b9a9bee0b9
- Consolidated and simplified Swarm example README to focus on YAML header comments for documentation. - Removed redundant and extended sections, replacing with concise steps for getting started. - Standardized YAML headers across `easyhaproxy.yml`, `services.yml`, and `portainer.yml` with a clearer and more readable format. - Enhanced user guidance for deployment, setup requirements, verification, and cleanup.
89 lines
2.8 KiB
YAML
89 lines
2.8 KiB
YAML
# ==============================================================================
|
|
# EXAMPLE: JWT Validator Plugin
|
|
# ==============================================================================
|
|
#
|
|
# WHAT THIS DEMONSTRATES:
|
|
# - JWT token validation for API protection
|
|
# - RS256 algorithm signature verification
|
|
# - Issuer and audience validation
|
|
# - Public key-based JWT verification
|
|
#
|
|
# REQUIREMENTS (run these first):
|
|
# ```bash
|
|
# # Generate RSA key pair (idempotent - skips if exists)
|
|
# [ -f jwt_private.pem ] || openssl genrsa -out jwt_private.pem 2048
|
|
# [ -f jwt_pubkey.pem ] || openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
|
|
#
|
|
# # Add to /etc/hosts (idempotent)
|
|
# grep -q "api.local" /etc/hosts || echo "127.0.0.1 api.local" | sudo tee -a /etc/hosts
|
|
# ```
|
|
#
|
|
# HOW TO START:
|
|
# ```bash
|
|
# docker compose -f docker-compose-jwt-validator.yml up -d
|
|
# ```
|
|
#
|
|
# HOW TO VERIFY IT'S WORKING:
|
|
# ```bash
|
|
# # Test without token (should fail)
|
|
# curl http://api.local/
|
|
# # Expected: HTTP 403 - Missing Authorization HTTP header
|
|
#
|
|
# # Generate test JWT at https://jwt.io with:
|
|
# # - Algorithm: RS256
|
|
# # - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
|
|
# # - Paste contents of jwt_private.pem in private key field
|
|
#
|
|
# # Test with valid token
|
|
# TOKEN="eyJhbGc..." # Replace with your generated token
|
|
# curl -H "Authorization: Bearer $TOKEN" http://api.local/
|
|
# # Expected: 200 OK with API response
|
|
#
|
|
# # View HAProxy stats
|
|
# # URL: http://localhost:1936
|
|
# # Username: admin
|
|
# # Password: password
|
|
# ```
|
|
#
|
|
# CLEAN UP:
|
|
# ```bash
|
|
# docker compose -f docker-compose-jwt-validator.yml down
|
|
# ```
|
|
#
|
|
# ==============================================================================
|
|
|
|
services:
|
|
haproxy:
|
|
image: byjg/easy-haproxy:4.6.0
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
# Mount the public key for JWT verification
|
|
- ./jwt_pubkey.pem:/etc/haproxy/jwt_keys/api_pubkey.pem:ro
|
|
environment:
|
|
EASYHAPROXY_DISCOVER: docker
|
|
HAPROXY_CUSTOMERRORS: "true"
|
|
HAPROXY_USERNAME: admin
|
|
HAPROXY_PASSWORD: password
|
|
HAPROXY_STATS_PORT: 1936
|
|
ports:
|
|
- "80:80/tcp"
|
|
- "1936:1936/tcp"
|
|
|
|
# API service protected by JWT
|
|
api:
|
|
image: byjg/static-httpserver
|
|
environment:
|
|
TITLE: "Protected API - JWT Required"
|
|
labels:
|
|
easyhaproxy.http.host: api.local
|
|
easyhaproxy.http.port: 80
|
|
easyhaproxy.http.localport: 8080
|
|
|
|
# Enable JWT validator plugin
|
|
easyhaproxy.http.plugins: jwt_validator
|
|
|
|
# JWT validator configuration
|
|
easyhaproxy.http.plugin.jwt_validator.algorithm: RS256
|
|
easyhaproxy.http.plugin.jwt_validator.issuer: https://auth.example.com/
|
|
easyhaproxy.http.plugin.jwt_validator.audience: https://api.example.com
|
|
easyhaproxy.http.plugin.jwt_validator.pubkey_path: /etc/haproxy/jwt_keys/api_pubkey.pem
|