badblocks/docker-easy-haproxy
1
0
Fork 0
Code Activity

Merge pull request #35 from byjg/issues

Browse source 
Issues
This commit is contained in:
Joao M 2023-02-08 21:39:25 -06:00 • committed by GitHub
commit d2a0c248fa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 173 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

16
.vscode/launch.json vendored
View file

@ -4,6 +4,22 @@
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
"version": "0.2.0",
"configurations": [
{
"name": "PyTest Current File",
"type": "python",
"request": "launch",
"module": "pytest",
"justMyCode": true,
"console": "integratedTerminal",
"cwd": "${workspaceFolder}/src",
"args": [
"-vv",
"${file}"
],
"env": {
"PYTHONPATH": "${cwd}/src"
}
},
{
"name": "Python: Current File",
"type": "python",

6
.vscode/settings.json vendored Normal file
View file

@ -0,0 +1,6 @@
{
"cSpell.words": [
"certonly",
"letsencrypt"
]
}

29
docs/docker-environment.md
View file

@ -1,19 +1,20 @@
# Docker environment variables
| Environment Variable | Description | Default |
|-------------------------------|-------------------------------------------------------------------------------------------------|------------------|
| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | *empty* |
| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`|
| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` |
| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` |
| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |
| Environment Variable | Description | Default |
|---------------------------------|-------------------------------------------------------------------------------------------------|------------------|
| EASYHAPROXY_DISCOVER | How the services will be discovered to create `haproxy.cfg`: `static`, `docker`, `swarm` or `kubernetes` | **required** |
| EASYHAPROXY_LABEL_PREFIX | (Optional) The key will search for matching resources. | `easyhaproxy` |
| EASYHAPROXY_LETSENCRYPT_EMAIL | (Optional) The email will be used to request the certificate to Letsencrypt | *empty* |
| EASYHAPROXY_LETSENCRYPT_SERVER | (Optional) Can be `staging` or 'schema://domain.tld'. If set, will try to connect to the Letsencrypt test server | *empty* |
| EASYHAPROXY_SSL_MODE | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`|
| EASYHAPROXY_REFRESH_CONF | (Optional) Check configuration every N seconds. | 10 |
| EASYHAPROXY_LOG_LEVEL | (Optional) The log level for EasyHAproxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| CERTBOT_LOG_LEVEL | (Optional) The log level for Certbot messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_LOG_LEVEL | (Optional) The log level for HAProxy messages. Available: TRACE,DEBUG,INFO,WARN,ERROR,FATAL | DEBUG |
| HAPROXY_USERNAME | (Optional) The HAProxy username to the statistics. | `admin` |
| HAPROXY_PASSWORD | (Optional) The HAProxy password to the statistics. If not set, statistics will be available with no password | *empty* |
| HAPROXY_STATS_PORT | (Optional) The HAProxy port to the statistics. If set to `false`, disable statistics | `1936` |
| HAPROXY_CUSTOMERRORS | (Optional) If HAProxy will use custom HTML errors. true/false. | `false` |

1
docs/docker.md
View file

@ -5,6 +5,7 @@
This method will use a docker standalone installation to discover the containers and configure the HAProxy.
The only requirement is that containers and EasyHAProxy must be in the same docker network.
If not, EasyHAProxy will connect the container with the EasyHAProxy network.
e.g.:

1
docs/swarm.md
View file

@ -6,6 +6,7 @@ This method will use a docker swarm installation to discover the containers and
The advantage of this method is that you can discover containers in other nodes from the cluster.
The only requirement is that containers and EasyHAProxy must be in the same docker swarm network.
If not, EasyHAProxy will connect the service with the EasyHAProxy service network.
e.g.:

2
examples/docker/docker-compose.yml
View file

@ -13,7 +13,7 @@
# location: https://host1.local/
#
# Test SSL:
# openssl s_client -showcerts -connect 127.0.0.1:443 --servername host1.local
# openssl s_client -showcerts -connect 127.0.0.1:443 -servername host1.local
version: "3"

