badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Some refactory to support letsencrypt

Browse source
This commit is contained in:
Joao M 2022-08-15 04:31:50 +00:00
parent bdc97fa10d
commit 9fa9dc9841
15 changed files with 207 additions and 145 deletions
Download patch file Download diff file Expand all files Collapse all files

3
assets/etc/haproxy/certs/README.md
View file

@ -1,3 +0,0 @@
# Certs Folder
Docker Easy HAProxy will save the SSL Certs here.

27
assets/scripts/certbot.sh
View file

@ -2,9 +2,25 @@
@todo @todo
mkdir -p /var/log/letsencrypt
ln -sf /dev/stdout /var/log/letsencrypt/letsencrypt.log ln -sf /dev/stdout /var/log/letsencrypt/letsencrypt.log
certbot certonly \ REQUEST_CERTS=""
RENEW_CERTS=""
for domain in $(cat /scripts/letsencrypt_hosts.txt); do
if [ ! -f "/etc/haproxy/certs/$domain.pem" ]; then
REQUEST_CERTS="$REQUES_CERTS -d $domain"
continue
fi
if [[ $(find "/etc/haproxy/certs/$domain.pem" -mtime +30 -print) ]]; then
RENEW_CERTS="$RENEW_CERTS -d $domain"
fi
done
if [ -n "$REQUEST_CERTS" ]; then
certbot certonly \
--standalone \ --standalone \
--preferred-challenges http \ --preferred-challenges http \
--http-01-port 2080 \ --http-01-port 2080 \
@ -13,5 +29,10 @@ certbot certonly \
--no-eff-email \ --no-eff-email \
--non-interactive \ --non-interactive \
--max-log-backups=0 \ --max-log-backups=0 \
--post-hook "/scripts/certbot_to_haproxy.sh && systemctl reload haproxy.service" --post-hook "/scripts/certbot_to_haproxy.sh" \
-d dev.globalnetguide.com -d other.domain.com --email info@xpto.us $REQUEST_CERTS --email info@xpto.us
fi
if [ -n "$RENEW_CERTS" ]; then
certbot renew --post-hook "/scripts/certbot_to_haproxy.sh"
fi

2
assets/scripts/certbot_to_haproxy.sh
View file

@ -9,3 +9,5 @@ for CERTIFICATE in `find /etc/letsencrypt/live/* -type d`; do
# Combine certificate and private key to single file # Combine certificate and private key to single file
cat /etc/letsencrypt/live/$CERTIFICATE/fullchain.pem /etc/letsencrypt/live/$CERTIFICATE/privkey.pem > /etc/haproxy/certs/$CERTIFICATE.pem cat /etc/letsencrypt/live/$CERTIFICATE/fullchain.pem /etc/letsencrypt/live/$CERTIFICATE/privkey.pem > /etc/haproxy/certs/$CERTIFICATE.pem
done done
/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf $(cat /run/haproxy.pid) &

