badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Add redirect-ssl and different ssl_modes

Browse source
This commit is contained in:
Joao M 2022-08-16 16:39:51 +00:00
parent 567f810e09
commit b363abea8c
15 changed files with 265 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Dockerfile
View file

@ -13,6 +13,7 @@ RUN apk add --no-cache haproxy bash python3 py3-pip py-yaml supervisor docker ce
&& pip3 install --upgrade pip \
&& pip install -r requirements.txt \
&& pytest -s tests/ \
&& openssl dhparam -out /etc/haproxy/dhparam 2048
&& openssl dhparam -out /etc/haproxy/dhparam 2048 \
&& openssl dhparam -out /etc/haproxy/dhparam-1024 1024
CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf" ]

2
README.md
View file

@ -43,6 +43,7 @@ The environment variables will setup the HAProxy.
| EASYHAPROXY_DISCOVER | How `haproxy.cfg` will be created: `static`, `docker` or `swarm` |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search to match resources. Default: `easyhaproxy`. |
| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request certificate to letsencrypt |
| EASYHAPROXY_SSL_MODE | (Optional) `STRICT` supports only the most recent TLS version; `DEFAULT` good SSL integration with recent browsers; `LOOSE` support all old SSL protocols for old browsers (not recommended). |
| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. Default: `admin` |
| HAPROXY_PASSWORD | The HAProxy password to the statistics. If not set disable stats. |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. Default: `1936` |
@ -97,6 +98,7 @@ Important: easyhaproxy needs to be in the same network of the containers or othe
| easyhaproxy.[definition].sslcert | (Optional) Cert PEM Base64 encoded. Do not use this if letsencrypt is enabled. | |
| easyhaproxy.[definition].health-check | (Optional) `ssl`, enable health check via SSL in `mode tcp` (Defaults to "empty") | |
| easyhaproxy.[definition].letsencrypt | (Optional) Generate certificate with letsencrypt. Do not use with sslcert | true OR yes OR false OR no |
| easyhaproxy.[definition].redirect-ssl | (Optional) Redirect all requests to https | true OR yes OR false OR no |
### Defining the labels in Docker Swarm

3
assets/scripts/swarm.py
View file

@ -5,7 +5,8 @@ with open("/tmp/.docker_data", 'r') as content_file:
line_list = content_file.readlines()
result = {
"customerrors": True if os.getenv("HAPROXY_CUSTOMERRORS") == "true" else False
"customerrors": True if os.getenv("HAPROXY_CUSTOMERRORS") == "true" else False,
"ssl_mode": os.getenv("EASYHAPROXY_SSL_MODE", "default")
}
if os.getenv("HAPROXY_PASSWORD"):

6
easymapping/__init__.py
View file

@ -48,6 +48,8 @@ class DockerLabelHandler:
class HaproxyConfigGenerator:
def __init__(self, mapping, ssl_cert_folder="/etc/haproxy/certs/discover"):
self.mapping = mapping
self.mapping.setdefault("ssl_mode", 'default')
self.mapping["ssl_mode"] = self.mapping["ssl_mode"].lower()
self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy")
self.ssl_cert_folder = ssl_cert_folder
self.letsencrypt_hosts = []
@ -142,6 +144,10 @@ class HaproxyConfigGenerator:
easymapping[port]["hosts"][hostname].setdefault("letsencrypt", False)
easymapping[port]["hosts"][hostname]["containers"] += ["{}:{}".format(container, ct_port)]
easymapping[port]["hosts"][hostname]["letsencrypt"] = letsencrypt
easymapping[port]["hosts"][hostname]["redirect_ssl"] = self.label.get_bool(
self.label.create([definition, "redirect_ssl"])
)
easymapping[port]["redirect"] = self.label.get_json(
self.label.create([definition, "redirect"])
)

