4df8666a2b
- Introduced health checks to Docker Compose files for better service reliability. - Added ACME environment readiness validation to ensure proper configuration for Certbot. - Implemented unit tests for Certbot's `check_acme_environment_ready` method to cover edge cases. - Improved E2E tests with startup wait adjustments and dynamic certificate issuance verification. - Enhanced Kubernetes test cleanup with forced resource deletion for faster termination.
94 lines
2.9 KiB
YAML
94 lines
2.9 KiB
YAML
# ==============================================================================
|
|
# EXAMPLE: JWT Validator Plugin
|
|
# ==============================================================================
|
|
#
|
|
# WHAT THIS DEMONSTRATES:
|
|
# - JWT token validation for API protection
|
|
# - RS256 algorithm signature verification
|
|
# - Issuer and audience validation
|
|
# - Public key-based JWT verification
|
|
#
|
|
# REQUIREMENTS (run these first):
|
|
# ```bash
|
|
# # Generate SSL certificates and JWT keys (from project root)
|
|
# cd ../.. && ./tests_e2e/generate-keys.sh && cd tests_e2e/docker
|
|
# ```
|
|
#
|
|
# HOW TO START:
|
|
# ```bash
|
|
# docker compose -f docker-compose-jwt-validator.yml up -d
|
|
# ```
|
|
#
|
|
# HOW TO VERIFY IT'S WORKING:
|
|
# ```bash
|
|
# # Test without token (should fail)
|
|
# curl -k -H "Host: api.local" http://127.0.0.1/
|
|
# # Expected: HTTP 403 - Missing Authorization HTTP header
|
|
#
|
|
# # Generate test JWT at https://jwt.io with:
|
|
# # - Algorithm: RS256
|
|
# # - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
|
|
# # - Paste contents of jwt_private.pem in private key field
|
|
#
|
|
# # Test with valid token
|
|
# TOKEN="eyJhbGc..." # Replace with your generated token
|
|
# curl -k -H "Host: host1.local" -H "Authorization: Bearer $TOKEN" http://api.local/
|
|
# # Expected: 200 OK with API response
|
|
#
|
|
# # View HAProxy stats
|
|
# # URL: http://localhost:1936
|
|
# # Username: admin
|
|
# # Password: password
|
|
# ```
|
|
#
|
|
# CLEAN UP:
|
|
# ```bash
|
|
# docker compose -f docker-compose-jwt-validator.yml down
|
|
# ```
|
|
#
|
|
# ==============================================================================
|
|
|
|
services:
|
|
haproxy:
|
|
build:
|
|
context: ../..
|
|
dockerfile: build/Dockerfile
|
|
image: byjg/easy-haproxy:local
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
# Mount the public key for JWT verification
|
|
- ./jwt_pubkey.pem:/etc/easyhaproxy/jwt_keys/api_pubkey.pem:ro
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "-u", "admin:password", "http://localhost:1936"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
start_period: 30s
|
|
retries: 3
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: docker
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "1936:1936/tcp"
|
|
|
|
# API service protected by JWT
|
|
api:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Protected API - JWT Required"
|
|
labels:
|
|
easyhaproxy.http.host: api.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# Enable JWT validator plugin
|
|
easyhaproxy.http.plugins: jwt_validator
|
|
|
|
# JWT validator configuration
|
|
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
|
|
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
|
|
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
|
|
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/easyhaproxy/jwt_keys/api_pubkey.pem
|