50
easymapping/__init__.py
View file

@ -42,11 +42,10 @@ class DockerLabelHandler:
class HaproxyConfigGenerator: class HaproxyConfigGenerator:
def __init__(self, mapping, ssl_cert_folder="/etc/haproxy/certs"): def __init__(self, mapping, ssl_cert_folder="/etc/haproxy/certs/discover"):
self.mapping = mapping self.mapping = mapping
self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy") self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy")
self.ssl_cert_folder = ssl_cert_folder self.ssl_cert_folder = ssl_cert_folder
self.ssl_cert_increment = 0
self.letsencrypt_hosts = [] self.letsencrypt_hosts = []
os.makedirs(self.ssl_cert_folder, exist_ok=True) os.makedirs(self.ssl_cert_folder, exist_ok=True)
@ -112,16 +111,8 @@ class HaproxyConfigGenerator:
) )
self.letsencrypt_hosts.append(d[host_label]) if letsencrypt and d[host_label] not in self.letsencrypt_hosts else self.letsencrypt_hosts self.letsencrypt_hosts.append(d[host_label]) if letsencrypt and d[host_label] not in self.letsencrypt_hosts else self.letsencrypt_hosts
hash = "" if port not in easymapping:
if self.label.create([definition, "sslcert"]) in d: easymapping[port] = {
hash = hashlib.md5(
d[self.label.create([definition, "sslcert"])].encode('utf-8')
).hexdigest()
key = port if not hash else port + "_" + hash
if key not in easymapping:
easymapping[key] = {
"mode": mode, "mode": mode,
"health-check": "", "health-check": "",
"port": port, "port": port,
@ -135,25 +126,38 @@ class HaproxyConfigGenerator:
"80" "80"
) )
easymapping[key]["health-check"] = self.label.get( easymapping[port]["health-check"] = self.label.get(
self.label.create([definition, "health-check"]), self.label.create([definition, "health-check"]),
"" ""
) )
easymapping[key]["hosts"].setdefault(d[host_label], {}) easymapping[port]["hosts"].setdefault(d[host_label], {})
easymapping[key]["hosts"][d[host_label]].setdefault("containers", []) easymapping[port]["hosts"][d[host_label]].setdefault("containers", [])
easymapping[key]["hosts"][d[host_label]].setdefault("letsencrypt", False) easymapping[port]["hosts"][d[host_label]].setdefault("letsencrypt", False)
easymapping[key]["hosts"][d[host_label]]["containers"] += ["{}:{}".format(container, ct_port)] easymapping[port]["hosts"][d[host_label]]["containers"] += ["{}:{}".format(container, ct_port)]
easymapping[key]["hosts"][d[host_label]]["letsencrypt"] = letsencrypt easymapping[port]["hosts"][d[host_label]]["letsencrypt"] = letsencrypt
if letsencrypt:
if "443" not in easymapping:
easymapping["443"] = {
"mode": "http",
"health-check": "ssl",
"port": "443",
"hosts": dict(),
"redirect": dict(),
}
easymapping["443"]["hosts"][d[host_label]] = dict(easymapping[port]["hosts"][d[host_label]])
easymapping["443"]["hosts"][d[host_label]]["letsencrypt"] = False
# handle SSL # handle SSL
ssl_label = self.label.create([definition, "sslcert"]) ssl_label = self.label.create([definition, "sslcert"])
if self.label.has_label(ssl_label): if self.label.has_label(ssl_label):
self.ssl_cert_increment += 1 filename = "{}/{}.pem".format(
filename = "{}/{}.{}.pem".format( self.ssl_cert_folder, d[host_label]
self.ssl_cert_folder, d[host_label], str(self.ssl_cert_increment)
) )
easymapping[key]["ssl_cert"] = filename easymapping[port]["ssl_cert"] = filename
with open(filename, 'wb') as file: with open(filename, 'wb') as file:
file.write( file.write(
base64.b64decode(d[ssl_label]) base64.b64decode(d[ssl_label])
@ -166,6 +170,6 @@ class HaproxyConfigGenerator:
if len(redirect) > 0: if len(redirect) > 0:
for r in redirect.split(","): for r in redirect.split(","):
r_parts = r.split("--") r_parts = r.split("--")
easymapping[key]["redirect"][r_parts[0]] = r_parts[1] easymapping[port]["redirect"][r_parts[0]] = r_parts[1]
return easymapping.values() return easymapping.values()

16
examples/docker/docker-compose.yml
View file

File diff suppressed because one or more lines are too long

2
templates/bind.j2
View file

@ -1,5 +1,5 @@
{% if "ssl_cert" in o %} {% if "ssl_cert" in o %}
bind *:{{ o["port"] }} ssl crt {{ o["ssl_cert"] }} bind *:{{ o["port"] }} ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
{% elif "h2" in o and o["h2"] %} {% elif "h2" in o and o["h2"] %}
bind *:{{ o["port"] }} proto h2 bind *:{{ o["port"] }} proto h2
option http-use-htx option http-use-htx

