Skip to content

Commit 1b3c53f

Browse files
thomasjpfanthomasjpfan
committed
ENH: HTTPS support without HTTP
DFP can now listen to HTTPS without needing listen to HTTP
1 parent 9f6cf0c commit 1b3c53f

4 files changed

Lines changed: 57 additions & 40 deletions

File tree

‎actions/reconfigure_test.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -160,14 +160,14 @@ backend myService-be2222_1
160160
mode http
161161
http-request add-header X-Forwarded-Proto https if { ssl_fc }
162162
server myService myService:2222
163-
backend https-myService-be1111_0
163+
backend https-myService-be3333_0
164164
mode http
165165
http-request add-header X-Forwarded-Proto https if { ssl_fc }
166166
server myService myService:3333
167167
acl myServiceUsersAcl http_auth(myServiceUsers)
168168
http-request auth realm myServiceRealm if !myServiceUsersAcl
169169
http-request del-header Authorization
170-
backend https-myService-be2222_1
170+
backend https-myService-be3333_1
171171
mode http
172172
http-request add-header X-Forwarded-Proto https if { ssl_fc }
173173
server myService myService:3333`
@@ -262,7 +262,7 @@ backend myService-be1234_2
262262
acl valid_allowed_method method GET DELETE
263263
http-request deny unless valid_allowed_method
264264
server myService myService:1234
265-
backend https-myService-be1234_2
265+
backend https-myService-be4321_2
266266
mode http
267267
http-request add-header X-Forwarded-Proto https if { ssl_fc }
268268
acl valid_allowed_method method GET DELETE
@@ -286,7 +286,7 @@ backend myService-be1234_5
286286
acl valid_denied_method method GET DELETE
287287
http-request deny if valid_denied_method
288288
server myService myService:1234
289-
backend https-myService-be1234_5
289+
backend https-myService-be4321_5
290290
mode http
291291
http-request add-header X-Forwarded-Proto https if { ssl_fc }
292292
acl valid_denied_method method GET DELETE
@@ -309,7 +309,7 @@ backend myService-be1234_32
309309
http-request add-header X-Forwarded-Proto https if { ssl_fc }
310310
http-request deny if !{ ssl_fc }
311311
server myService myService:1234
312-
backend https-myService-be1234_32
312+
backend https-myService-be4321_32
313313
mode http
314314
http-request add-header X-Forwarded-Proto https if { ssl_fc }
315315
server myService myService:4321`
@@ -370,7 +370,7 @@ backend myService-be1234_3
370370
mode http
371371
http-request add-header X-Forwarded-Proto https if { ssl_fc }
372372
server myService myService:1234
373-
backend https-myService-be1234_3
373+
backend https-myService-be4321_3
374374
mode http
375375
http-request add-header X-Forwarded-Proto https if { ssl_fc }
376376
server myService myService:4321`
@@ -389,7 +389,7 @@ backend myService-be1234_0
389389
mode http
390390
http-request add-header X-Forwarded-Proto https if { ssl_fc }
391391
server-template myService 7 myService:1234 check
392-
backend https-myService-be1234_0
392+
backend https-myService-be4321_0
393393
mode http
394394
http-request add-header X-Forwarded-Proto https if { ssl_fc }
395395
server-template myService 7 myService:4321 check`
@@ -421,7 +421,7 @@ backend myService-be1234_0
421421
mode http
422422
http-request add-header X-Forwarded-Proto https if { ssl_fc }
423423
server-template myService 3 myService:1234 check
424-
backend https-myService-be1234_0
424+
backend https-myService-be4321_0
425425
mode http
426426
http-request add-header X-Forwarded-Proto https if { ssl_fc }
427427
server-template myService 3 myService:4321 check`
@@ -462,7 +462,7 @@ backend myService-be1234_1
462462
mode http
463463
http-request add-header X-Forwarded-Proto https if { ssl_fc }
464464
server myService acme.com:1234
465-
backend https-myService-be1234_1
465+
backend https-myService-be4321_1
466466
mode http
467467
http-request add-header X-Forwarded-Proto https if { ssl_fc }
468468
server myService acme.com:4321`
@@ -750,7 +750,7 @@ backend my-service-be1111_0
750750
cookie my-service insert indirect nocache
751751
server my-service_0 1.2.3.4:1111 check cookie my-service_0
752752
server my-service_1 4.3.2.1:1111 check cookie my-service_1
753-
backend https-my-service-be1111_0
753+
backend https-my-service-be2222_0
754754
mode http
755755
http-request add-header X-Forwarded-Proto https if { ssl_fc }
756756
balance roundrobin

