Some refactory to support letsencrypt
This commit is contained in:
Joao M
parent
bdc97fa10d
commit
9fa9dc9841
15 changed files with 207 additions and 145 deletions
|
|
@ -1,3 +0,0 @@
|
|||
# Certs Folder
|
||||
|
||||
Docker Easy HAProxy will save the SSL Certs here.
|
||||
|
|
@ -2,16 +2,37 @@
|
|||
|
||||
@todo
|
||||
|
||||
mkdir -p /var/log/letsencrypt
|
||||
ln -sf /dev/stdout /var/log/letsencrypt/letsencrypt.log
|
||||
|
||||
certbot certonly \
|
||||
--standalone \
|
||||
--preferred-challenges http \
|
||||
--http-01-port 2080 \
|
||||
--agree-tos \
|
||||
--issuance-timeout 90 \
|
||||
--no-eff-email \
|
||||
--non-interactive \
|
||||
--max-log-backups=0 \
|
||||
--post-hook "/scripts/certbot_to_haproxy.sh && systemctl reload haproxy.service"
|
||||
-d dev.globalnetguide.com -d other.domain.com --email info@xpto.us
|
||||
REQUEST_CERTS=""
|
||||
RENEW_CERTS=""
|
||||
|
||||
for domain in $(cat /scripts/letsencrypt_hosts.txt); do
|
||||
if [ ! -f "/etc/haproxy/certs/$domain.pem" ]; then
|
||||
REQUEST_CERTS="$REQUES_CERTS -d $domain"
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ $(find "/etc/haproxy/certs/$domain.pem" -mtime +30 -print) ]]; then
|
||||
RENEW_CERTS="$RENEW_CERTS -d $domain"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$REQUEST_CERTS" ]; then
|
||||
certbot certonly \
|
||||
--standalone \
|
||||
--preferred-challenges http \
|
||||
--http-01-port 2080 \
|
||||
--agree-tos \
|
||||
--issuance-timeout 90 \
|
||||
--no-eff-email \
|
||||
--non-interactive \
|
||||
--max-log-backups=0 \
|
||||
--post-hook "/scripts/certbot_to_haproxy.sh" \
|
||||
$REQUEST_CERTS --email info@xpto.us
|
||||
fi
|
||||
|
||||
if [ -n "$RENEW_CERTS" ]; then
|
||||
certbot renew --post-hook "/scripts/certbot_to_haproxy.sh"
|
||||
fi
|
||||
|
|
@ -9,3 +9,5 @@ for CERTIFICATE in `find /etc/letsencrypt/live/* -type d`; do
|
|||
# Combine certificate and private key to single file
|
||||
cat /etc/letsencrypt/live/$CERTIFICATE/fullchain.pem /etc/letsencrypt/live/$CERTIFICATE/privkey.pem > /etc/haproxy/certs/$CERTIFICATE.pem
|
||||
done
|
||||
|
||||
/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf $(cat /run/haproxy.pid) &
|
||||
|
|
|
|||
|
|
@ -42,11 +42,10 @@ class DockerLabelHandler:
|
|||
|
||||
|
||||
class HaproxyConfigGenerator:
|
||||
def __init__(self, mapping, ssl_cert_folder="/etc/haproxy/certs"):
|
||||
def __init__(self, mapping, ssl_cert_folder="/etc/haproxy/certs/discover"):
|
||||
self.mapping = mapping
|
||||
self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy")
|
||||
self.ssl_cert_folder = ssl_cert_folder
|
||||
self.ssl_cert_increment = 0
|
||||
self.letsencrypt_hosts = []
|
||||
os.makedirs(self.ssl_cert_folder, exist_ok=True)
|
||||
|
||||
|
|
@ -112,16 +111,8 @@ class HaproxyConfigGenerator:
|
|||
)
|
||||
self.letsencrypt_hosts.append(d[host_label]) if letsencrypt and d[host_label] not in self.letsencrypt_hosts else self.letsencrypt_hosts
|
||||
|
||||
hash = ""
|
||||
if self.label.create([definition, "sslcert"]) in d:
|
||||
hash = hashlib.md5(
|
||||
d[self.label.create([definition, "sslcert"])].encode('utf-8')
|
||||
).hexdigest()
|
||||
|
||||
key = port if not hash else port + "_" + hash
|
||||
|
||||
if key not in easymapping:
|
||||
easymapping[key] = {
|
||||
if port not in easymapping:
|
||||
easymapping[port] = {
|
||||
"mode": mode,
|
||||
"health-check": "",