2
templates/frontend-mode-http.j2
View file

@ -4,7 +4,7 @@
{% endfor %} {% endfor %}
{%- for k in o["hosts"] %} {%- for k in o["hosts"] %}
{% set host = k.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) %} {% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
{% set letsencrypt = o["hosts"][k]["letsencrypt"] %} {% set letsencrypt = o["hosts"][k]["letsencrypt"] %}
acl is_rule_{{ host }}_1 hdr(host) -i {{ k }} acl is_rule_{{ host }}_1 hdr(host) -i {{ k }}

2
templates/frontend-mode-tcp.j2
View file

@ -2,5 +2,5 @@
option tcplog option tcplog
log global log global
{% set backend = (o["hosts"]|first) %} {% set backend = (o["hosts"]|first) %}
default_backend srv_{{ backend.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) }} default_backend srv_{{ backend.replace(".", "_") + "_{0}".format(o["port"]) }}

6
templates/haproxy.cfg.j2
View file

@ -39,9 +39,8 @@ backend srv_stats
{% endif %} {% endif %}
{% for o in data["easymapping"] -%} {% for o in data["easymapping"] -%}
{% set mode = o["mode"] or "http" %} {% set mode = o["mode"] or "http" %}
{% set salt = loop.index %}
frontend {{ mode }}_in_{{ o["port"] }}_{{ salt }} frontend {{ mode }}_in_{{ o["port"] }}
{% include "bind.j2" %} {% include "bind.j2" %}
{% if mode == "http" %} {% if mode == "http" %}
{% include "frontend-mode-http.j2" %} {% include "frontend-mode-http.j2" %}
@ -50,7 +49,7 @@ frontend {{ mode }}_in_{{ o["port"] }}_{{ salt }}
{% endif %} {% endif %}
{% for k in o["hosts"] -%} {% for k in o["hosts"] -%}
{% set host = k.replace(".", "_") + "_{0}_{1}".format(o["port"], salt) %} {% set host = k.replace(".", "_") + "_{0}".format(o["port"]) %}
backend srv_{{ host }} backend srv_{{ host }}
balance roundrobin balance roundrobin
mode {{ mode }} mode {{ mode }}
@ -69,4 +68,5 @@ backend srv_{{ host }}
{% endfor %} {% endfor %}
backend letsencrypt_backend backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

1
tests/expected/no-services.txt
View file

@ -12,4 +12,5 @@ defaults
backend letsencrypt_backend backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

11
tests/expected/services-multi-containers.txt
View file

@ -11,15 +11,15 @@ defaults
timeout server 10m timeout server 10m
frontend http_in_19901_1 frontend http_in_19901
bind *:19901 bind *:19901
mode http mode http
acl is_rule_www_helloworld_com_19901_1_1 hdr(host) -i www.helloworld.com acl is_rule_www_helloworld_com_19901_1 hdr(host) -i www.helloworld.com
acl is_rule_www_helloworld_com_19901_1_2 hdr(host) -i www.helloworld.com:19901 acl is_rule_www_helloworld_com_19901_2 hdr(host) -i www.helloworld.com:19901
use_backend srv_www_helloworld_com_19901_1 if is_rule_www_helloworld_com_19901_1_1 OR is_rule_www_helloworld_com_19901_1_2 use_backend srv_www_helloworld_com_19901 if is_rule_www_helloworld_com_19901_1 OR is_rule_www_helloworld_com_19901_2
backend srv_www_helloworld_com_19901_1 backend srv_www_helloworld_com_19901
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
@ -29,4 +29,5 @@ backend srv_www_helloworld_com_19901_1
server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1 server srv-1 test_nginx.1.p552hqxkdx88narjrp5kouwb2:80 check weight 1
backend letsencrypt_backend backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

