1
0
Fork 0

Some refactory to support letsencrypt

This commit is contained in:
Joao M 2022-08-15 04:31:50 +00:00
parent bdc97fa10d
commit 9fa9dc9841
15 changed files with 207 additions and 145 deletions

View file

@ -12,4 +12,5 @@ defaults
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

View file

@ -11,15 +11,15 @@ defaults
timeout server 10m
frontend http_in_19901_1
frontend http_in_19901
bind *:19901
mode http
acl is_rule_www_helloworld_com_19901_1_1 hdr(host) -i www.helloworld.com
acl is_rule_www_helloworld_com_19901_1_2 hdr(host) -i www.helloworld.com:19901
use_backend srv_www_helloworld_com_19901_1 if is_rule_www_helloworld_com_19901_1_1 OR is_rule_www_helloworld_com_19901_1_2
acl is_rule_www_helloworld_com_19901_1 hdr(host) -i www.helloworld.com
acl is_rule_www_helloworld_com_19901_2 hdr(host) -i www.helloworld.com:19901
use_backend srv_www_helloworld_com_19901 if is_rule_www_helloworld_com_19901_1 OR is_rule_www_helloworld_com_19901_2
backend srv_www_helloworld_com_19901_1
backend srv_www_helloworld_com_19901
balance roundrobin
mode http
option forwardfor
@ -29,4 +29,5 @@ backend srv_www_helloworld_com_19901_1
server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

View file

@ -11,14 +11,14 @@ defaults
timeout server 10m
frontend tcp_in_31339_1
frontend tcp_in_31339
bind *:31339
mode tcp
option tcplog
log global
default_backend srv_agent_quantum_local_31339_1
default_backend srv_agent_quantum_local_31339
backend srv_agent_quantum_local_31339_1
backend srv_agent_quantum_local_31339
balance roundrobin
mode tcp
option tcp-check
@ -26,4 +26,5 @@ backend srv_agent_quantum_local_31339_1
server srv-0 test_agent:9001 check weight 1 verify none
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