2
examples/swarm/docker-compose.yml
View file

@ -13,7 +13,7 @@
# location: https://host1.local/
#
# Test SSL:
# openssl s_client -showcerts -connect 127.0.0.1:443 --servername host1.local
# openssl s_client -showcerts -connect 127.0.0.1:443 -servername host1.local
version: "3"

2
src/easymapping/__init__.py
View file

@ -49,7 +49,7 @@ class HaproxyConfigGenerator:
def __init__(self, mapping):
self.mapping = mapping
self.mapping.setdefault("ssl_mode", 'default')
self.mapping.setdefault("letsencrypt", {"email": ""})
self.mapping.setdefault("letsencrypt", {"email": "", "staging": False})
self.mapping["ssl_mode"] = self.mapping["ssl_mode"].lower()
self.label = DockerLabelHandler(mapping['lookup_label'] if 'lookup_label' in mapping else "easyhaproxy")
self.letsencrypt_hosts = []

19
src/functions/__init__.py
View file

@ -174,9 +174,18 @@ class DaemonizeHAProxy:
class Certbot:
def __init__(self, certs, email):
def __init__(self, certs, email, test_server):
self.certs = certs
self.email = email
self.test_server = self.set_test_server(test_server)
def set_test_server(self, test_server):
if test_server.lower() == "staging":
return "--staging"
elif test_server.lower().startswith("http"):
return "--server " + test_server
else:
return ""
def check_certificates(self, hosts):
if self.email == "" or len(hosts) == 0:
@ -201,7 +210,7 @@ class Certbot:
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Renew certificate for %s" % (host))
renew_certs.append(host_arg)
certbot_certonly = ('/usr/bin/certbot certonly '
certbot_certonly = ('/usr/bin/certbot certonly {test_server}'
' --standalone'
' --preferred-challenges http'
' --http-01-port 2080'
@ -210,7 +219,9 @@ class Certbot:
' --no-eff-email'
' --non-interactive'
' --max-log-backups=0'
' %s --email %s' % (' '.join(request_certs), self.email)
' {certs} --email {email}'.format(certs = ' '.join(request_certs),
email = self.email,
test_server = self.test_server)
)
ret_reload = False
@ -235,6 +246,8 @@ class Certbot:
def find_live_certificates(self):
letsencrypt_certs = "/etc/letsencrypt/live/"
if not os.path.exists(letsencrypt_certs):
return
for item in os.listdir(letsencrypt_certs):
path = os.path.join(letsencrypt_certs, item)
if os.path.isdir(path):

2
src/main.py
View file

@ -22,7 +22,7 @@ def start():
haproxy.haproxy("start")
haproxy.sleep()
certbot = Certbot(Consts.certs_letsencrypt, os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"))
certbot = Certbot(Consts.certs_letsencrypt, os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"), os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "").lower())
while True:
if old_haproxy is not None:

47
src/processor/__init__.py
View file

@ -6,6 +6,7 @@ import os
import json
import base64
import docker
import socket
from kubernetes import client, config
from kubernetes.client.rest import ApiException
@ -27,7 +28,8 @@ class ContainerEnv:
env_vars["lookup_label"] = os.getenv("EASYHAPROXY_LABEL_PREFIX") if os.getenv("EASYHAPROXY_LABEL_PREFIX") else "easyhaproxy"
if (os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL")):
env_vars["letsencrypt"] = {
"email": os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL")
"email": os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"),
"server": os.getenv("EASYHAPROXY_LETSENCRYPT_SERVER", "false").lower() in ["true", "1", "yes"]
}
return env_vars
@ -126,9 +128,25 @@ class Docker(ProcessorInterface):
super().__init__()
def inspect_network(self):
try:
ha_proxy_network_name = next(iter(self.client.containers.get(socket.gethostname()).attrs["NetworkSettings"]["Networks"]))
except:
# HAProxy is not running in a container, get first container network
if len(self.client.containers.list()) == 0:
return
ha_proxy_network_name = next(iter(self.client.containers.get(self.client.containers.list()[0].name).attrs["NetworkSettings"]["Networks"]))
ha_proxy_network = self.client.networks.get(ha_proxy_network_name)
self.parsed_object = {}
for container in self.client.containers.list():
self.parsed_object[container.name] = container.labels
# Issue 32 - Docker container cannot connect to containers in different network.
if ha_proxy_network_name not in container.attrs["NetworkSettings"]["Networks"].keys():
ha_proxy_network.connect(container.name)
container = self.client.containers.get(container.name) # refresh object
ip_address = container.attrs["NetworkSettings"]["Networks"][ha_proxy_network_name]["IPAddress"]
self.parsed_object[ip_address] = container.labels
class Swarm(ProcessorInterface):
@ -137,9 +155,28 @@ class Swarm(ProcessorInterface):
super().__init__()
def inspect_network(self):
ha_proxy_service_name = self.client.containers.get(socket.gethostname()).name.split('.')[0]
for endpoint in self.client.services.get(ha_proxy_service_name).attrs['Endpoint']["VirtualIPs"]:
ha_proxy_network_id = endpoint["NetworkID"]
if self.client.networks.get(ha_proxy_network_id).name != 'ingress':
break
self.parsed_object = {}
for container in self.client.services.list():
self.parsed_object[container.attrs["Spec"]["Name"]] = container.attrs["Spec"]["Labels"]
for service in self.client.services.list():
ip_address = None
network_list = []
for endpoint in service.attrs["Endpoint"]["VirtualIPs"]:
if ha_proxy_network_id == endpoint["NetworkID"]:
ip_address = endpoint["Addr"].split("/")[0]
break
network_list.append(endpoint["NetworkID"])
if ip_address is None:
network_list.append(ha_proxy_network_id)
service.update(networks = network_list)
continue # skip to the next service to give time to update the network
self.parsed_object[ip_address] = service.attrs["Spec"]["Labels"]
class Kubernetes(ProcessorInterface):
@ -162,6 +199,8 @@ class Kubernetes(ProcessorInterface):
self.parsed_object = {}
for ingress in ret.items:
if 'kubernetes.io/ingress.class' not in ingress.metadata.annotations:
continue
if ingress.metadata.annotations['kubernetes.io/ingress.class'] != "easyhaproxy-ingress":
continue

16
src/tests/test_containerenv.py
View file

@ -95,8 +95,24 @@ def test_container_env_stats_password():
"lookup_label": "easyhaproxy",
"letsencrypt": {
"email": "acme@example.org",
"server": False
}
} == ContainerEnv.read()
finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = ''
def test_container_env_letsencrypt():
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = 'acme@example.org'
os.environ['EASYHAPROXY_LETSENCRYPT_SERVER'] = 'true'
try:
assert {
"customerrors": False,
"ssl_mode": "default",
"lookup_label": "easyhaproxy",
"letsencrypt": {
"email": "acme@example.org",
"server": True
}
} == ContainerEnv.read()
finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = ''