7
tests/expected/services-tcp.txt
View file

@ -11,14 +11,14 @@ defaults
timeout server 10m timeout server 10m
frontend tcp_in_31339_1 frontend tcp_in_31339
bind *:31339 bind *:31339
mode tcp mode tcp
option tcplog option tcplog
log global log global
default_backend srv_agent_quantum_local_31339_1 default_backend srv_agent_quantum_local_31339
backend srv_agent_quantum_local_31339_1 backend srv_agent_quantum_local_31339
balance roundrobin balance roundrobin
mode tcp mode tcp
option tcp-check option tcp-check
@ -26,4 +26,5 @@ backend srv_agent_quantum_local_31339_1
server srv-0 test_agent:9001 check weight 1 verify none server srv-0 test_agent:9001 check weight 1 verify none
backend letsencrypt_backend backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

92
tests/expected/services.txt
View file

@ -11,42 +11,42 @@ defaults
timeout server 10m timeout server 10m
frontend tcp_in_31339_1 frontend tcp_in_31339
bind *:31339 bind *:31339
mode tcp mode tcp
option tcplog option tcplog
log global log global
default_backend srv_agent_quantum_example_org_31339_1 default_backend srv_agent_quantum_example_org_31339
backend srv_agent_quantum_example_org_31339_1 backend srv_agent_quantum_example_org_31339
balance roundrobin balance roundrobin
mode tcp mode tcp
option tcp-check option tcp-check
tcp-check connect tcp-check connect
server srv-0 my-stack_agent:9001 check weight 1 server srv-0 my-stack_agent:9001 check weight 1
frontend http_in_31337_2 frontend http_in_31337
bind *:31337 bind *:31337
mode http mode http
acl is_rule_cadvisor_quantum_example_org_31337_2_1 hdr(host) -i cadvisor.quantum.example.org acl is_rule_cadvisor_quantum_example_org_31337_1 hdr(host) -i cadvisor.quantum.example.org
acl is_rule_cadvisor_quantum_example_org_31337_2_2 hdr(host) -i cadvisor.quantum.example.org:31337 acl is_rule_cadvisor_quantum_example_org_31337_2 hdr(host) -i cadvisor.quantum.example.org:31337
use_backend srv_cadvisor_quantum_example_org_31337_2 if is_rule_cadvisor_quantum_example_org_31337_2_1 OR is_rule_cadvisor_quantum_example_org_31337_2_2 use_backend srv_cadvisor_quantum_example_org_31337 if is_rule_cadvisor_quantum_example_org_31337_1 OR is_rule_cadvisor_quantum_example_org_31337_2
acl is_rule_node-exporter_quantum_example_org_31337_2_1 hdr(host) -i node-exporter.quantum.example.org acl is_rule_node-exporter_quantum_example_org_31337_1 hdr(host) -i node-exporter.quantum.example.org
acl is_rule_node-exporter_quantum_example_org_31337_2_2 hdr(host) -i node-exporter.quantum.example.org:31337 acl is_rule_node-exporter_quantum_example_org_31337_2 hdr(host) -i node-exporter.quantum.example.org:31337
acl is_letsencrypt_node-exporter_quantum_example_org_31337_2 path_beg /.well-known/acme-challenge/ acl is_letsencrypt_node-exporter_quantum_example_org_31337 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337_2 is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337_2 is_rule_node-exporter_quantum_example_org_31337_2_2 use_backend letsencrypt_backend if is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_1 OR is_letsencrypt_node-exporter_quantum_example_org_31337 is_rule_node-exporter_quantum_example_org_31337_2
use_backend srv_node-exporter_quantum_example_org_31337_2 if is_rule_node-exporter_quantum_example_org_31337_2_1 OR is_rule_node-exporter_quantum_example_org_31337_2_2 use_backend srv_node-exporter_quantum_example_org_31337 if is_rule_node-exporter_quantum_example_org_31337_1 OR is_rule_node-exporter_quantum_example_org_31337_2