|
||||
"port": port,
|
||||
|
|
@ -135,25 +126,38 @@ class HaproxyConfigGenerator:
|
|||
"80"
|
||||
)
|
||||
|
||||
easymapping[key]["health-check"] = self.label.get(
|
||||
easymapping[port]["health-check"] = self.label.get(
|
||||
self.label.create([definition, "health-check"]),
|
||||
""
|
||||
)
|
||||
|
||||
easymapping[key]["hosts"].setdefault(d[host_label], {})
|
||||
easymapping[key]["hosts"][d[host_label]].setdefault("containers", [])
|
||||
easymapping[key]["hosts"][d[host_label]].setdefault("letsencrypt", False)
|
||||
easymapping[key]["hosts"][d[host_label]]["containers"] += ["{}:{}".format(container, ct_port)]
|
||||
easymapping[key]["hosts"][d[host_label]]["letsencrypt"] = letsencrypt
|
||||
easymapping[port]["hosts"].setdefault(d[host_label], {})
|
||||
easymapping[port]["hosts"][d[host_label]].setdefault("containers", [])
|
||||
easymapping[port]["hosts"][d[host_label]].setdefault("letsencrypt", False)
|
||||
easymapping[port]["hosts"][d[host_label]]["containers"] += ["{}:{}".format(container, ct_port)]
|
||||
easymapping[port]["hosts"][d[host_label]]["letsencrypt"] = letsencrypt
|
||||
|
||||
if letsencrypt:
|
||||
if "443" not in easymapping:
|
||||
easymapping["443"] = {
|
||||
"mode": "http",
|
||||
"health-check": "ssl",
|
||||
"port": "443",
|
||||
"hosts": dict(),
|
||||
"redirect": dict(),
|
||||
}
|
||||
easymapping["443"]["hosts"][d[host_label]] = dict(easymapping[port]["hosts"][d[host_label]])
|
||||
easymapping["443"]["hosts"][d[host_label]]["letsencrypt"] = False
|
||||
|
||||
|
||||
|
||||
# handle SSL
|
||||
ssl_label = self.label.create([definition, "sslcert"])
|
||||
if self.label.has_label(ssl_label):
|
||||
self.ssl_cert_increment += 1
|
||||
filename = "{}/{}.{}.pem".format(
|
||||
self.ssl_cert_folder, d[host_label], str(self.ssl_cert_increment)
|
||||
filename = "{}/{}.pem".format(
|
||||
self.ssl_cert_folder, d[host_label]
|
||||
)
|
||||
easymapping[key]["ssl_cert"] = filename
|
||||
easymapping[port]["ssl_cert"] = filename
|
||||
with open(filename, 'wb') as file:
|
||||
file.write(
|
||||
base64.b64decode(d[ssl_label])
|
||||
|
|
@ -166,6 +170,6 @@ class HaproxyConfigGenerator:
|
|||
if len(redirect) > 0:
|
||||
for r in redirect.split(","):
|
||||
r_parts = r.split("--")
|
||||
easymapping[key]["redirect"][r_parts[0]] = r_parts[1]
|
||||
easymapping[port]["redirect"][r_parts[0]] = r_parts[1]
|
||||
|
||||
return easymapping.values()
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -1,5 +1,5 @@
|
|||
{% if "ssl_cert" in o %}
|
||||
bind *:{{ o["port"] }} ssl crt {{ o["ssl_cert"] }}
|
||||
bind *:{{ o["port"] }} ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
|
||||
{% elif "h2" in o and o["h2"] %}
|
||||
bind *:{{ o["port"] }} proto h2
|
||||
option http-use-htx
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
{% endfor %}
|
||||
|
||||
{%- for k in o["hosts"] %}
|
||||
{% set host = k.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) %}
|
||||
{% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
|
||||
{% set letsencrypt = o["hosts"][k]["letsencrypt"] %}
|
||||
|
||||
acl is_rule_{{ host }}_1 hdr(host) -i {{ k }}
|
||||
|
|
|
|||
|
|
@ -2,5 +2,5 @@
|
|||
option tcplog
|
||||
log global
|
||||
{% set backend = (o["hosts"]|first) %}
|
||||
default_backend srv_{{ backend.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) }}
|
||||