‎docs/config.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ The following environment variables can be used to configure the *Docker Flow Pr
1111

1212
|Variable |Description |
1313
|-------------------|----------------------------------------------------------|
14-
|BIND_PORTS |Ports to bind in addition to `80` and `443`. Multiple values can be separated with comma. If a port is specified with the `srcPort` reconfigure parameter, it is not required to specify it in this environment variable. Those values will be used as default ports used for services that do not specify `srcPort`. Please note that all binded ports need to be published on the service level (usually defined in a Compose stack file). If a port should be for SSL connections, append it with `:ssl`. Additional binding options can be added after a port. For example, `80 accept-proxy,443 accept-proxy:ssl` adds `accept-proxy` to the defalt binding options.<br>**Example:** `8085,8086:ssl`|
14+
|BIND_PORTS |Ports to bind in addition to `80` and `443`. Multiple values can be separated with comma. If a port is specified with the `srcPort` reconfigure parameter, it is not required to specify it in this environment variable for `tcp` and `sni` mode. In `http` mode, this environment variable **is** required. Those values will be used as default ports used for services that do not specify `srcPort`. Please note that all binded ports need to be published on the service level (usually defined in a Compose stack file). If a port should be for SSL connections, append it with `:ssl`. Additional binding options can be added after a port. For example, `80 accept-proxy,443 accept-proxy:ssl` adds `accept-proxy` to the defalt binding options.<br>**Example:** `8085,8086:ssl`|
1515
|CA_FILE |Path to a PEM file from which to load CA certificates that will be used to verify client's certificate. Preferably, the file should be provided as a Docker secret.<br>**Example:** /run/secrets/ca-file|
1616
|CAPTURE_REQUEST_HEADER|Allows capturing specific request headers. This feature is useful if debugging is enabled (e.g. `DEBUG=true`) and the format is customized with `DEBUG_HTTP_FORMAT` or `DEBUG_TCP_FORMAT` to output headers. Header name and lenght in bytes must be separated with colon (e.g. `Host:15`). Multiple headers should be separated with colon (e.g. `Host:15,X-Forwarded-For:20`).<br>**Example:** `Host:15,X-Forwarded-For:20,Referer:15`|
1717
|CFG_TEMPLATE_PATH |Path to the configuration template. The path can be absolute (starting with `/`) or relative to `/cfg/tmpl`.<br>**Default value:** `/cfg/tmpl/haproxy.tmpl`|