View file

@ -11,42 +11,42 @@ defaults
timeout server 10m
frontend tcp_in_31339_1
frontend tcp_in_31339
bind *:31339
mode tcp
option tcplog
log global
default_backend srv_agent_quantum_example_org_31339_1
default_backend srv_agent_quantum_example_org_31339
backend srv_agent_quantum_example_org_31339_1
backend srv_agent_quantum_example_org_31339
balance roundrobin
mode tcp
option tcp-check
tcp-check connect
server srv-0 my-stack_agent:9001 check weight 1
frontend http_in_31337_2
frontend http_in_31337
bind *:31337
mode http
acl is_rule_cadvisor_quantum_example_org_31337_2_1 hdr(host) -i cadvisor.quantum.example.org
acl is_rule_cadvisor_quantum_example_org_31337_2_2 hdr(host) -i cadvisor.quantum.example.org:31337
use_backend srv_cadvisor_quantum_example_org_31337_2 if is_rule_cadvisor_quantum_example_org_31337_2_1 OR is_rule_cadvisor_quantum_example_org_31337_2_2
acl is_rule_cadvisor_quantum_example_org_31337_1 hdr(host) -i cadvisor.quantum.example.org
acl is_rule_cadvisor_quantum_example_org_31337_2 hdr(host) -i cadvisor.quantum.example.org:31337
use_backend srv_cadvisor_quantum_example_org_31337 if is_rule_cadvisor_quantum_example_org_31337_1 OR is_rule_cadvisor_quantum_example_org_31337_2
acl is_rule_node-exporter_quantum_example_org_31337_2_1 hdr(host) -i node-exporter.quantum.example.org
acl is_rule_node-exporter_quantum_example_org_31337_2_2 hdr(host) -i node-exporter.quantum.example.org:31337
acl is_letsencrypt_node-exporter_quantum_example_org_31337_2 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337_2 is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337_2 is_rule_node-exporter_quantum_example_org_31337_2_2
use_backend srv_node-exporter_quantum_example_org_31337_2 if is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_rule_node-exporter_quantum_example_org_31337_2_2
acl is_rule_node-exporter_quantum_example_org_31337_1 hdr(host) -i node-exporter.quantum.example.org
acl is_rule_node-exporter_quantum_example_org_31337_2 hdr(host) -i node-exporter.quantum.example.org:31337
acl is_letsencrypt_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2
use_backend srv_node-exporter_quantum_example_org_31337 if is_rule_node-exporter_quantum_example_org_31337_1 OR is_rule_node-exporter_quantum_example_org_31337_2
backend srv_cadvisor_quantum_example_org_31337_2
backend srv_cadvisor_quantum_example_org_31337
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 my-stack_cadvisor:8080 check weight 1
backend srv_node-exporter_quantum_example_org_31337_2
backend srv_node-exporter_quantum_example_org_31337
balance roundrobin
mode http
option forwardfor
@ -54,7 +54,39 @@ backend srv_node-exporter_quantum_example_org_31337_2
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 my-stack_node-exporter:9100 check weight 1
frontend http_in_80_3
frontend http_in_443
bind *:443 ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
acl is_rule_node-exporter_quantum_example_org_443_1 hdr(host) -i node-exporter.quantum.example.org
acl is_rule_node-exporter_quantum_example_org_443_2 hdr(host) -i node-exporter.quantum.example.org:443
use_backend srv_node-exporter_quantum_example_org_443 if is_rule_node-exporter_quantum_example_org_443_1 OR is_rule_node-exporter_quantum_example_org_443_2
acl is_rule_www_somehost_com_br_443_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_443_2 hdr(host) -i www.somehost.com.br:443
use_backend srv_www_somehost_com_br_443 if is_rule_www_somehost_com_br_443_1 OR is_rule_www_somehost_com_br_443_2
backend srv_node-exporter_quantum_example_org_443
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 my-stack_node-exporter:9100 check weight 1
backend srv_www_somehost_com_br_443
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 some-service:80 check weight 1
frontend http_in_80
bind *:80
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
@ -63,32 +95,11 @@ frontend http_in_80_3
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
acl is_rule_www_somehost_com_br_80_3_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_80_3_2 hdr(host) -i www.somehost.com.br:80
use_backend srv_www_somehost_com_br_80_3 if is_rule_www_somehost_com_br_80_3_1 OR is_rule_www_somehost_com_br_80_3_2
acl is_rule_www_somehost_com_br_80_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_80_2 hdr(host) -i www.somehost.com.br:80
use_backend srv_www_somehost_com_br_80 if is_rule_www_somehost_com_br_80_1 OR is_rule_www_somehost_com_br_80_2
backend srv_www_somehost_com_br_80_3
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 some-service:80 check weight 1
frontend http_in_443_4
bind *:443 ssl crt /tmp/www.somehost.com.br.1.pem
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
acl is_rule_www_somehost_com_br_443_4_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_443_4_2 hdr(host) -i www.somehost.com.br:443
use_backend srv_www_somehost_com_br_443_4 if is_rule_www_somehost_com_br_443_4_1 OR is_rule_www_somehost_com_br_443_4_2
backend srv_www_somehost_com_br_443_4
backend srv_www_somehost_com_br_80
balance roundrobin
mode http
option forwardfor
@ -97,4 +108,5 @@ backend srv_www_somehost_com_br_443_4
server srv-0 some-service:80 check weight 1
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

View file

@ -34,29 +34,29 @@ backend srv_stats
mode http
server Local 127.0.0.1:1936
frontend http_in_80_1
frontend http_in_80
bind *:80
mode http
redirect prefix http://host1.com.br code 301 if { hdr(host) -i www.host1.com.br }
acl is_rule_host1_com_br_80_1_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_80_1_2 hdr(host) -i host1.com.br:80
acl is_letsencrypt_host1_com_br_80_1 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80_1 is_rule_host1_com_br_80_1_1 OR is_letsencrypt_host1_com_br_80_1 is_rule_host1_com_br_80_1_2
use_backend srv_host1_com_br_80_1 if is_rule_host1_com_br_80_1_1 OR is_rule_host1_com_br_80_1_2
acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80
acl is_letsencrypt_host1_com_br_80 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_2
use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2
acl is_rule_host2_com_br_80_1_1 hdr(host) -i host2.com.br
acl is_rule_host2_com_br_80_1_2 hdr(host) -i host2.com.br:80
use_backend srv_host2_com_br_80_1 if is_rule_host2_com_br_80_1_1 OR is_rule_host2_com_br_80_1_2
acl is_rule_host2_com_br_80_1 hdr(host) -i host2.com.br
acl is_rule_host2_com_br_80_2 hdr(host) -i host2.com.br:80
use_backend srv_host2_com_br_80 if is_rule_host2_com_br_80_1 OR is_rule_host2_com_br_80_2
backend srv_host1_com_br_80_1
backend srv_host1_com_br_80
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 container:5000 check weight 1
backend srv_host2_com_br_80_1
backend srv_host2_com_br_80
balance roundrobin
mode http
option forwardfor
@ -64,15 +64,15 @@ backend srv_host2_com_br_80_1
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 other:3000 check weight 1
frontend http_in_443_2
bind *:443 ssl crt /etc/haproxy/certs/mycert.pem
frontend http_in_443
bind *:443 ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
mode http
acl is_rule_host1_com_br_443_2_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_443_2_2 hdr(host) -i host1.com.br:443
use_backend srv_host1_com_br_443_2 if is_rule_host1_com_br_443_2_1 OR is_rule_host1_com_br_443_2_2
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_443_2 hdr(host) -i host1.com.br:443
use_backend srv_host1_com_br_443 if is_rule_host1_com_br_443_1 OR is_rule_host1_com_br_443_2
backend srv_host1_com_br_443_2
backend srv_host1_com_br_443
balance roundrobin
mode http
option forwardfor
@ -80,15 +80,15 @@ backend srv_host1_com_br_443_2
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 container:80 check weight 1
frontend http_in_8080_3
frontend http_in_8080
bind *:8080
mode http
acl is_rule_host3_com_br_8080_3_1 hdr(host) -i host3.com.br
acl is_rule_host3_com_br_8080_3_2 hdr(host) -i host3.com.br:8080
use_backend srv_host3_com_br_8080_3 if is_rule_host3_com_br_8080_3_1 OR is_rule_host3_com_br_8080_3_2
acl is_rule_host3_com_br_8080_1 hdr(host) -i host3.com.br
acl is_rule_host3_com_br_8080_2 hdr(host) -i host3.com.br:8080
use_backend srv_host3_com_br_8080 if is_rule_host3_com_br_8080_1 OR is_rule_host3_com_br_8080_2
backend srv_host3_com_br_8080_3
backend srv_host3_com_br_8080
balance roundrobin
mode http
option forwardfor
@ -97,4 +97,5 @@ backend srv_host3_com_br_8080_3
server srv-0 domain:8181 check weight 1
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