backend srv_cadvisor_quantum_example_org_31337_2 backend srv_cadvisor_quantum_example_org_31337
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
http-request set-header X-Forwarded-Port %[dst_port] http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 my-stack_cadvisor:8080 check weight 1 server srv-0 my-stack_cadvisor:8080 check weight 1
backend srv_node-exporter_quantum_example_org_31337_2 backend srv_node-exporter_quantum_example_org_31337
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
@ -54,7 +54,39 @@ backend srv_node-exporter_quantum_example_org_31337_2
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 my-stack_node-exporter:9100 check weight 1 server srv-0 my-stack_node-exporter:9100 check weight 1
frontend http_in_80_3 frontend http_in_443
bind *:443 ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
acl is_rule_node-exporter_quantum_example_org_443_1 hdr(host) -i node-exporter.quantum.example.org
acl is_rule_node-exporter_quantum_example_org_443_2 hdr(host) -i node-exporter.quantum.example.org:443
use_backend srv_node-exporter_quantum_example_org_443 if is_rule_node-exporter_quantum_example_org_443_1 OR is_rule_node-exporter_quantum_example_org_443_2
acl is_rule_www_somehost_com_br_443_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_443_2 hdr(host) -i www.somehost.com.br:443
use_backend srv_www_somehost_com_br_443 if is_rule_www_somehost_com_br_443_1 OR is_rule_www_somehost_com_br_443_2
backend srv_node-exporter_quantum_example_org_443
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 my-stack_node-exporter:9100 check weight 1
backend srv_www_somehost_com_br_443
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 some-service:80 check weight 1
frontend http_in_80
bind *:80 bind *:80
mode http mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
@ -63,32 +95,11 @@ frontend http_in_80_3
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca } redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
acl is_rule_www_somehost_com_br_80_3_1 hdr(host) -i www.somehost.com.br acl is_rule_www_somehost_com_br_80_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_80_3_2 hdr(host) -i www.somehost.com.br:80 acl is_rule_www_somehost_com_br_80_2 hdr(host) -i www.somehost.com.br:80
use_backend srv_www_somehost_com_br_80_3 if is_rule_www_somehost_com_br_80_3_1 OR is_rule_www_somehost_com_br_80_3_2 use_backend srv_www_somehost_com_br_80 if is_rule_www_somehost_com_br_80_1 OR is_rule_www_somehost_com_br_80_2
backend srv_www_somehost_com_br_80_3 backend srv_www_somehost_com_br_80
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 some-service:80 check weight 1
frontend http_in_443_4
bind *:443 ssl crt /tmp/www.somehost.com.br.1.pem
mode http
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.somehost.com }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i byjg.ca }
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i www.byjg.ca }
acl is_rule_www_somehost_com_br_443_4_1 hdr(host) -i www.somehost.com.br
acl is_rule_www_somehost_com_br_443_4_2 hdr(host) -i www.somehost.com.br:443
use_backend srv_www_somehost_com_br_443_4 if is_rule_www_somehost_com_br_443_4_1 OR is_rule_www_somehost_com_br_443_4_2
backend srv_www_somehost_com_br_443_4
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
@ -97,4 +108,5 @@ backend srv_www_somehost_com_br_443_4
server srv-0 some-service:80 check weight 1 server srv-0 some-service:80 check weight 1
backend letsencrypt_backend backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