‎proxy/ha_proxy_test.go‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -794,10 +794,12 @@ func (s HaProxyTestSuite) Test_CreateConfigFromTemplates_AddsServicePathExclude(
794794
`%s
795795
acl url_my-service-11111_0 path_beg /path-1
796796
acl url_exclude_my-service-11111_0 path_beg /path-2 path_beg /path-3
797+
acl url_https_my-service-12222_0 path_beg /path-1
798+
acl url_exclude_https_my-service-12222_0 path_beg /path-2 path_beg /path-3
797799
acl srcPort_my-service-180_0 dst_port 80
798800
acl srcHttpsPort_my-service-1443_0 dst_port 443
799801
use_backend my-service-1-be1111_0 if url_my-service-11111_0 !url_exclude_my-service-11111_0 srcPort_my-service-180_0
800-
use_backend https-my-service-1-be1111_0 if url_my-service-11111_0 !url_exclude_my-service-11111_0 srcHttpsPort_my-service-1443_0%s`,
802+
use_backend https-my-service-1-be2222_0 if url_https_my-service-12222_0 !url_exclude_https_my-service-12222_0 srcHttpsPort_my-service-1443_0%s`,
801803
tmpl,
802804
s.ServicesContent,
803805
)
@@ -1651,8 +1653,8 @@ func (s HaProxyTestSuite) Test_CreateConfigFromTemplates_AddsDomainsForEachServi
16511653
acl url_my-service1111_1 path_beg /path
16521654
acl domain_my-service1111_1 hdr_beg(host) -i domain-1-1.com domain-1-2.com
16531655
acl url_my-service2222_45 path_beg /path
1654-
acl srcPort_my-service4321_45 dst_port 4321
16551656
acl domain_my-service2222_45 hdr_beg(host) -i domain-2-1.com domain-2-2.com
1657+
acl srcPort_my-service4321_45 dst_port 4321
16561658
use_backend my-service-be1111_1 if url_my-service1111_1 domain_my-service1111_1
16571659
use_backend my-service-be2222_45 if url_my-service2222_45 domain_my-service2222_45 srcPort_my-service4321_45%s`,
16581660
tmpl,
@@ -1808,7 +1810,9 @@ func (s HaProxyTestSuite) Test_CreateConfigFromTemplates_AddsContentFrontEndWith
18081810
tmpl := s.TemplateContent
18091811
expectedData := fmt.Sprintf(
18101812
`%s
1811-
acl domain_my-service_0 hdr_end(host) -i domain-1%s`,
1813+
acl url_my-service8080_0
1814+
acl domain_my-service8080_0 hdr_end(host) -i domain-1
1815+
use_backend my-service-be8080_0 if url_my-service8080_0 domain_my-service8080_0%s`,
18121816
tmpl,
18131817
s.ServicesContent,
18141818
)
@@ -1820,7 +1824,8 @@ func (s HaProxyTestSuite) Test_CreateConfigFromTemplates_AddsContentFrontEndWith
18201824
service1 := Service{
18211825
ServiceName: "my-service",
18221826
ServiceDest: []ServiceDest{
1823-
{ServiceDomain: []string{"*domain-1"}},
1827+
{ServiceDomain: []string{"*domain-1"},
1828+
Port: "8080"},
18241829
},
18251830
}
18261831
p.AddService(service1)
@@ -1836,10 +1841,11 @@ func (s HaProxyTestSuite) Test_CreateConfigFromTemplates_AddsContentFrontEndWith
18361841
expectedData := fmt.Sprintf(
18371842
`%s
18381843
acl url_my-service1111_0 path_beg /path
1844+
acl url_https_my-service2222_0 path_beg /path
18391845
acl srcPort_my-service80_0 dst_port 80
18401846
acl srcHttpsPort_my-service443_0 dst_port 443
18411847
use_backend my-service-be1111_0 if url_my-service1111_0 srcPort_my-service80_0
1842-
use_backend https-my-service-be1111_0 if url_my-service1111_0 srcHttpsPort_my-service443_0%s`,
1848+
use_backend https-my-service-be2222_0 if url_https_my-service2222_0 srcHttpsPort_my-service443_0%s`,
18431849
tmpl,
18441850
s.ServicesContent,
18451851
)
@@ -1870,10 +1876,11 @@ func (s HaProxyTestSuite) Test_CreateConfigFromTemplates_AddsContentFrontEndWith
18701876
expectedData := fmt.Sprintf(
18711877
`%s
18721878
acl url_my-service1111_0 path_beg /path
1879+
acl url_https_my-service2222_0 path_beg /path
18731880
acl srcPort_my-service8080_0 dst_port 8080
18741881
acl srcHttpsPort_my-service443_0 dst_port 443
18751882
use_backend my-service-be1111_0 if url_my-service1111_0 srcPort_my-service8080_0
1876-
use_backend https-my-service-be1111_0 if url_my-service1111_0 srcHttpsPort_my-service443_0%s`,
1883+
use_backend https-my-service-be2222_0 if url_https_my-service2222_0 srcHttpsPort_my-service443_0%s`,
18771884
tmpl,
18781885
s.ServicesContent,
18791886
)

