From e6d58420986d859a2dd276a38586a17844a3ffb8 Mon Sep 17 00:00:00 2001 From: Joao M Date: Thu, 18 Aug 2022 04:00:52 +0000 Subject: [PATCH 1/5] Change statistics --- README.md | 20 ++++++------ templates/haproxy.cfg.j2 | 14 ++++---- tests/expected/services-letsencrypt.txt | 3 -- tests/expected/services-multiple-hosts.txt | 3 -- tests/expected/ssl-loose.txt | 12 +++++++ tests/expected/static.txt | 3 -- tests/test_parser.py | 37 ++++++++++++++++++---- 7 files changed, 59 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index e53fdbc..f77d57c 100644 --- a/README.md +++ b/README.md @@ -45,16 +45,16 @@ The mapping to `/var/run/docker.sock` is necessary to discover the docker contai The environment variables will setup the HAProxy. -| Environment Variable | Description | -|-------------------------------|-------------------------------------------------------------------------------| -| EASYHAPROXY_DISCOVER | How `haproxy.cfg` will be created: `static`, `docker` or `swarm` | -| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. Default: `easyhaproxy`. | -| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | +| Environment Variable | Description | +|-------------------------------|---------------------------------------------------------------------------------------------------------------| +| EASYHAPROXY_DISCOVER | How `haproxy.cfg` will be created: `static`, `docker` or `swarm` | +| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. Default: `easyhaproxy`. | +| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | | EASYHAPROXY_SSL_MODE | (Optional) `STRICT` supports only the most recent TLS version; `DEFAULT` good SSL integration with recent browsers; `LOOSE` supports all old SSL protocols for old browsers (not recommended). | -| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. Default: `admin` | -| HAPROXY_PASSWORD | The HAProxy password to the statistics. If not set, it will disable stats. | -| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. Default: `1936` | -| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. Default: false | +| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. Default: `admin` | +| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | +| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. Default: `1936`. If set to `false`, disable statistics | +| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. Default: `false` | The environment variable `EASYHAPROXY_DISCOVER` will define where is located your containers (see below for more details): @@ -258,7 +258,7 @@ Caveats: You must expose some ports on the EasyHAProxy container and in the firewall. However, you don't need to expose the other container ports because EasyHAProxy will handle that. - The ports `80` and `443`. -- If you enable the HAProxy statistics, you must also expose the port defined in `HAPROXY_STATS_PORT` environment variable. +- If you enable the HAProxy statistics, you must also expose the port defined in `HAPROXY_STATS_PORT` environment variable (default 1936). Be aware that statististics are enabled by default with no password. - Every port defined in `easyhaproxy.[definitions].port` also should be exposed. e.g. diff --git a/templates/haproxy.cfg.j2 b/templates/haproxy.cfg.j2 index c47c127..6e183de 100644 --- a/templates/haproxy.cfg.j2 +++ b/templates/haproxy.cfg.j2 @@ -26,23 +26,23 @@ defaults errorfile 504 /etc/haproxy/errors-custom/504.http {% endif %} -{% if "stats" in data %} +{% set data_stats = data["stats"] | default({}) %} +{% if data_stats["port"] | default(1936) | int > 0 %} frontend stats - bind *:{{ data["stats"]["port"] | default(1936) }} + bind *:{{ data_stats["port"] | default(1936) }} mode http