20
examples/docker/docker-compose.yml
View file

@ -1,8 +1,19 @@
# To test:
# curl -k -H "Host: host1.local" https://127.0.0.1/
# curl -k -H "Host: host2.local" https://127.0.0.1/
#
# or add to /etc/hosts
# 127.0.0.1 host1.local
# curl -I -H Host:host1.local http://127.0.0.1
# HTTP/1.1 301 Moved Permanently
# content-length: 0
# location: https://host1.local/
#
# curl -I -H Host:host2.local http://127.0.0.1
# HTTP/1.1 200 OK
# accept-ranges: bytes
# content-length: 3276
# content-type: text/html; charset=utf-8
# last-modified: Tue, 16 Aug 2022 15:48:05 GMT
# date: Tue, 16 Aug 2022 16:36:35 GMT
#
# Test SSL:
# openssl s_client -showcerts -connect 127.0.0.1:443 --servername host1.local
@ -16,6 +27,7 @@ services:
- /var/run/docker.sock:/var/run/docker.sock
environment:
EASYHAPROXY_DISCOVER: docker
EASYHAPROXY_SSL_MODE: "loose"
HAPROXY_CUSTOMERRORS: "true"
HAPROXY_USERNAME: admin
HAPROXY_PASSWORD: password
@ -29,7 +41,7 @@ services:
container:
image: byjg/static-httpserver
labels:
easyhaproxy.http.redirect: host1.local--https://host1.local
easyhaproxy.http.redirect_ssl: true
easyhaproxy.http.host: host1.local
easyhaproxy.http.port: 80
@ -41,8 +53,8 @@ services:
container2:
image: byjg/static-httpserver
labels:
easyhaproxy.http.redirect: host2.local--https://host2.local
easyhaproxy.http.host: host2.local
easyhaproxy.http.localport: 8080
easyhaproxy.http.port: 80
easyhaproxy.https.port: 443

4
templates/frontend-mode-http.j2
View file

@ -13,5 +13,9 @@
acl is_letsencrypt_{{ host }} path_beg /.well-known/acme-challenge/
use_backend letsencrypt_backend if is_letsencrypt_{{ host }} is_rule_{{ host }}_1 OR is_letsencrypt_{{ host }} is_rule_{{ host }}_2
{% endif %}
{% if o["hosts"][k]["redirect_ssl"] %}
http-request redirect scheme https code 301 if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2
{% else %}
use_backend srv_{{ host }} if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2
{% endif %}
{% endfor %}

18
templates/haproxy.cfg.j2
View file

@ -1,18 +1,14 @@
global
log stdout format raw local0 info
maxconn 2000
tune.ssl.default-dh-param 2048
{% if data["ssl_mode"] == "strict" %}
{% include "ssl_strict.j2" %}
{% elif data["ssl_mode"] == "loose" %}
{% include "ssl_loose.j2" %}
{% else %}
{% include "ssl_default.j2" %}
{% endif %}
# intermediate configuration
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-dh-param-file /etc/haproxy/dhparam
defaults
log global

12
templates/ssl_default.j2 Normal file
View file

@ -0,0 +1,12 @@
tune.ssl.default-dh-param 2048
# intermediate configuration
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-dh-param-file /etc/haproxy/dhparam

10
templates/ssl_loose.j2 Normal file
View file

@ -0,0 +1,10 @@
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options no-sslv3 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tls-tickets
ssl-dh-param-file /etc/haproxy/dhparam-1024

7
templates/ssl_strict.j2 Normal file
View file

@ -0,0 +1,7 @@
# modern configuration
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets

81
tests/expected/services-redirect-ssl.txt Normal file
View file

@ -0,0 +1,81 @@
global
log stdout format raw local0 info
maxconn 2000
tune.ssl.default-dh-param 2048
# intermediate configuration
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-dh-param-file /etc/haproxy/dhparam
defaults
log global
timeout connect 3s
timeout client 10s
timeout server 10m
frontend http_in_80
bind *:80
mode http
acl is_rule_host2_local_80_1 hdr(host) -i host2.local
acl is_rule_host2_local_80_2 hdr(host) -i host2.local:80
use_backend srv_host2_local_80 if is_rule_host2_local_80_1 OR is_rule_host2_local_80_2
acl is_rule_host1_local_80_1 hdr(host) -i host1.local
acl is_rule_host1_local_80_2 hdr(host) -i host1.local:80
http-request redirect scheme https code 301 if is_rule_host1_local_80_1 OR is_rule_host1_local_80_2
backend srv_host2_local_80
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 b18a88da403b:8080 check weight 1
backend srv_host1_local_80
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 78a90f5c2d8a:80 check weight 1
frontend http_in_443
bind *:443 ssl crt /etc/haproxy/certs/discover/ alpn http/1.1 crt /etc/haproxy/certs/ alpn http/1.1
mode http
acl is_rule_host2_local_443_1 hdr(host) -i host2.local
acl is_rule_host2_local_443_2 hdr(host) -i host2.local:443
use_backend srv_host2_local_443 if is_rule_host2_local_443_1 OR is_rule_host2_local_443_2
acl is_rule_host1_local_443_1 hdr(host) -i host1.local
acl is_rule_host1_local_443_2 hdr(host) -i host1.local:443
use_backend srv_host1_local_443 if is_rule_host1_local_443_1 OR is_rule_host1_local_443_2
backend srv_host2_local_443
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 b18a88da403b:8080 check weight 1
backend srv_host1_local_443
balance roundrobin
mode http
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server srv-0 78a90f5c2d8a:8080 check weight 1
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