‎proxy/template.go‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,28 @@ func getFrontTemplate(s Service) string {
1919
compression type {{$.CompressionType}}
2020
{{- end}}
2121
{{- end}}
22-
{{- if ne .Port ""}}
23-
acl url_{{$.AclName}}{{.Port}}_{{.Index}}{{range .ServicePath}} {{if eq $.PathType ""}}path_beg{{end}}{{if ne $.PathType ""}}{{$.PathType}}{{end}} {{.}}{{end}}
22+
{{- if ne $sd.Port ""}}
23+
acl url_{{$.AclName}}{{$sd.Port}}_{{.Index}}{{range .ServicePath}} {{if eq $.PathType ""}}path_beg{{end}}{{if ne $.PathType ""}}{{$.PathType}}{{end}} {{.}}{{end}}
24+
{{- if .ServicePathExclude}}
25+
acl url_exclude_{{$.AclName}}{{$sd.Port}}_{{.Index}}{{range .ServicePathExclude}} {{if eq $.PathType ""}}path_beg{{end}}{{if ne $.PathType ""}}{{$.PathType}}{{end}} {{.}}{{end}}
26+
{{- end}}
27+
{{- if $sd.ServiceDomain}}
28+
acl domain_{{$.AclName}}{{$sd.Port}}_{{$sd.Index}} {{$.ServiceDomainAlgo}} -i{{range $sd.ServiceDomain}} {{.}}{{end}}
29+
{{- end}}
30+
{{- if $sd.ServiceHeader}}{{$skIndex := 0}}
31+
{{- range $key, $value := $sd.ServiceHeader}}
32+
acl hdr_{{$.AclName}}{{$sd.Port}}_{{incIndex}} hdr({{$key}}) {{$value}}
33+
{{- end}}
34+
{{- end}}
2435
{{- end}}
25-
{{- if .ServicePathExclude}}
26-
acl url_exclude_{{$.AclName}}{{.Port}}_{{.Index}}{{range .ServicePathExclude}} {{if eq $.PathType ""}}path_beg{{end}}{{if ne $.PathType ""}}{{$.PathType}}{{end}} {{.}}{{end}}
36+
{{- if gt $sd.HttpsPort 0}}
37+
acl url_https_{{$.AclName}}{{$sd.HttpsPort}}_{{.Index}}{{range .ServicePath}} {{if eq $.PathType ""}}path_beg{{end}}{{if ne $.PathType ""}}{{$.PathType}}{{end}} {{.}}{{end}}
38+
{{- if .ServicePathExclude}}
39+
acl url_exclude_https_{{$.AclName}}{{$sd.HttpsPort}}_{{.Index}}{{range .ServicePathExclude}} {{if eq $.PathType ""}}path_beg{{end}}{{if ne $.PathType ""}}{{$.PathType}}{{end}} {{.}}{{end}}
40+
{{- end}}
41+
{{- if $sd.ServiceDomain}}
42+
acl domain_https_{{$.AclName}}{{$sd.HttpsPort}}_{{$sd.Index}} {{$.ServiceDomainAlgo}} -i{{range $sd.ServiceDomain}} {{.}}{{end}}
43+
{{- end}}
2744
{{- end}}
2845
{{- if $sd.IncludeSrcPortACL }}
2946
{{$sd.SrcPortAcl}}
@@ -35,14 +52,6 @@ func getFrontTemplate(s Service) string {
3552
acl user_agent_{{$.AclName}}_{{.UserAgent.AclName}}_{{.Index}} hdr_sub(User-Agent) -i{{range .UserAgent.Value}} {{.}}{{end}}
3653
{{- end}}
3754
{{- end}}
38-
{{- if .ServiceDomain}}
39-
acl domain_{{$.AclName}}{{.Port}}_{{.Index}} {{$.ServiceDomainAlgo}} -i{{range .ServiceDomain}} {{.}}{{end}}
40-
{{- end}}
41-
{{- if .ServiceHeader}}{{$skIndex := 0}}
42-
{{- range $key, $value := .ServiceHeader}}
43-
acl hdr_{{$.AclName}}{{$sd.Port}}_{{incIndex}} hdr({{$key}}) {{$value}}
44-
{{- end}}
45-
{{- end}}
4655
{{- range $rd := $sd.RedirectFromDomain}}
4756
http-request redirect code 301 prefix http://{{index $sd.ServiceDomain 0}} if { hdr_beg(host) -i {{$rd}} }
4857
{{- end}}
@@ -58,16 +67,17 @@ func getFrontTemplate(s Service) string {
5867
{{- end}}
5968
{{- end}}
6069
{{- range $sd := .ServiceDest}}
61-
{{- if eq .ReqMode "http"}}{{- if ne .Port ""}}
62-