stats enable stats hide-version stats realm Haproxy\ Statistics stats uri / - stats auth {{ data["stats"]["username"] }}:{{ data["stats"]["password"] }} -# acl is_proxystats hdr(host) -i some.host.com -# default_backend srv_stats -# use_backend srv_stats if is_proxystats + {% if data_stats["password"] | default("") != "" %} + stats auth {{ data_stats["username"] | default("admin") }}:{{ data_stats["password"] }} + {% endif %} default_backend srv_stats backend srv_stats mode http - server Local 127.0.0.1:{{ data["stats"]["port"] | default(1936) }} + server Local 127.0.0.1:{{ data_stats["port"] | default(1936) }} {% endif %} {% for o in data["easymapping"] -%} {% set mode = o["mode"] or "http" %} diff --git a/tests/expected/services-letsencrypt.txt b/tests/expected/services-letsencrypt.txt index 7dc6abc..809b8a6 100644 --- a/tests/expected/services-letsencrypt.txt +++ b/tests/expected/services-letsencrypt.txt @@ -36,9 +36,6 @@ frontend stats stats realm Haproxy\ Statistics stats uri / stats auth admin:password -# acl is_proxystats hdr(host) -i some.host.com -# default_backend srv_stats -# use_backend srv_stats if is_proxystats default_backend srv_stats backend srv_stats diff --git a/tests/expected/services-multiple-hosts.txt b/tests/expected/services-multiple-hosts.txt index 4459421..5da3bed 100644 --- a/tests/expected/services-multiple-hosts.txt +++ b/tests/expected/services-multiple-hosts.txt @@ -36,9 +36,6 @@ frontend stats stats realm Haproxy\ Statistics stats uri / stats auth joe:s3cr3t -# acl is_proxystats hdr(host) -i some.host.com -# default_backend srv_stats -# use_backend srv_stats if is_proxystats default_backend srv_stats backend srv_stats diff --git a/tests/expected/ssl-loose.txt b/tests/expected/ssl-loose.txt index 6236f95..b03571e 100644 --- a/tests/expected/ssl-loose.txt +++ b/tests/expected/ssl-loose.txt @@ -19,6 +19,18 @@ defaults timeout client 10s timeout server 10m +frontend stats + bind *:1936 + mode http + stats enable + stats hide-version + stats realm Haproxy\ Statistics + stats uri / + default_backend srv_stats + +backend srv_stats + mode http + server Local 127.0.0.1:1936 backend letsencrypt_backend mode http diff --git a/tests/expected/static.txt b/tests/expected/static.txt index ad76627..1656236 100644 --- a/tests/expected/static.txt +++ b/tests/expected/static.txt @@ -36,9 +36,6 @@ frontend stats stats realm Haproxy\ Statistics stats uri / stats auth admin:test123 -# acl is_proxystats hdr(host) -i some.host.com -# default_backend srv_stats -# use_backend srv_stats if is_proxystats default_backend srv_stats backend srv_stats diff --git a/tests/test_parser.py b/tests/test_parser.py index 83028ba..81b4dfc 100644 --- a/tests/test_parser.py +++ b/tests/test_parser.py @@ -19,7 +19,10 @@ def test_parser_doesnt_crash(): line_list = load_fixture("no-services") result = { - "customerrors": False + "customerrors": False, + "stats": { + "port": "false" + } } cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER) @@ -38,6 +41,9 @@ def test_parser_finds_services(): "customerrors": False, "letsencrypt": { "email": LETSENCRYPT_EMAIL + }, + "stats": { + "port": 0 } } @@ -65,6 +71,9 @@ def test_parser_finds_services_changed_label(): "lookup_label": "haproxy", "letsencrypt": { "email": LETSENCRYPT_EMAIL + }, + "stats": { + "port": 0 } } @@ -91,6 +100,9 @@ def test_parser_finds_services_raw(): "customerrors": False, "letsencrypt": { "email": LETSENCRYPT_EMAIL + }, + "stats": { + "port": 0 } } @@ -277,7 +289,10 @@ def test_parser_tcp(): line_list = load_fixture("services-tcp") result = { - "customerrors": False + "customerrors": False, + "stats": { + "port": 0 + } } cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER) @@ -294,7 +309,10 @@ def test_parser_multi_containers(): line_list = load_fixture("services-multi-containers") result = { - "customerrors": False + "customerrors": False, + "stats": { + "port": 0 + } } cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER) @@ -334,7 +352,10 @@ def test_parser_redirect_ssl(): result = { "customerrors": False, - "ssl_mode": "loose" + "ssl_mode": "loose", + "stats": { + "port": 0 + } } cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER) @@ -352,7 +373,10 @@ def test_parser_ssl_strict(): result = { "customerrors": False, - "ssl_mode": "strict" + "ssl_mode": "strict", + "stats": { + "port": False + } } cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER) @@ -369,7 +393,7 @@ def test_parser_ssl_loose(): result = { "customerrors": False, - "ssl_mode": "loose" + "ssl_mode": "loose", } cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER) @@ -387,7 +411,6 @@ def test_parser_ssl_letsencrypt(): result = { "customerrors": True, "stats": { - "username": "admin", "password": "password" }, "letsencrypt": { From fad161596887a53d4ef077288e068ada0528b3ed Mon Sep 17 00:00:00 2001 From: Joao Magalhaes Date: Thu, 18 Aug 2022 15:17:12 +0000 Subject: [PATCH 2/5] Small adjusts on start HAProxy --- assets/scripts/haproxy-reload.sh | 7 +++---- templates/haproxy.cfg.j2 | 3 ++- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/assets/scripts/haproxy-reload.sh b/assets/scripts/haproxy-reload.sh index 6943425..5a3980f 100755 --- a/assets/scripts/haproxy-reload.sh +++ b/assets/scripts/haproxy-reload.sh @@ -57,11 +57,10 @@ if [ -f /tmp/force-reload ]; then fi if [[ ! -z "$1" ]]; then - echo "[CONF_CHECK] Start haproxy" - /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock -fi + echo "[CONF_CHECK] Starting haproxy..." + /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg $(ls /etc/haproxy/conf.d/*.cfg 2>/dev/null | xargs -I{} echo -f {}) -p /run/haproxy.pid -S /var/run/haproxy.sock & -if [[ "$RELOAD" == "true" ]]; then +elif [[ "$RELOAD" == "true" ]]; then echo "[CONF_CHECK] Reloading..." /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg $(ls /etc/haproxy/conf.d/*.cfg 2>/dev/null | xargs -I{} echo -f {}) -p /run/haproxy.pid -x /var/run/haproxy.sock -sf $(cat /run/haproxy.pid) & fi diff --git a/templates/haproxy.cfg.j2 b/templates/haproxy.cfg.j2 index 6e183de..eda4b8a 100644 --- a/templates/haproxy.cfg.j2 +++ b/templates/haproxy.cfg.j2 @@ -12,6 +12,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s @@ -76,4 +77,4 @@ backend srv_{{ host }} backend letsencrypt_backend mode http - server certbot 127.0.0.1:2080 \ No newline at end of file + server certbot 127.0.0.1:2080 From 2e2640c8595ca4876815bdc0564b90aa68734313 Mon Sep 17 00:00:00 2001 From: Joao M Date: Thu, 18 Aug 2022 15:24:55 +0000 Subject: [PATCH 3/5] Fix tests --- tests/expected/no-services.txt | 1 + tests/expected/services-letsencrypt.txt | 1 + tests/expected/services-multi-containers.txt | 1 + tests/expected/services-multiple-hosts.txt | 1 + tests/expected/services-redirect-ssl.txt | 1 + tests/expected/services-tcp.txt | 1 + tests/expected/services.txt | 1 + tests/expected/ssl-loose.txt | 1 + tests/expected/ssl-strict.txt | 1 + tests/expected/static.txt | 1 + 10 files changed, 10 insertions(+) diff --git a/tests/expected/no-services.txt b/tests/expected/no-services.txt index 3a3d948..428cbca 100644 --- a/tests/expected/no-services.txt +++ b/tests/expected/no-services.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/services-letsencrypt.txt b/tests/expected/services-letsencrypt.txt index 809b8a6..e0093d1 100644 --- a/tests/expected/services-letsencrypt.txt +++ b/tests/expected/services-letsencrypt.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/services-multi-containers.txt b/tests/expected/services-multi-containers.txt index d47459e..00e9196 100644 --- a/tests/expected/services-multi-containers.txt +++ b/tests/expected/services-multi-containers.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/services-multiple-hosts.txt b/tests/expected/services-multiple-hosts.txt index 5da3bed..cc9c39e 100644 --- a/tests/expected/services-multiple-hosts.txt +++ b/tests/expected/services-multiple-hosts.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/services-redirect-ssl.txt b/tests/expected/services-redirect-ssl.txt index ffbf1e6..d0dbb07 100644 --- a/tests/expected/services-redirect-ssl.txt +++ b/tests/expected/services-redirect-ssl.txt @@ -14,6 +14,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/services-tcp.txt b/tests/expected/services-tcp.txt index 5804dac..6df1a26 100644 --- a/tests/expected/services-tcp.txt +++ b/tests/expected/services-tcp.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/services.txt b/tests/expected/services.txt index 8e4d03f..43765e6 100644 --- a/tests/expected/services.txt +++ b/tests/expected/services.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/ssl-loose.txt b/tests/expected/ssl-loose.txt index b03571e..674c9c6 100644 --- a/tests/expected/ssl-loose.txt +++ b/tests/expected/ssl-loose.txt @@ -14,6 +14,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/ssl-strict.txt b/tests/expected/ssl-strict.txt index 7a43dc3..815fd2f 100644 --- a/tests/expected/ssl-strict.txt +++ b/tests/expected/ssl-strict.txt @@ -11,6 +11,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s diff --git a/tests/expected/static.txt b/tests/expected/static.txt index 1656236..f3cd653 100644 --- a/tests/expected/static.txt +++ b/tests/expected/static.txt @@ -16,6 +16,7 @@ global defaults log global + option httplog timeout connect 3s timeout client 10s From 78e9ae3d089c3450cd01e673cb6491bb43365dfa Mon Sep 17 00:00:00 2001 From: Joao M Date: Thu, 18 Aug 2022 17:37:37 +0000 Subject: [PATCH 4/5] Documentation Update --- README.md | 27 ++++++++++++++++++++++++++ tests/fixtures/services-multiple-hosts | 4 ++-- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f77d57c..e1f33bf 100644 --- a/README.md +++ b/README.md @@ -146,6 +146,33 @@ docker run \ some/myimage ``` +### Multiples hosts on the same container + +```bash +docker run \ + -l easyhaproxy.express.port=80 \ + -l easyhaproxy.express.localport=3000 \ + -l easyhaproxy.express.host=express.byjg.com.br,admin.byjg.com.br \ + .... \ + some/myimage +``` + +If you are using docker-compose you can use this way: + +```yaml +version: "3" + +services: + mycontainer: + image: some/myimage + labels: + easyhaproxy.express.port: 80 + easyhaproxy.express.localport: 3000 + easyhaproxy.express.host: >- + express.byjg.com.br, + admin.byjg.com.br +``` + ### TLS passthrough Used to pass on SSL termination to a backend. Alternatively, you can enable health-check via SSL on the backend with the optional `health-check` label: diff --git a/tests/fixtures/services-multiple-hosts b/tests/fixtures/services-multiple-hosts index 44bfc19..c04b29a 100644 --- a/tests/fixtures/services-multiple-hosts +++ b/tests/fixtures/services-multiple-hosts @@ -1,3 +1,3 @@ db79d3a910f4={"com.docker.compose.config-hash":"5bde40f52451521ad201e70de1291397376a0498a7c955624a609da3b60e7e8e","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:ea39067705590557dd0cd951664a10970ceefcb725a3c1f43690d6d6d4ed5fce","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"haproxy","com.docker.compose.version":"2.8.0"} -3e63154954b0={"com.docker.compose.config-hash":"4e0cbdd8372c6779863799e5021ed8178f74b55bd8e070abcdffaf87eb7baa36","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"hello.com, www.helloworld.com","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"19901","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}"} -eb294c110eb1={"com.docker.compose.config-hash":"4e0cbdd8372c6779863799e5021ed8178f74b55bd8e070abcdffaf87eb7baa36","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"hello.com, www.helloworld.com","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"19901","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}"} \ No newline at end of file +3e63154954b0={"com.docker.compose.config-hash":"4e0cbdd8372c6779863799e5021ed8178f74b55bd8e070abcdffaf87eb7baa36","com.docker.compose.container-number":"1","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"hello.com\n, www.helloworld.com\n","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"19901","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}"} +eb294c110eb1={"com.docker.compose.config-hash":"4e0cbdd8372c6779863799e5021ed8178f74b55bd8e070abcdffaf87eb7baa36","com.docker.compose.container-number":"2","com.docker.compose.depends_on":"","com.docker.compose.image":"sha256:bea3509d6fdc8d7f9ec95563a5a226dc977ee74fb3e980e0de70e892c2d38dde","com.docker.compose.oneoff":"False","com.docker.compose.project":"docker","com.docker.compose.project.config_files":"/workspace/docker-easy-haproxy/examples/docker/docker-compose-multi-containers.yml","com.docker.compose.project.working_dir":"/workspace/docker-easy-haproxy/examples/docker","com.docker.compose.service":"nginx","com.docker.compose.version":"2.8.0","easyhaproxy.http.host":"hello.com\n, www.helloworld.com\n","easyhaproxy.http.localport":"80","easyhaproxy.http.port":"19901","easyhaproxy.http.redirect":"{\"google.helloworld.com\": \"www.google.com\"}"} \ No newline at end of file From 71119268f21c738a6a4e9d9d7acafee598913f25 Mon Sep 17 00:00:00 2001 From: Joao M Date: Thu, 18 Aug 2022 18:49:07 +0000 Subject: [PATCH 5/5] Kill supervisord --- .gitpod.yml | 3 -- Dockerfile | 4 +-- README.md | 3 +- assets/etc/crontabs/root | 9 ------ assets/etc/supervisord.conf | 45 --------------------------- assets/scripts/certbot.sh | 6 ++-- assets/scripts/exit-event-listener.py | 23 -------------- assets/scripts/haproxy-reload.sh | 10 +++--- assets/scripts/haproxy.sh | 14 +++++++-- 9 files changed, 24 insertions(+), 93 deletions(-) delete mode 100644 assets/etc/crontabs/root delete mode 100644 assets/etc/supervisord.conf delete mode 100755 assets/scripts/exit-event-listener.py diff --git a/.gitpod.yml b/.gitpod.yml index 130cfe5..2b37d88 100644 --- a/.gitpod.yml +++ b/.gitpod.yml @@ -3,9 +3,6 @@ # and commit this file to your remote git repository to share the goodness with others. tasks: - - init: - make - - command: | virtualenv -p /usr/bin/python3 venv source venv/bin/activate diff --git a/Dockerfile b/Dockerfile index 95acd84..ef19a6f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,7 +8,7 @@ COPY easymapping /scripts/easymapping/ COPY tests/ /scripts/tests/ COPY assets / -RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml supervisor docker certbot openssl \ +RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml docker certbot openssl \ && ln -s /usr/bin/python3 /usr/bin/python \ && pip3 install --upgrade pip \ && pip install -r requirements.txt \ @@ -16,4 +16,4 @@ RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml supervisor docker ce && openssl dhparam -out /etc/haproxy/dhparam 2048 \ && openssl dhparam -out /etc/haproxy/dhparam-1024 1024 -CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf" ] +CMD ["/bin/bash", "-c", "/scripts/haproxy.sh" ] diff --git a/README.md b/README.md index e1f33bf..7320e43 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,8 @@ The environment variables will setup the HAProxy. | EASYHAPROXY_DISCOVER | How `haproxy.cfg` will be created: `static`, `docker` or `swarm` | | EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. Default: `easyhaproxy`. | | EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | -| EASYHAPROXY_SSL_MODE | (Optional) `STRICT` supports only the most recent TLS version; `DEFAULT` good SSL integration with recent browsers; `LOOSE` supports all old SSL protocols for old browsers (not recommended). | +| EASYHAPROXY_SSL_MODE | (Optional) `STRICT` supports only the most recent TLS version; `DEFAULT` good SSL integration with recent browsers; `LOOSE` supports all old SSL protocols for old browsers (not recommended). | +| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. Default: 10 | | HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. Default: `admin` | | HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | | HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. Default: `1936`. If set to `false`, disable statistics | diff --git a/assets/etc/crontabs/root b/assets/etc/crontabs/root deleted file mode 100644 index fb82802..0000000 --- a/assets/etc/crontabs/root +++ /dev/null @@ -1,9 +0,0 @@ -# do daily/weekly/monthly maintenance -# min hour day month weekday command -*/15 * * * * run-parts /etc/periodic/15min -0 * * * * run-parts /etc/periodic/hourly -0 2 * * * run-parts /etc/periodic/daily -0 3 * * 6 run-parts /etc/periodic/weekly -0 5 1 * * run-parts /etc/periodic/monthly -* * * * * /scripts/haproxy-reload.sh > /proc/$(cat /var/run/supervisord.pid)/fd/1 2>&1 - diff --git a/assets/etc/supervisord.conf b/assets/etc/supervisord.conf deleted file mode 100644 index dd1f43b..0000000 --- a/assets/etc/supervisord.conf +++ /dev/null @@ -1,45 +0,0 @@ -[unix_http_server] -file=/dev/shm/supervisor.sock ; (the path to the socket file) - -[supervisord] -logfile=/var/log/supervisord.log ; (main log file;default $CWD/supervisord.log) -logfile_maxbytes=50MB ; (max main logfile bytes b4 rotation;default 50MB) -logfile_backups=10 ; (num of main logfile rotation backups;default 10) -loglevel=info ; (log level;default info; others: debug,warn,trace) -pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid) -nodaemon=false ; (start in foreground if true;default false) -minfds=1024 ; (min. avail startup file descriptors;default 1024) -minprocs=200 ; (min. avail process descriptors;default 200) -user=root ; - -; the below section must remain in the config file for RPC -; (supervisorctl/web interface) to work, additional interfaces may be -; added by defining them in separate rpcinterface: sections -[rpcinterface:supervisor] -supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface - -[supervisorctl] -serverurl=unix:///dev/shm/supervisor.sock ; use a unix:// URL for a unix socket - -[program:haproxy] -command = /scripts/haproxy.sh -autostart=true -autorestart=false -priority=5 -stdout_logfile=/dev/stdout -stdout_logfile_maxbytes=0 -stderr_logfile=/dev/stderr -stderr_logfile_maxbytes=0 - -[program:crond] -command=/usr/sbin/crond -f -autostart=true -autorestart=false -stdout_logfile=/dev/stdout -stdout_logfile_maxbytes=0 -stderr_logfile=/dev/stderr -stderr_logfile_maxbytes=0 - -[eventlistener:exit_on_any_fatal] -command=/scripts/exit-event-listener.py -events=PROCESS_STATE_FATAL,PROCESS_STATE_EXITED,PROCESS_STATE_STOPPED diff --git a/assets/scripts/certbot.sh b/assets/scripts/certbot.sh index 76f1774..6d9113d 100755 --- a/assets/scripts/certbot.sh +++ b/assets/scripts/certbot.sh @@ -2,7 +2,7 @@ # Semaphore if [ -f /tmp/certbot-lock ]; then - echo "[CERTBOT_JOB] Another process is running" + echo "[CERTBOT_JOB] $(date +"$EASYHAPROXY_DATEFORMAT") Another process is running" exit 0 fi @@ -26,7 +26,7 @@ for domain in $(cat /scripts/letsencrypt_hosts.txt); do done if [ -n "$REQUEST_CERTS" ]; then - echo "[CERTBOT_JOB] Requesting certificates for $REQUEST_CERTS" + echo "[CERTBOT_JOB] $(date +"$EASYHAPROXY_DATEFORMAT") Requesting certificates for $REQUEST_CERTS" certbot certonly \ --standalone \ --preferred-challenges http \ @@ -41,7 +41,7 @@ if [ -n "$REQUEST_CERTS" ]; then fi if [ -n "$RENEW_CERTS" ]; then - echo "[CERTBOT_JOB] Resquesting renew certificated fort $RENEW_CERTS" + echo "[CERTBOT_JOB] $(date +"$EASYHAPROXY_DATEFORMAT") Resquesting renew certificated fort $RENEW_CERTS" certbot renew --post-hook "/scripts/certbot_to_haproxy.sh" fi diff --git a/assets/scripts/exit-event-listener.py b/assets/scripts/exit-event-listener.py deleted file mode 100755 index 2a7cda7..0000000 --- a/assets/scripts/exit-event-listener.py +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/env python - -import os -import signal - -from supervisor import childutils - - -def main(): - while True: - headers, payload = childutils.listener.wait() - childutils.listener.ok() - events = ['PROCESS_STATE_FATAL', 'PROCESS_STATE_EXITED', 'PROCESS_STATE_STOPPED'] - if headers['eventname'] not in events: - continue - - print(headers) - print(payload) - os.kill(os.getppid(), signal.SIGTERM) - - -if __name__ == "__main__": - main() diff --git a/assets/scripts/haproxy-reload.sh b/assets/scripts/haproxy-reload.sh index 5a3980f..1d55fe5 100755 --- a/assets/scripts/haproxy-reload.sh +++ b/assets/scripts/haproxy-reload.sh @@ -35,7 +35,7 @@ else RELOAD="false" else python3 swarm.py > /etc/haproxy/haproxy.cfg - echo "[CONF_CHECK] New configuration found" + echo "[CONF_CHECK] $(date +"$EASYHAPROXY_DATEFORMAT") New configuration found" fi fi @@ -44,23 +44,23 @@ if cmp -s ${CONTROL_FILE} ${CONTROL_FILE}.old ; then fi if [[ ! -z "$1" ]]; then - echo "[CONF_CHECK] Initial configuration. Skip certbot." + echo "[CONF_CHECK] $(date +"$EASYHAPROXY_DATEFORMAT") Initial configuration. Skip certbot." else /scripts/certbot.sh fi # If Certbot reloads successfully will create the file /tmp/force-reload if [ -f /tmp/force-reload ]; then - echo "[CONF_CHECK] New certificates found..." + echo "[CONF_CHECK] $(date +"$EASYHAPROXY_DATEFORMAT") New certificates found..." RELOAD="true" rm /tmp/force-reload fi if [[ ! -z "$1" ]]; then - echo "[CONF_CHECK] Starting haproxy..." + echo "[CONF_CHECK] $(date +"$EASYHAPROXY_DATEFORMAT") Starting haproxy..." /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg $(ls /etc/haproxy/conf.d/*.cfg 2>/dev/null | xargs -I{} echo -f {}) -p /run/haproxy.pid -S /var/run/haproxy.sock & elif [[ "$RELOAD" == "true" ]]; then - echo "[CONF_CHECK] Reloading..." + echo "[CONF_CHECK] $(date +"$EASYHAPROXY_DATEFORMAT") Reloading..." /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg $(ls /etc/haproxy/conf.d/*.cfg 2>/dev/null | xargs -I{} echo -f {}) -p /run/haproxy.pid -x /var/run/haproxy.sock -sf $(cat /run/haproxy.pid) & fi diff --git a/assets/scripts/haproxy.sh b/assets/scripts/haproxy.sh index 688bdc9..b830088 100755 --- a/assets/scripts/haproxy.sh +++ b/assets/scripts/haproxy.sh @@ -2,8 +2,18 @@ /usr/sbin/haproxy -v -source /scripts/haproxy-reload.sh initial +if [ -z "$EASYHAPROXY_DATEFORMAT" ]; then + export EASYHAPROXY_DATEFORMAT="%Y-%m-%d %H:%M:%S %Z" +fi + +if [ -z "$EASYHAPROXY_REFRESH_CONF" ]; then + export EASYHAPROXY_REFRESH_CONF=10 +fi + +/scripts/haproxy-reload.sh initial while true; do - sleep 60 + sleep $EASYHAPROXY_REFRESH_CONF + echo "[CONF_CHECK] $(date +"$EASYHAPROXY_DATEFORMAT") - Heartbeat." + /scripts/haproxy-reload.sh done