Port %[dst_port]
+    http-request add-header X-Forwarded-Proto https if { ssl_fc }
+    server srv-0 3e63154954b0:80 check weight 1
+    server srv-1 eb294c110eb1:80 check weight 1
+
+backend letsencrypt_backend
+    mode http
+    server certbot 127.0.0.1:2080

tests/fixtures/services-multiple-hosts

@@ -0,0 +1,3 @@
+db79d3a910f4={"com.docker.compose.config-hash":"5bde40f52451521ad201e70de1291397376a0498a7c955624a609da3b60e7e8e","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:ea39067705590557dd0cd951664a10970ceefcb725a3c1f43690d6d6d4ed5fce","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"haproxy","com.docker.compose.version":"2.8.0"}
+3e63154954b0={"com.docker.compose.config-hash":"4e0cbdd8372c6779863799e5021ed8178f74b55bd8e070abcdffaf87eb7baa36","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"hello.com, www.helloworld.com","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"19901","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}"}
+eb294c110eb1={"com.docker.compose.config-hash":"4e0cbdd8372c6779863799e5021ed8178f74b55bd8e070abcdffaf87eb7baa36","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"hello.com, www.helloworld.com","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"19901","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}"}

tests/test_parser.py

@@ -295,5 +295,28 @@ def test_parser_multi_containers():
     assert [] == cfg.letsencrypt_hosts
 
 
+def test_parser_multiple_hosts():
+    line_list = load_fixture("services-multiple-hosts")
+
+    result = {
+        "customerrors": True,
+        "stats": {
+            "username": "joe",
+            "password": "s3cr3t",
+            "port": "1937"
+        }
+    }
+
+    cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER)
+    haproxy_config = cfg.generate(line_list)
+
+    assert len(haproxy_config) > 0
+    path = os.path.dirname(os.path.realpath(__file__))
+    with open(path + "/expected/services-multiple-hosts.txt", 'r') as expected_file:
+        assert expected_file.read() == haproxy_config
+    assert [] == cfg.letsencrypt_hosts
+
+
 #test_parser_finds_services_raw()
 #test_parser_tcp()
+#test_parser_multiple_hosts()