use_backend {{$.AclName}}-be{{.Port}}_{{.Index}} if url_{{$.AclName}}{{.Port}}_{{.Index}}{{if .ServicePathExclude}} !url_exclude_{{$.AclName}}{{.Port}}_{{.Index}}{{end}}{{if .ServiceDomain}} domain_{{$.AclName}}{{.Port}}_{{.Index}}{{end}}{{if .ServiceHeader}}{{resetIndex}}{{range $key, $value := .ServiceHeader}} hdr_{{$.AclName}}{{$sd.Port}}_{{incIndex}}{{end}}{{end}}{{.SrcPortAclName}}
63-
{{- if gt $sd.HttpsPort 0 }}
64-
use_backend https-{{$.AclName}}-be{{.Port}}_{{.Index}} if url_{{$.AclName}}{{.Port}}_{{.Index}}{{if .ServicePathExclude}} !url_exclude_{{$.AclName}}{{.Port}}_{{.Index}}{{end}}{{if .ServiceDomain}} domain_{{$.AclName}}{{.Port}}_{{.Index}}{{end}}{{.SrcHttpsPortAclName}}
65-
{{- end}}
66-
{{- $length := len .UserAgent.Value}}{{if gt $length 0}} user_agent_{{$.AclName}}_{{.UserAgent.AclName}}_{{.Index}}{{end}}
67-
{{- if $.IsDefaultBackend}}
70+
{{- if eq .ReqMode "http" }}
71+
{{- if ne .Port ""}}
72+
use_backend {{$.AclName}}-be{{.Port}}_{{.Index}} if url_{{$.AclName}}{{.Port}}_{{.Index}}{{if .ServicePathExclude}} !url_exclude_{{$.AclName}}{{.Port}}_{{.Index}}{{end}}{{if .ServiceDomain}} domain_{{$.AclName}}{{.Port}}_{{.Index}}{{end}}{{if .ServiceHeader}}{{resetIndex}}{{range $key, $value := .ServiceHeader}} hdr_{{$.AclName}}{{$sd.Port}}_{{incIndex}}{{end}}{{end}}{{.SrcPortAclName}}{{ $length := len .UserAgent.Value}}{{if gt $length 0}} user_agent_{{$.AclName}}_{{.UserAgent.AclName}}_{{.Index}}{{end}}
73+
{{- if $.IsDefaultBackend}}
6874
default_backend {{$.AclName}}-be{{.Port}}_{{$sd.Index}}
75+
{{- end}}
76+
{{- end }}
77+
{{- if gt $sd.HttpsPort 0 }}
78+
use_backend https-{{$.AclName}}-be{{.HttpsPort}}_{{.Index}} if url_https_{{$.AclName}}{{.HttpsPort}}_{{.Index}}{{if .ServicePathExclude}} !url_exclude_https_{{$.AclName}}{{.HttpsPort}}_{{.Index}}{{end}}{{if .ServiceDomain}} domain_https{{$.AclName}}{{.HttpsPort}}_{{.Index}}{{end}}{{.SrcHttpsPortAclName}}{{ $length := len .UserAgent.Value}}{{if gt $length 0}} user_agent_{{$.AclName}}_{{.UserAgent.AclName}}_{{.Index}}{{end}}
6979
{{- end}}
70-
{{- end}}{{- end}}
80+
{{- end}}
7181
{{- end}}`
7282
return templateToString(tmplString, s)
7383
}
@@ -300,7 +310,7 @@ backend {{$.AclName}}-be{{$sd.Port}}_{{.Index}}
300310
{{- end}}
301311
{{- range $sd := .ServiceDest}}
302312
{{- if gt $sd.HttpsPort 0}}
303-
backend https-{{$.AclName}}-be{{.Port}}_{{.Index}}
313+
backend https-{{$.AclName}}-be{{.HttpsPort}}_{{.Index}}
304314
mode {{.ReqModeFormatted}}
305315
{{- if eq .ReqModeFormatted "http"}}
306316
http-request add-header X-Forwarded-Proto https if { ssl_fc }
@@ -323,8 +333,8 @@ backend https-{{$.AclName}}-be{{.Port}}_{{.Index}}
323333
http-request set-path %[path,regsub({{.}})]
324334
{{- end}}
325335
{{- if eq .VerifyClientSsl true}}
326-
acl valid_client_cert_{{$.ServiceName}}{{.Port}} ssl_c_used ssl_c_verify 0
327-
http-request deny unless valid_client_cert_{{$.ServiceName}}{{.Port}}
336+
acl valid_client_cert_{{$.ServiceName}}{{.HttpsPort}} ssl_c_used ssl_c_verify 0
337+
http-request deny unless valid_client_cert_{{$.ServiceName}}{{.HttpsPort}}
328338
{{- end}}
329339
{{- if .AllowedMethods}}
330340
acl valid_allowed_method method{{range .AllowedMethods}} {{.}}{{end}}

0 commit comments

Comments
 (0)