default_backend srv_{{ backend.replace(".", "_") + "_{0}".format(o["port"]) }}
|
||||
|
||||
|
|
|
|||
|
|
@ -39,9 +39,8 @@ backend srv_stats
|
|||
{% endif %}
|
||||
{% for o in data["easymapping"] -%}
|
||||
{% set mode = o["mode"] or "http" %}
|
||||
{% set salt = loop.index %}
|
||||
|
||||
frontend {{ mode }}_in_{{ o["port"] }}_{{ salt }}
|
||||
frontend {{ mode }}_in_{{ o["port"] }}
|
||||
{% include "bind.j2" %}
|
||||
{% if mode == "http" %}
|
||||
{% include "frontend-mode-http.j2" %}
|
||||
|
|
@ -50,7 +49,7 @@ frontend {{ mode }}_in_{{ o["port"] }}_{{ salt }}
|
|||
{% endif %}
|
||||
|
||||
{% for k in o["hosts"] -%}
|
||||
{% set host = k.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) %}
|
||||
{% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
|
||||
backend srv_{{ host }}
|
||||
balance roundrobin
|
||||
mode {{ mode }}
|
||||
|
|
@ -69,4 +68,5 @@ backend srv_{{ host }}
|
|||
{% endfor %}
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -12,4 +12,5 @@ defaults
|
|||
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -11,15 +11,15 @@ defaults
|
|||
timeout server 10m
|
||||
|
||||
|
||||
frontend http_in_19901_1
|
||||
frontend http_in_19901
|
||||
bind *:19901
|
||||
mode http
|
||||
|
||||
acl is_rule_www_helloworld_com_19901_1_1 hdr(host) -i www.helloworld.com
|
||||
acl is_rule_www_helloworld_com_19901_1_2 hdr(host) -i www.helloworld.com:19901
|
||||
use_backend srv_www_helloworld_com_19901_1 if is_rule_www_helloworld_com_19901_1_1 OR is_rule_www_helloworld_com_19901_1_2
|
||||
acl is_rule_www_helloworld_com_19901_1 hdr(host) -i www.helloworld.com
|
||||
acl is_rule_www_helloworld_com_19901_2 hdr(host) -i www.helloworld.com:19901
|
||||
use_backend srv_www_helloworld_com_19901 if is_rule_www_helloworld_com_19901_1 OR is_rule_www_helloworld_com_19901_2
|
||||
|
||||
backend srv_www_helloworld_com_19901_1
|
||||
backend srv_www_helloworld_com_19901
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
|
|
@ -29,4 +29,5 @@ backend srv_www_helloworld_com_19901_1
|
|||
server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -11,14 +11,14 @@ defaults
|
|||
timeout server 10m
|
||||
|
||||
|
||||
frontend tcp_in_31339_1
|
||||
frontend tcp_in_31339
|
||||
bind *:31339
|
||||
mode tcp
|
||||
option tcplog
|
||||
log global
|
||||
default_backend srv_agent_quantum_local_31339_1
|
||||
default_backend srv_agent_quantum_local_31339
|
||||
|
||||
backend srv_agent_quantum_local_31339_1
|
||||
backend srv_agent_quantum_local_31339
|
||||
balance roundrobin
|
||||
mode tcp
|
||||
option tcp-check
|
||||
|
|
@ -26,4 +26,5 @@ backend srv_agent_quantum_local_31339_1
|
|||
server srv-0 test_agent:9001 check weight 1 verify none
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -11,42 +11,42 @@ defaults
|
|||
timeout server 10m
|
||||
|
||||
|
||||
frontend tcp_in_31339_1
|
||||
frontend tcp_in_31339
|
||||
bind *:31339
|
||||
mode tcp
|
||||
option tcplog
|
||||
log global
|
||||
default_backend srv_agent_quantum_example_org_31339_1
|
||||
default_backend srv_agent_quantum_example_org_31339
|
||||
|
||||
backend srv_agent_quantum_example_org_31339_1
|
||||
backend srv_agent_quantum_example_org_31339
|
||||
balance roundrobin
|
||||
mode tcp
|
||||
option tcp-check
|
||||
tcp-check connect
|
||||
server srv-0 my-stack_agent:9001 check weight 1
|
||||
|
||||
frontend http_in_31337_2
|
||||