84
src/tests/test_docker.py
View file

@ -6,15 +6,24 @@ from functions import Functions
from processor import ProcessorInterface
from processor import Docker
def _get_hydrated_object(parsed_objects, key):
assert key in parsed_objects.keys()
def _get_hydrated_object(parsed_objects, lookup_key):
hydrated_object = {}
for keys in parsed_objects[key]:
if "easyhaproxy" in keys:
hydrated_object[keys] = parsed_objects[key][keys]
for key in parsed_objects:
for keys in parsed_objects[key]:
if lookup_key in keys:
hydrated_object[keys] = parsed_objects[key][keys]
return hydrated_object
def _get_ip_host(parsed_objects, lookup_key):
hydrated_object = {}
for key in parsed_objects:
for keys in parsed_objects[key]:
if lookup_key in keys:
return key
def test_processor_docker():
try:
client = docker.from_env()
@ -25,31 +34,31 @@ def test_processor_docker():
pytest.skip("I cannot run this test with other containers running.")
container = client.containers.run("byjg/static-httpserver",
name="test_processor_docker",
detach=True,
auto_remove=True,
remove=True,
labels={
"easyhaproxy.http.port": "80",
"easyhaproxy.http.localport": "8080",
"easyhaproxy.http.host": "host1.local",
name="test_processor_docker",
detach=True,
auto_remove=True,
remove=True,
labels={
"easyhaproxy.http.port": "80",
"easyhaproxy.http.localport": "8080",
"easyhaproxy.http.host": "host1.local",
"easyhaproxy.http2.port": "90",
"easyhaproxy.http2.localport": "9000",
"easyhaproxy.http2.host": "host2.local",
"easyhaproxy.http2.letsencrypt": "true",
})
"easyhaproxy.http2.port": "90",
"easyhaproxy.http2.localport": "9000",
"easyhaproxy.http2.host": "host2.local",
"easyhaproxy.http2.letsencrypt": "true",
})
container2 = client.containers.run("byjg/static-httpserver",
name="test2_processor_docker",
detach=True,
auto_remove=True,
remove=True,
labels={
"easyhaproxy.ssl.port": "443",
"easyhaproxy.ssl.localport": "8080",
"easyhaproxy.ssl.host": "hostssl.local",
"easyhaproxy.ssl.sslcert": "U29tZSBQRU0gQ2VydGlmaWNhdGU="
})
name="test2_processor_docker",
detach=True,
auto_remove=True,
remove=True,
labels={
"easyhaproxy.ssl.port": "443",
"easyhaproxy.ssl.localport": "8080",
"easyhaproxy.ssl.host": "hostssl.local",
"easyhaproxy.ssl.sslcert": "U29tZSBQRU0gQ2VydGlmaWNhdGU="
})
try:
time.sleep(1)
@ -66,27 +75,34 @@ def test_processor_docker():
'easyhaproxy.http2.localport': '9000',
'easyhaproxy.http2.port': '90',
'easyhaproxy.http2.letsencrypt': 'true',
} == _get_hydrated_object(static.get_parsed_object(), "test_processor_docker")
} == _get_hydrated_object(static.get_parsed_object(), "easyhaproxy.http")
assert {
'easyhaproxy.ssl.host': 'hostssl.local',
'easyhaproxy.ssl.localport': '8080',
'easyhaproxy.ssl.port': '443',
'easyhaproxy.ssl.sslcert': 'U29tZSBQRU0gQ2VydGlmaWNhdGU='
} == _get_hydrated_object(static.get_parsed_object(), "test2_processor_docker")
} == _get_hydrated_object(static.get_parsed_object(), "easyhaproxy.ssl.")
assert static.get_hosts() is None
assert static.get_certs() == {}
haproxy_cfg = static.get_haproxy_conf()
assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/docker.txt"))
assert haproxy_cfg == Functions.load(os.path.join(os.path.dirname(os.path.realpath(__file__)), "./expected/docker.txt")).replace("test_processor_docker", _get_ip_host(
static.get_parsed_object(), "easyhaproxy.http")).replace("test2_processor_docker", _get_ip_host(static.get_parsed_object(), "easyhaproxy.ssl"))
assert static.get_letsencrypt_hosts() == ['host2.local']
assert static.get_hosts() == ['hostssl.local:443', 'host1.local:80', 'host2.local:90']
assert static.get_certs() == {'hostssl.local.pem': 'Some PEM Certificate'}
assert static.get_hosts() == [
'hostssl.local:443',
'host1.local:80',
'host2.local:90'
]
assert static.get_certs() == {
'hostssl.local.pem': 'Some PEM Certificate'
}
finally:
os.environ['EASYHAPROXY_LETSENCRYPT_EMAIL'] = ''
container.stop()
container2.stop()
#test_processor_docker()
# test_processor_docker()