45
tests/expected/static.txt
View file

@ -34,29 +34,29 @@ backend srv_stats
mode http mode http
server Local 127.0.0.1:1936 server Local 127.0.0.1:1936
frontend http_in_80_1 frontend http_in_80
bind *:80 bind *:80
mode http mode http
redirect prefix http://host1.com.br code 301 if { hdr(host) -i www.host1.com.br } redirect prefix http://host1.com.br code 301 if { hdr(host) -i www.host1.com.br }
acl is_rule_host1_com_br_80_1_1 hdr(host) -i host1.com.br acl is_rule_host1_com_br_80_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_80_1_2 hdr(host) -i host1.com.br:80 acl is_rule_host1_com_br_80_2 hdr(host) -i host1.com.br:80
acl is_letsencrypt_host1_com_br_80_1 path_beg /.well-known/acme-challenge/ acl is_letsencrypt_host1_com_br_80 path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80_1 is_rule_host1_com_br_80_1_1 OR is_letsencrypt_host1_com_br_80_1 is_rule_host1_com_br_80_1_2 use_backend letsencrypt_backend if is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_1 OR is_letsencrypt_host1_com_br_80 is_rule_host1_com_br_80_2
use_backend srv_host1_com_br_80_1 if is_rule_host1_com_br_80_1_1 OR is_rule_host1_com_br_80_1_2 use_backend srv_host1_com_br_80 if is_rule_host1_com_br_80_1 OR is_rule_host1_com_br_80_2
acl is_rule_host2_com_br_80_1_1 hdr(host) -i host2.com.br acl is_rule_host2_com_br_80_1 hdr(host) -i host2.com.br
acl is_rule_host2_com_br_80_1_2 hdr(host) -i host2.com.br:80 acl is_rule_host2_com_br_80_2 hdr(host) -i host2.com.br:80
use_backend srv_host2_com_br_80_1 if is_rule_host2_com_br_80_1_1 OR is_rule_host2_com_br_80_1_2 use_backend srv_host2_com_br_80 if is_rule_host2_com_br_80_1 OR is_rule_host2_com_br_80_2
backend srv_host1_com_br_80_1 backend srv_host1_com_br_80
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
http-request set-header X-Forwarded-Port %[dst_port] http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 container:5000 check weight 1 server srv-0 container:5000 check weight 1
backend srv_host2_com_br_80_1 backend srv_host2_com_br_80
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
@ -64,15 +64,15 @@ backend srv_host2_com_br_80_1
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 other:3000 check weight 1 server srv-0 other:3000 check weight 1
frontend http_in_443_2 frontend http_in_443
bind *:443 ssl crt /etc/haproxy/certs/mycert.pem bind *:443 ssl crt /etc/haproxy/certs/discover/ crt /etc/haproxy/certs/
mode http mode http
acl is_rule_host1_com_br_443_2_1 hdr(host) -i host1.com.br acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
acl is_rule_host1_com_br_443_2_2 hdr(host) -i host1.com.br:443 acl is_rule_host1_com_br_443_2 hdr(host) -i host1.com.br:443
use_backend srv_host1_com_br_443_2 if is_rule_host1_com_br_443_2_1 OR is_rule_host1_com_br_443_2_2 use_backend srv_host1_com_br_443 if is_rule_host1_com_br_443_1 OR is_rule_host1_com_br_443_2
backend srv_host1_com_br_443_2 backend srv_host1_com_br_443
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
@ -80,15 +80,15 @@ backend srv_host1_com_br_443_2
http-request add-header X-Forwarded-Proto https if { ssl_fc } http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 container:80 check weight 1 server srv-0 container:80 check weight 1
frontend http_in_8080_3 frontend http_in_8080
bind *:8080 bind *:8080
mode http mode http
acl is_rule_host3_com_br_8080_3_1 hdr(host) -i host3.com.br acl is_rule_host3_com_br_8080_1 hdr(host) -i host3.com.br
acl is_rule_host3_com_br_8080_3_2 hdr(host) -i host3.com.br:8080 acl is_rule_host3_com_br_8080_2 hdr(host) -i host3.com.br:8080
use_backend srv_host3_com_br_8080_3 if is_rule_host3_com_br_8080_3_1 OR is_rule_host3_com_br_8080_3_2 use_backend srv_host3_com_br_8080 if is_rule_host3_com_br_8080_1 OR is_rule_host3_com_br_8080_2
backend srv_host3_com_br_8080_3 backend srv_host3_com_br_8080
balance roundrobin balance roundrobin
mode http mode http
option forwardfor option forwardfor
@ -97,4 +97,5 @@ backend srv_host3_com_br_8080_3
server srv-0 domain:8181 check weight 1 server srv-0 domain:8181 check weight 1
backend letsencrypt_backend backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080 server certbot 127.0.0.1:2080

68
tests/test_parser.py
View file

@ -19,7 +19,7 @@ def test_parser_doesnt_crash():
"customerrors": False "customerrors": False
} }
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp") cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list) haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0 assert len(haproxy_config) > 0
@ -35,11 +35,11 @@ def test_parser_finds_services():
"customerrors": False "customerrors": False
} }
cert_file = "/tmp/www.somehost.com.br.1.pem" cert_file = "/tmp/certs/www.somehost.com.br.pem"
if os.path.exists(cert_file): if os.path.exists(cert_file):
os.remove(cert_file) os.remove(cert_file)
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp") cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list) haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0 assert len(haproxy_config) > 0
@ -60,11 +60,11 @@ def test_parser_finds_services_changed_label():
"lookup_label": "haproxy" "lookup_label": "haproxy"
} }
cert_file = "/tmp/www.somehost.com.br.1.pem" cert_file = "/tmp/certs/www.somehost.com.br.pem"
if os.path.exists(cert_file): if os.path.exists(cert_file):
os.remove(cert_file) os.remove(cert_file)
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp") cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list) haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0 assert len(haproxy_config) > 0
@ -84,11 +84,11 @@ def test_parser_finds_services_raw():
"customerrors": False "customerrors": False
} }
cert_file = "/tmp/www.somehost.com.br.1.pem" cert_file = "/tmp/certs/www.somehost.com.br.pem"
if os.path.exists(cert_file): if os.path.exists(cert_file):
os.remove(cert_file) os.remove(cert_file)
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp") cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
parsed_object = [ parsed_object = [
{ {
@ -129,6 +129,33 @@ def test_parser_finds_services_raw():
} }
}, },
{
"mode":"http",
"health-check":"",
"port":"443",
"hosts":{
"node-exporter.quantum.example.org": {
"containers": [
"my-stack_node-exporter:9100"
],
"letsencrypt": False
},
"www.somehost.com.br":{
"containers": [
"some-service:80"
],
"letsencrypt": False
}
},
"redirect":{
"somehost.com.br":"https://www.somehost.com.br",
"somehost.com":"https://www.somehost.com.br",
"www.somehost.com":"https://www.somehost.com.br",
"byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br"
},
"ssl_cert":"/tmp/certs/www.somehost.com.br.pem"
},
{ {
"mode":"http", "mode":"http",
"health-check":"", "health-check":"",
@ -148,27 +175,6 @@ def test_parser_finds_services_raw():
"byjg.ca":"https://www.somehost.com.br", "byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br" "www.byjg.ca":"https://www.somehost.com.br"
} }
},
{
"mode":"http",
"health-check":"",
"port":"443",
"hosts":{
"www.somehost.com.br":{
"containers": [
"some-service:80"
],
"letsencrypt": False
}
},
"redirect":{
"somehost.com.br":"https://www.somehost.com.br",
"somehost.com":"https://www.somehost.com.br",
"www.somehost.com":"https://www.somehost.com.br",
"byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br"
},
"ssl_cert":"/tmp/www.somehost.com.br.1.pem"
} }
] ]
@ -184,7 +190,7 @@ def test_parser_static():
with open(path + "/fixtures/static.yml", 'r') as content_file: with open(path + "/fixtures/static.yml", 'r') as content_file:
parsed = yaml.load(content_file.read(), Loader=yaml.FullLoader) parsed = yaml.load(content_file.read(), Loader=yaml.FullLoader)
cfg = easymapping.HaproxyConfigGenerator(parsed, "/tmp") cfg = easymapping.HaproxyConfigGenerator(parsed, "/tmp/certs")
haproxy_config = cfg.generate() haproxy_config = cfg.generate()
assert len(haproxy_config) > 0 assert len(haproxy_config) > 0
@ -259,7 +265,7 @@ def test_parser_tcp():
"customerrors": False "customerrors": False
} }
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp") cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list) haproxy_config = cfg.generate(line_list)
# print(haproxy_config) # print(haproxy_config)
@ -276,7 +282,7 @@ def test_parser_multi_containers():
"customerrors": False "customerrors": False
} }
cfg = easymapping.HaproxyConfigGenerator(result, "/tmp") cfg = easymapping.HaproxyConfigGenerator(result, "/tmp/certs")
haproxy_config = cfg.generate(line_list) haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0 assert len(haproxy_config) > 0