frontend http_in_31337
|
||||
bind *:31337
|
||||
mode http
|
||||
|
||||
acl is_rule_cadvisor_quantum_example_org_31337_2_1 hdr(host) -i cadvisor.quantum.example.org
|
||||
acl is_rule_cadvisor_quantum_example_org_31337_2_2 hdr(host) -i cadvisor.quantum.example.org:31337
|
||||
use_backend srv_cadvisor_quantum_example_org_31337_2 if is_rule_cadvisor_quantum_example_org_31337_2_1 OR is_rule_cadvisor_quantum_example_org_31337_2_2
|
||||
acl is_rule_cadvisor_quantum_example_org_31337_1 hdr(host) -i cadvisor.quantum.example.org
|
||||
acl is_rule_cadvisor_quantum_example_org_31337_2 hdr(host) -i cadvisor.quantum.example.org:31337
|
||||
use_backend srv_cadvisor_quantum_example_org_31337 if is_rule_cadvisor_quantum_example_org_31337_1 OR is_rule_cadvisor_quantum_example_org_31337_2
|
||||
|
||||
acl is_rule_node-exporter_quantum_example_org_31337_2_1 hdr(host) -i node-exporter.quantum.example.org
|
||||
acl is_rule_node-exporter_quantum_example_org_31337_2_2 hdr(host) -i node-exporter.quantum.example.org:31337
|
||||
acl is_letsencrypt_node-exporter_quantum_example_org_31337_2 path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337_2 is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337_2 is_rule_node-exporter_quantum_example_org_31337_2_2
|
||||
use_backend srv_node-exporter_quantum_example_org_31337_2 if is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_rule_node-exporter_quantum_example_org_31337_2_2
|
||||
acl is_rule_node-exporter_quantum_example_org_31337_1 hdr(host) -i node-exporter.quantum.example.org
|
||||
acl is_rule_node-exporter_quantum_example_org_31337_2 hdr(host) -i node-exporter.quantum.example.org:31337
|
||||
acl is_letsencrypt_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2
|
||||
use_backend srv_node-exporter_quantum_example_org_31337 if is_rule_node-exporter_quantum_example_org_31337_1 OR is_rule_node-exporter_quantum_example_org_31337_2
|
||||
|
||||
backend srv_cadvisor_quantum_example_org_31337_2
|
||||
backend srv_cadvisor_quantum_example_org_31337
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 my-stack_cadvisor:8080 check weight 1
|
||||
backend srv_node-exporter_quantum_example_org_31337_2
|
||||
backend srv_node-exporter_quantum_example_org_31337
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
|
|
@ -54,7 +54,39 @@ backend srv_node-exporter_quantum_example_org_31337_2
|
|||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 my-stack_node-exporter:9100 check weight 1
|
||||
|
||||
frontend http_in_80_3
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
|
||||
mode http
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.somehost.com }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
|
||||
|
||||
acl is_rule_node-exporter_quantum_example_org_443_1 hdr(host) -i node-exporter.quantum.example.org
|
||||
acl is_rule_node-exporter_quantum_example_org_443_2 hdr(host) -i node-exporter.quantum.example.org:443
|
||||
use_backend srv_node-exporter_quantum_example_org_443 if is_rule_node-exporter_quantum_example_org_443_1 OR is_rule_node-exporter_quantum_example_org_443_2
|
||||
|
||||
acl is_rule_www_somehost_com_br_443_1 hdr(host) -i www.somehost.com.br
|
||||
acl is_rule_www_somehost_com_br_443_2 hdr(host) -i www.somehost.com.br:443
|
||||
use_backend srv_www_somehost_com_br_443 if is_rule_www_somehost_com_br_443_1 OR is_rule_www_somehost_com_br_443_2
