d3637e737a
- Replaced `config.yml` with modular configuration examples: `config-basic.yml`, `config-certbot.yml`, `config-deny-pages.yml`, and `config-jwt-validator.yml`. - Improved examples with detailed usage instructions, prerequisites, and testing steps for each configuration. - Fixed indentation and formatting inconsistencies across plugin files and HAProxy configuration generation. - Streamlined README comparison table for static vs. dynamic discovery. - Updated `docker-compose-jwt-validator.yml` to correct audience key formatting.
66 lines
2 KiB
YAML
66 lines
2 KiB
YAML
# JWT Validator Plugin Example
|
|
#
|
|
# This example demonstrates JWT token validation for API protection
|
|
#
|
|
# Prerequisites:
|
|
# 1. Generate RSA key pair:
|
|
# openssl genrsa -out jwt_private.pem 2048
|
|
# openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
|
|
#
|
|
# 2. Add to /etc/hosts:
|
|
# 127.0.0.1 api.local
|
|
#
|
|
# 3. Start the stack:
|
|
# docker compose -f docker-compose-jwt-validator.yml up -d
|
|
#
|
|
# 4. Test without token (should fail):
|
|
# curl http://api.local/
|
|
# # Response: Missing Authorization HTTP header
|
|
#
|
|
# 5. Generate test JWT at https://jwt.io with:
|
|
# - Algorithm: RS256
|
|
# - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
|
|
# - Use your jwt_private.pem for signing
|
|
#
|
|
# 6. Test with token:
|
|
# TOKEN="eyJhbGc..."
|
|
# curl -H "Authorization: Bearer $TOKEN" http://api.local/
|
|
# # Response: Success
|
|
|
|
version: "3"
|
|
|
|
services:
|
|
haproxy:
|
|
image: byjg/easy-haproxy:4.6.0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
# Mount the public key for JWT verification
|
|
- ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: docker
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "1936:1936/tcp"
|
|
|
|
# API service protected by JWT
|
|
api:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Protected API - JWT Required"
|
|
labels:
|
|
easyhaproxy.http.host: api.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# Enable JWT validator plugin
|
|
easyhaproxy.http.plugins: jwt_validator
|
|
|
|
# JWT validator configuration
|
|
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
|
|
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
|
|
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
|
|
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
|