badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Merge pull request #45 from byjg/issue/38

Browse source 
Issue #38 Add HTTPS Support for SSL
This commit is contained in:
Joao M 2023-07-03 13:37:38 -05:00 • committed by GitHub
commit 78ea9b6810
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 147 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/easymapping/__init__.py
View file

@ -56,7 +56,7 @@ class HaproxyConfigGenerator:
self.serving_hosts = []
self.certs = {}
def generate(self, container_metadata = {}):
def generate(self, container_metadata={}):
self.mapping.setdefault("easymapping", [])
if container_metadata != {}:

8
src/processor/__init__.py
View file

@ -31,7 +31,13 @@ class ContainerEnv:
"email": os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"),
"server": os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "false").lower() in ["true", "1", "yes"]
}
env_vars["logLevel"] = {
"easyhaproxy": os.getenv("EASYHAPROXY_LOG_LEVEL") if os.getenv("EASYHAPROXY_LOG_LEVEL") else Functions.DEBUG,
"haproxy": os.getenv("HAPROXY_LOG_LEVEL") if os.getenv("HAPROXY_LOG_LEVEL") else Functions.INFO,
"certbot": os.getenv("CERTBOT_LOG_LEVEL") if os.getenv("CERTBOT_LOG_LEVEL") else Functions.DEBUG,
}
return env_vars

2
src/templates/bind.j2
View file

@ -1,5 +1,5 @@
{% if "ssl" in o %}
bind *:{{ o["port"] }} ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
bind *:{{ o["port"] }} ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
{% elif "h2" in o and o["h2"] %}
bind *:{{ o["port"] }} proto h2
option http-use-htx

15
src/templates/haproxy.cfg.j2
View file

@ -1,5 +1,18 @@
{% set log_definition = data["logLevel"] | default({}) %}
{% set log_level = log_definition["haproxy"] | default("INFO") | upper %}
{% if log_level == "TRACE" or log_level == "DEBUG" %}
{% set haproxy_log_level = "debug" %}
{% elif log_level == "INFO" %}
{% set haproxy_log_level = "info" %}
{% elif log_level == "WARN" %}
{% set haproxy_log_level = "warning" %}
{% elif log_level == "ERROR" %}
{% set haproxy_log_level = "err" %}
{% elif log_level == "FATAL" %}
{% set haproxy_log_level = "crit" %}
{% endif %}
global
log stdout format raw local0 info
log stdout format raw local0 {{ haproxy_log_level }}
maxconn 2000
{% if data["ssl_mode"] == "strict" %}
{% include "ssl_strict.j2" %}

2
src/tests/expected/docker.txt
View file

@ -36,7 +36,7 @@ backend srv_stats
server Local 127.0.0.1:1936
frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local

2
src/tests/expected/services-letsencrypt.txt
View file

@ -74,7 +74,7 @@ backend srv_test2_example_org_80
server srv-0 83d57d592e26:8080 check weight 1
frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org

2
src/tests/expected/services-redirect-ssl.txt
View file

@ -49,7 +49,7 @@ backend srv_host1_local_80
server srv-0 5b69bc7fea1b:80 check weight 1
frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_host2_local_443_1 hdr(host) -i host2.local

2
src/tests/expected/services.txt
View file

@ -67,7 +67,7 @@ backend srv_node-exporter_quantum_example_org_31337
server srv-0 my-stack_node-exporter:9100 check weight 1
frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }

2
src/tests/expected/static.txt
View file

@ -74,7 +74,7 @@ backend srv_host2_com_br_80
server srv-0 other:3000 check weight 1
frontend http_in_443
bind *:443 ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
bind *:443 ssl crt /certs/letsencrypt/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
mode http
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br

79
src/tests/test_containerenv.py
View file

@ -1,12 +1,20 @@
import pytest
import os
from functions import Functions
from processor import ContainerEnv
def test_container_env_empty():
assert {
"customerrors": False,
"ssl_mode": "default",
"lookup_label": "easyhaproxy"
"lookup_label": "easyhaproxy",
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
# os.environ['CERTBOT_LOG_LEVEL'] = 'warn'
@ -17,7 +25,12 @@ def test_container_env_customerrors():
assert {
"customerrors": True,
"ssl_mode": "default",
"lookup_label": "easyhaproxy"
"lookup_label": "easyhaproxy",
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['HAPROXY_CUSTOMERRORS'] = ''
@ -28,7 +41,12 @@ def test_container_env_sslmode():
assert {
"customerrors": False,
"ssl_mode": "strict",
"lookup_label": "easyhaproxy"
"lookup_label": "easyhaproxy",
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['EASYHAPROXY_SSL_MODE'] = ''
@ -41,6 +59,11 @@ def test_container_env_stats():
"customerrors": False,
"ssl_mode": "default",
"lookup_label": "easyhaproxy",
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['HAPROXY_USERNAME'] = ''
@ -58,7 +81,12 @@ def test_container_env_stats_password():
"password": "xyz",
"port": "1936"
}
},
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['HAPROXY_PASSWORD'] = ''
@ -78,7 +106,12 @@ def test_container_env_stats_password():
"password": "xyz",
"port": "2101"
}
},
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['HAPROXY_USERNAME'] = ''
@ -96,7 +129,12 @@ def test_container_env_stats_password():
"letsencrypt": {
"email": "acme@example.org",
"server": False
}
},
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = ''
@ -112,7 +150,32 @@ def test_container_env_letsencrypt():
"letsencrypt": {
"email": "acme@example.org",
"server": True
}
},
"logLevel": {
"easyhaproxy": Functions.DEBUG,
"haproxy": Functions.INFO,
"certbot": Functions.DEBUG,
},
} == ContainerEnv.read()
finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = ''
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = ''
def test_container_log_level():
os.environ['CERTBOT_LOG_LEVEL'] = Functions.TRACE
os.environ['EASYHAPROXY_LOG_LEVEL'] = Functions.ERROR
os.environ['HAPROXY_LOG_LEVEL'] = Functions.FATAL
try:
assert {
"customerrors": False,
"ssl_mode": "default",
"lookup_label": "easyhaproxy",
"logLevel": {
"easyhaproxy": Functions.ERROR,
"haproxy": Functions.FATAL,
"certbot": Functions.TRACE,
},
} == ContainerEnv.read()
finally:
os.environ['CERTBOT_LOG_LEVEL'] = ''
os.environ['EASYHAPROXY_LOG_LEVEL'] = ''
os.environ['HAPROXY_LOG_LEVEL'] = ''