|
||||
|
||||
backend srv_node-exporter_quantum_example_org_443
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 my-stack_node-exporter:9100 check weight 1
|
||||
backend srv_www_somehost_com_br_443
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 some-service:80 check weight 1
|
||||
|
||||
frontend http_in_80
|
||||
bind *:80
|
||||
mode http
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
|
||||
|
|
@ -63,32 +95,11 @@ frontend http_in_80_3
|
|||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
|
||||
|
||||
acl is_rule_www_somehost_com_br_80_3_1 hdr(host) -i www.somehost.com.br
|
||||
acl is_rule_www_somehost_com_br_80_3_2 hdr(host) -i www.somehost.com.br:80
|
||||
use_backend srv_www_somehost_com_br_80_3 if is_rule_www_somehost_com_br_80_3_1 OR is_rule_www_somehost_com_br_80_3_2
|
||||
acl is_rule_www_somehost_com_br_80_1 hdr(host) -i www.somehost.com.br
|
||||
acl is_rule_www_somehost_com_br_80_2 hdr(host) -i www.somehost.com.br:80
|
||||
use_backend srv_www_somehost_com_br_80 if is_rule_www_somehost_com_br_80_1 OR is_rule_www_somehost_com_br_80_2
|
||||
|
||||
backend srv_www_somehost_com_br_80_3
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 some-service:80 check weight 1
|
||||
|
||||
frontend http_in_443_4
|
||||
bind *:443 ssl crt /tmp/www.somehost.com.br.1.pem
|
||||
mode http
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.somehost.com }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
|
||||
|
||||
acl is_rule_www_somehost_com_br_443_4_1 hdr(host) -i www.somehost.com.br
|
||||
acl is_rule_www_somehost_com_br_443_4_2 hdr(host) -i www.somehost.com.br:443
|
||||
use_backend srv_www_somehost_com_br_443_4 if is_rule_www_somehost_com_br_443_4_1 OR is_rule_www_somehost_com_br_443_4_2
|
||||
|
||||
backend srv_www_somehost_com_br_443_4
|
||||
backend srv_www_somehost_com_br_80
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
|
|
@ -97,4 +108,5 @@ backend srv_www_somehost_com_br_443_4
|
|||
server srv-0 some-service:80 check weight 1
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -34,29 +34,29 @@ backend srv_stats
|
|||
mode http
|
||||
server Local 127.0.0.1:1936
|
||||
|
||||
frontend http_in_80_1
|
||||
frontend http_in_80
|
||||
bind *:80
|
||||
mode http
|
||||
redirect prefix http://host1.com.br code 301 if { hdr(host) -i www.host1.com.br }
|
||||
|
||||
acl is_rule_host1_com_br_80_1_1 hdr(host) -i host1.com.br
|
||||
acl is_rule_host1_com_br_80_1_2 hdr(host) -i host1.com.br:80
|
||||
acl is_letsencrypt_host1_com_br_80_1 path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80_1 is_rule_host1_com_br_80_1_1 OR is_letsencrypt_host1_com_br_80_1 is_rule_host1_com_br_80_1_2
|
||||
use_backend srv_host1_com_br_80_1 if is_rule_host1_com_br_80_1_1 OR is_rule_host1_com_br_80_1_2
|
||||
acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br
|
||||
acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80
|
||||
acl is_letsencrypt_host1_com_br_80 path_beg /.well-known/acme-challenge/
|
||||
use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_2
|
||||
use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2
|
||||
|
||||
acl is_rule_host2_com_br_80_1_1 hdr(host) -i host2.com.br
|
||||
acl is_rule_host2_com_br_80_1_2 hdr(host) -i host2.com.br:80
|
||||
use_backend srv_host2_com_br_80_1 if is_rule_host2_com_br_80_1_1 OR is_rule_host2_com_br_80_1_2
|
||||