25
tests/expected/ssl-loose.txt Normal file
View file

@ -0,0 +1,25 @@
global
log stdout format raw local0 info
maxconn 2000
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options no-sslv3 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tls-tickets
ssl-dh-param-file /etc/haproxy/dhparam-1024
defaults
log global
timeout connect 3s
timeout client 10s
timeout server 10m
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

22
tests/expected/ssl-strict.txt Normal file
View file

@ -0,0 +1,22 @@
global
log stdout format raw local0 info
maxconn 2000
# modern configuration
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
defaults
log global
timeout connect 3s
timeout client 10s
timeout server 10m
backend letsencrypt_backend
mode http
server certbot 127.0.0.1:2080

3
tests/fixtures/services-redirect-ssl vendored Normal file
View file

File diff suppressed because one or more lines are too long

74
tests/test_parser.py
View file

@ -103,7 +103,8 @@ def test_parser_finds_services_raw():
"containers": [
"my-stack_agent:9001"
],
"letsencrypt": False
"letsencrypt": False,
"redirect_ssl": False
}
},
"redirect":{
@ -119,18 +120,20 @@ def test_parser_finds_services_raw():
"containers": [
"my-stack_cadvisor:8080"
],
"letsencrypt": False
"letsencrypt": False,
"redirect_ssl": False
},
"node-exporter.quantum.example.org":{
"containers": [
"my-stack_node-exporter:9100"
],
"letsencrypt": True
"letsencrypt": True,
"redirect_ssl": False
}
},
"redirect":{
}
},
},
{
"mode":"http",
@ -141,13 +144,15 @@ def test_parser_finds_services_raw():
"containers": [
"my-stack_node-exporter:9100"
],
"letsencrypt": False
"letsencrypt": False,
"redirect_ssl": False
},
"www.somehost.com.br":{
"containers": [
"some-service:80"
],
"letsencrypt": False
"letsencrypt": False,
"redirect_ssl": False
}
},
"redirect":{
@ -168,7 +173,8 @@ def test_parser_finds_services_raw():
"containers": [
"some-service:80"
],
"letsencrypt": False
"letsencrypt": False,
"redirect_ssl": False
}
},
"redirect":{
@ -177,7 +183,7 @@ def test_parser_finds_services_raw():
"www.somehost.com":"https://www.somehost.com.br",
"byjg.ca":"https://www.somehost.com.br",
"www.byjg.ca":"https://www.somehost.com.br"
}
},
}
]
@ -317,6 +323,58 @@ def test_parser_multiple_hosts():
assert [] == cfg.letsencrypt_hosts
def test_parser_redirect_ssl():
line_list = load_fixture("services-redirect-ssl")
result = {
"customerrors": False
}
cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER)
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0
path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/services-redirect-ssl.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts
def test_parser_ssl_strict():
line_list = load_fixture("no-services")
result = {
"customerrors": False,
"ssl_mode": "strict"
}
cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER)
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0
path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/ssl-strict.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts
def test_parser_ssl_loose():
line_list = load_fixture("no-services")
result = {
"customerrors": False,
"ssl_mode": "loose"
}
cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER)
haproxy_config = cfg.generate(line_list)
assert len(haproxy_config) > 0
path = os.path.dirname(os.path.realpath(__file__))
with open(path + "/expected/ssl-loose.txt", 'r') as expected_file:
assert expected_file.read() == haproxy_config
assert [] == cfg.letsencrypt_hosts
#test_parser_finds_services_raw()
#test_parser_tcp()
#test_parser_multiple_hosts()