View file

@ -19,7 +19,7 @@ def test_parser_doesnt_crash():
"customerrors": False
}
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0
@ -35,11 +35,11 @@ def test_parser_finds_services():
"customerrors": False
}
cert_file = "/tmp/www.somehost.com.br.1.pem"
cert_file = "/tmp/certs/www.somehost.com.br.pem"
if os.path.exists(cert_file):
os.remove(cert_file)
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0
@ -60,11 +60,11 @@ def test_parser_finds_services_changed_label():
"lookup_label": "haproxy"
}
cert_file = "/tmp/www.somehost.com.br.1.pem"
cert_file = "/tmp/certs/www.somehost.com.br.pem"
if os.path.exists(cert_file):
os.remove(cert_file)
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0
@ -84,11 +84,11 @@ def test_parser_finds_services_raw():
"customerrors": False
}
cert_file = "/tmp/www.somehost.com.br.1.pem"
cert_file = "/tmp/certs/www.somehost.com.br.pem"
if os.path.exists(cert_file):
os.remove(cert_file)
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
parsed_object = [
{
@ -129,6 +129,33 @@ def test_parser_finds_services_raw():
}
},
{
"mode":"http",
"health-check":"",
"port":"443",
"hosts":{
"node-exporter.quantum.example.org": {
"containers": [
"my-stack_node-exporter:9100"
],
"letsencrypt": False
},
"www.somehost.com.br":{
"containers": [
"some-service:80"
],
"letsencrypt": False
}
},
"redirect":{
"somehost.com.br":"https://www.somehost.com.br",
"somehost.com":"https://www.somehost.com.br",
"www.somehost.com":"https://www.somehost.com.br",
"byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br"
},
"ssl_cert":"/tmp/certs/www.somehost.com.br.pem"
},
{
"mode":"http",
"health-check":"",
@ -148,27 +175,6 @@ def test_parser_finds_services_raw():
"byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br"
}
},
{
"mode":"http",
"health-check":"",
"port":"443",
"hosts":{
"www.somehost.com.br":{
"containers": [
"some-service:80"
],
"letsencrypt": False
}
},
"redirect":{
"somehost.com.br":"https://www.somehost.com.br",
"somehost.com":"https://www.somehost.com.br",
"www.somehost.com":"https://www.somehost.com.br",
"byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br"
},
"ssl_cert":"/tmp/www.somehost.com.br.1.pem"
}
]
@ -184,7 +190,7 @@ def test_parser_static():
with open(path + "/fixtures/static.yml", 'r') as content_file:
parsed = yaml.load(content_file.read(), Loader=yaml.FullLoader)
cfg = easymapping.HaproxyConfigGenerator(parsed, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(parsed, "/tmp/certs")
haproxy_config = cfg.generate()
assert len(haproxy_config) > 0
@ -259,7 +265,7 @@ def test_parser_tcp():
"customerrors": False
}
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list)
# print(haproxy_config)
@ -276,7 +282,7 @@ def test_parser_multi_containers():
"customerrors": False
}
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp")
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0