acl is_rule_host2_com_br_80_1 hdr(host) -i host2.com.br
|
||||
acl is_rule_host2_com_br_80_2 hdr(host) -i host2.com.br:80
|
||||
use_backend srv_host2_com_br_80 if is_rule_host2_com_br_80_1 OR is_rule_host2_com_br_80_2
|
||||
|
||||
backend srv_host1_com_br_80_1
|
||||
backend srv_host1_com_br_80
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 container:5000 check weight 1
|
||||
backend srv_host2_com_br_80_1
|
||||
backend srv_host2_com_br_80
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
|
|
@ -64,15 +64,15 @@ backend srv_host2_com_br_80_1
|
|||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 other:3000 check weight 1
|
||||
|
||||
frontend http_in_443_2
|
||||
bind *:443 ssl crt /etc/haproxy/certs/mycert.pem
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
|
||||
mode http
|
||||
|
||||
acl is_rule_host1_com_br_443_2_1 hdr(host) -i host1.com.br
|
||||
acl is_rule_host1_com_br_443_2_2 hdr(host) -i host1.com.br:443
|
||||
use_backend srv_host1_com_br_443_2 if is_rule_host1_com_br_443_2_1 OR is_rule_host1_com_br_443_2_2
|
||||
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
|
||||
acl is_rule_host1_com_br_443_2 hdr(host) -i host1.com.br:443
|
||||
use_backend srv_host1_com_br_443 if is_rule_host1_com_br_443_1 OR is_rule_host1_com_br_443_2
|
||||
|
||||
backend srv_host1_com_br_443_2
|
||||
backend srv_host1_com_br_443
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
|
|
@ -80,15 +80,15 @@ backend srv_host1_com_br_443_2
|
|||
http-request add-header X-Forwarded-Proto https if { ssl_fc }
|
||||
server srv-0 container:80 check weight 1
|
||||
|
||||
frontend http_in_8080_3
|
||||
frontend http_in_8080
|
||||
bind *:8080
|
||||
mode http
|
||||
|
||||
acl is_rule_host3_com_br_8080_3_1 hdr(host) -i host3.com.br
|
||||
acl is_rule_host3_com_br_8080_3_2 hdr(host) -i host3.com.br:8080
|
||||
use_backend srv_host3_com_br_8080_3 if is_rule_host3_com_br_8080_3_1 OR is_rule_host3_com_br_8080_3_2
|
||||
acl is_rule_host3_com_br_8080_1 hdr(host) -i host3.com.br
|
||||
acl is_rule_host3_com_br_8080_2 hdr(host) -i host3.com.br:8080
|
||||
use_backend srv_host3_com_br_8080 if is_rule_host3_com_br_8080_1 OR is_rule_host3_com_br_8080_2
|
||||
|
||||
backend srv_host3_com_br_8080_3
|
||||
backend srv_host3_com_br_8080
|
||||
balance roundrobin
|
||||
mode http
|
||||
option forwardfor
|
||||
|
|
@ -97,4 +97,5 @@ backend srv_host3_com_br_8080_3
|
|||
server srv-0 domain:8181 check weight 1
|
||||
|
||||
backend letsencrypt_backend
|
||||
mode http
|
||||
server certbot 127.0.0.1:2080
|
||||
|
|
@ -19,7 +19,7 @@ def test_parser_doesnt_crash():
|
|||
"customerrors": False
|
||||
}
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
|
||||
haproxy_config = cfg.generate(line_list)
|
||||
|
||||
assert len(haproxy_config) > 0
|
||||
|
|
@ -35,11 +35,11 @@ def test_parser_finds_services():
|
|||
"customerrors": False
|
||||
}
|
||||
|
||||
cert_file = "/tmp/www.somehost.com.br.1.pem"
|
||||
cert_file = "/tmp/certs/www.somehost.com.br.pem"
|
||||
if os.path.exists(cert_file):
|
||||
os.remove(cert_file)
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
|
||||
haproxy_config = cfg.generate(line_list)
|
||||
|
||||
assert len(haproxy_config) > 0
|
||||
|
|
@ -60,11 +60,11 @@ def test_parser_finds_services_changed_label():
|
|||
"lookup_label": "haproxy"
|
||||
}
|
||||
|
||||
cert_file = "/tmp/www.somehost.com.br.1.pem"
|
||||
cert_file = "/tmp/certs/www.somehost.com.br.pem"
|
||||
if os.path.exists(cert_file):
|
||||
os.remove(cert_file)
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
|
||||
haproxy_config = cfg.generate(line_list)
|
||||
|
||||
assert len(haproxy_config) > 0
|
||||
|
|
@ -84,11 +84,11 @@ def test_parser_finds_services_raw():
|
|||
"customerrors": False
|
||||
}
|
||||
|
||||
cert_file = "/tmp/www.somehost.com.br.1.pem"
|
||||
cert_file = "/tmp/certs/www.somehost.com.br.pem"
|
||||
if os.path.exists(cert_file):
|
||||
os.remove(cert_file)
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
|
||||
|
||||
parsed_object = [
|
||||
{
|
||||
|
|
@ -129,6 +129,33 @@ def test_parser_finds_services_raw():
|
|||
|
||||
}
|
||||
},
|
||||
{
|
||||
"mode":"http",
|
||||
"health-check":"",
|
||||
"port":"443",
|
||||
"hosts":{
|
||||
"node-exporter.quantum.example.org": {
|
||||
"containers": [
|
||||
"my-stack_node-exporter:9100"
|
||||
],
|
||||
"letsencrypt": False
|
||||
},
|
||||
"www.somehost.com.br":{
|
||||
"containers": [
|
||||
"some-service:80"
|
||||
],
|
||||
"letsencrypt": False
|
||||
}
|
||||
},
|
||||
"redirect":{
|
||||
"somehost.com.br":"https://www.somehost.com.br",
|
||||
"somehost.com":"https://www.somehost.com.br",
|
||||
"www.somehost.com":"https://www.somehost.com.br",
|
||||
"byjg.ca":"https://www.somehost.com.br",
|
||||
"www.byjg.ca":"https://www.somehost.com.br"
|
||||
},
|
||||
"ssl_cert":"/tmp/certs/www.somehost.com.br.pem"
|
||||
},
|
||||
{
|
||||
"mode":"http",
|
||||
"health-check":"",
|
||||
|
|
@ -148,27 +175,6 @@ def test_parser_finds_services_raw():
|
|||
"byjg.ca":"https://www.somehost.com.br",
|
||||
"www.byjg.ca":"https://www.somehost.com.br"
|
||||
}
|
||||
},
|
||||
{
|
||||
"mode":"http",
|
||||
"health-check":"",
|
||||
"port":"443",
|
||||
"hosts":{
|
||||
"www.somehost.com.br":{
|
||||
"containers": [
|
||||
"some-service:80"
|
||||
],
|
||||
"letsencrypt": False
|
||||
}
|
||||
},
|
||||
"redirect":{
|
||||
"somehost.com.br":"https://www.somehost.com.br",
|
||||
"somehost.com":"https://www.somehost.com.br",
|
||||
"www.somehost.com":"https://www.somehost.com.br",
|
||||
"byjg.ca":"https://www.somehost.com.br",
|
||||
"www.byjg.ca":"https://www.somehost.com.br"
|
||||
},
|
||||
"ssl_cert":"/tmp/www.somehost.com.br.1.pem"
|
||||
}
|
||||
]
|
||||
|
||||
|
|
@ -184,7 +190,7 @@ def test_parser_static():
|
|||
with open(path + "/fixtures/static.yml", 'r') as content_file:
|
||||
parsed = yaml.load(content_file.read(), Loader=yaml.FullLoader)
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(parsed, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(parsed, "/tmp/certs")
|
||||
haproxy_config = cfg.generate()
|
||||
assert len(haproxy_config) > 0
|
||||
|
||||
|
|
@ -259,7 +265,7 @@ def test_parser_tcp():
|
|||
"customerrors": False
|
||||
}
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
|
||||
haproxy_config = cfg.generate(line_list)
|
||||
# print(haproxy_config)
|
||||
|
||||
|
|
@ -276,7 +282,7 @@ def test_parser_multi_containers():
|
|||
"customerrors": False
|
||||
}
|
||||
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
|
||||
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
|
||||
haproxy_config = cfg.generate(line_list)
|
||||
|
||||
assert len(haproxy_config) > 0
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue