Merge branch 'master' of https://github.com/vfarcic/docker-flow-proxy

Author: mhaamann

Dockerfile

@@ -6,8 +6,7 @@ RUN go test --cover ./... --run UnitTest
 RUN go build -v -o docker-flow-proxy
 
 
-
-FROM haproxy:1.7-alpine
+FROM haproxy:1.8-alpine
 MAINTAINER 	Viktor Farcic <viktor@farcic.com>
 
 RUN mkdir /lib64 && ln -s /lib/libc.musl-x86_64.so.1 /lib64/ld-linux-x86-64.so.2
@@ -22,6 +21,7 @@ ENV CERTS="" \
     DEFAULT_PORTS="80,443:ssl" \
     DEFAULT_REQ_MODE="http" \
     DO_NOT_RESOLVE_ADDR="false" \
+    ENABLE_H2="true" \
     HEALTHCHECK="true" \
     HTTPS_ONLY="false" \
     EXTRA_FRONTEND="" \

Jenkinsfile

@@ -42,6 +42,7 @@ pipeline {
         sh "docker image push vfarcic/docker-flow-proxy:${currentBuild.displayName}-packet-beat"
         dockerLogout()
         dfRelease("docker-flow-proxy")
+        dfReleaseGithub("docker-flow-proxy")
       }
     }
     stage("deploy") {

actions/reconfigure.go

@@ -1,14 +1,15 @@
 package actions
 
 import (
-	"../proxy"
 	"bytes"
 	"fmt"
 	"html/template"
 	"os"
 	"strconv"
 	"strings"
 	"sync"
+
+	"../proxy"
 )
 
 const serviceTemplateFeFilename = "service-formatted-fe.ctmpl"

actions/reconfigure_test.go

@@ -398,19 +398,26 @@ backend myService-be5555_2
 	s.Equal(expectedBack, actualBack)
 }
 
-func (s ReconfigureTestSuite) Test_GetTemplates_AddsHttpRequestSetPath_WhenReqPathSearchAndReqPathReplaceArePresent() {
-	s.reconfigure.ReqPathSearch = "this"
-	s.reconfigure.ReqPathReplace = "that"
-	s.reconfigure.ServiceDest = []proxy.ServiceDest{{Port: "1234", Index: 0}}
-	expected := fmt.Sprintf(`
+func (s ReconfigureTestSuite) Test_GetTemplates_AddsHttpRequestSetPath_WhenReqPathSearchReplaceFormattedIsPresent() {
+	s.reconfigure.HttpsPort = 1234
+	s.reconfigure.ServiceDest = []proxy.ServiceDest{{
+		Port:  "1234",
+		Index: 0,
+		ReqPathSearchReplaceFormatted: []string{"this,that", "foo,bar"},
+	}}
+	expected := `
 backend myService-be1234_0
     mode http
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
-    http-request set-path %%[path,regsub(%s,%s)]
-    server myService myService:1234`,
-		s.reconfigure.ReqPathSearch,
-		s.reconfigure.ReqPathReplace,
-	)
+    http-request set-path %[path,regsub(this,that)]
+    http-request set-path %[path,regsub(foo,bar)]
+    server myService myService:1234
+backend https-myService-be1234_0
+    mode http
+    http-request add-header X-Forwarded-Proto https if { ssl_fc }
+    http-request set-path %[path,regsub(this,that)]
+    http-request set-path %[path,regsub(foo,bar)]
+    server myService myService:1234`
 
 	_, backend, _ := s.reconfigure.GetTemplates()
 

docs/certs.md

@@ -178,7 +178,7 @@ The relevant part of the output is as follows.
 ```
 frontend services
     bind *:80
-    bind *:443 ssl crt-list /cfg/crt-list.txt
+    bind *:443 ssl crt-list /cfg/crt-list.txt alpn h2,http/1.1
     mode http
 
     acl url_go-demo path_beg /demo

docs/config.md

@@ -21,12 +21,13 @@ The following environment variables can be used to configure the *Docker Flow Pr
 |COMPRESSION_TYPE   |The type of files that will be compressed.<br>**Example:** text/css text/html text/javascript application/javascript text/plain text/xml application/json|
 |CONNECTION_MODE    |HAProxy supports 5 connection modes.<br><br>`http-keep-alive`: all requests and responses are processed.<br>`http-tunnel`: only the first request and response are processed, everything else is forwarded with no analysis.<br>`httpclose`: tunnel with "Connection: close" added in both directions.<br>`http-server-close`: the server-facing connection is closed after the response.<br>`forceclose`: the connection is actively closed after end of response.<br><br>In general, it is preferred to use `http-server-close` with application servers, and some static servers might benefit from `http-keep-alive`.<br>**Example:** `http-server-close`<br>**Default value:** `http-keep-alive`|
 |DEBUG              |Enables logging of each request sent through the proxy. Please consult [Debug Format](#debug-format) for info about the log entries. This feature should be used with caution. **Do not enable debugging in production unless necessary.**<br>**Example:** true<br>**Default value:** `false`|
-|DEBUG_ERRORS_ONLY  |If set to `true`, only requests that resulted in an error, timeout, retry, and redispatch will be logged. If a request is HTTP, responses with a status 5xx will be logged too. This variable will take effect only if `DEBUG` is set to `true`.<br>**Example:** true<br>**Default value:** `false`|
+|DEBUG_ERRORS_ONLY  |If set to `true`, only requests that resulted in an error, timeout, retry, and redispatch will be logged. If a request is HTTP, responses with a status 5xx will be logged too. This variable will take effect only if `DEBUG` is set to `true`.<br>**Example:** `true`<br>**Default value:** `false`|
 |DEBUG_HTTP_FORMAT  |Logging format that will be used with HTTP requests. Please consult [Custom log format](https://cbonte.github.io/haproxy-dconv/1.7/configuration.html#8.2.4) for more info about the available options.|
 |DEBUG_TCP_FORMAT   |Logging format that will be used with TCP requests. Please consult [Custom log format](https://cbonte.github.io/haproxy-dconv/1.7/configuration.html#8.2.4) for more info about the available options.|
 |DEFAULT_PORTS      |The default ports used by the proxy. Multiple values can be separated with comma (`,`). If a port should be for SSL connections, append it with `:ssl`. Additional binding options can be added after a port. For example, `80 accept-proxy,443 accept-proxy:ssl` adds `accept-proxy` to the defalt binding options.<br>**Default value:** `80,443:ssl`|
 |DEFAULT_REQ_MODE   |The default request mode used by the proxy.<br>**Default value:** `http`|
 |DO_NOT_RESOLVE_ADDR|Whether not to resolve addresses. If set to `true`, the proxy will NOT fail if the service is not available.<br>**Default value:** `false`|
+|ENABLE_H2          |Whether to enable http/2<br>**Example:** `false`<br>**Default:** `true`|
 |EXTRA_FRONTEND     |Value will be added to the default `frontend` configuration. Multiple lines should be separated with comma (*,*).|
 |EXTRA_GLOBAL       |Value will be added to the default `global` configuration. Multiple lines should be separated with comma (*,*).|
 |HTTPS_ONLY         |If set to true, all requests to all services will be redirected to HTTPS.<br>**Example:** `true`<br>**Default Value:** `false`|

docs/sni-routing.md

@@ -63,7 +63,6 @@ services:
       replicas: 1
       labels:
         com.df.notify: 'true'
-        com.df.distribute: 'true'
         com.df.pathType: "req_ssl_sni -i -m reg"
         com.df.servicePath: "^(api\\.)"
         com.df.srcPort: 443
@@ -87,7 +86,6 @@ services:
       replicas: 1
       labels:
         com.df.notify: 'true'
-        com.df.distribute: 'true'
         com.df.pathType: "req_ssl_sni -i -m beg"
         com.df.servicePath: "test."
         com.df.srcPort: 443

docs/swarm-mode-auto.md

@@ -102,7 +102,6 @@ docker service create --name go-demo \
     --network go-demo \
     --network proxy \
     --label com.df.notify=true \
-    --label com.df.distribute=true \
     --label com.df.servicePath=/demo \
     --label com.df.port=8080 \
     vfarcic/go-demo
@@ -139,7 +138,7 @@ We sent a request to the proxy (the only service listening to the port 80) and g
 
 The way the process works is as follows.
 
-[Docker Flow: Swarm Listener](https://github.com/vfarcic/docker-flow-swarm-listener) is running inside one of the Swarm manager nodes and queries Docker API in search for newly created services. Once it finds a new service, it looks for its labels. If the service contains the `com.df.notify` (it can hold any value), the rest of the labels with keys starting with `com.df.` are retrieved. All those labels are used to form request parameters. Those parameters are appended to the address specified as the `DF_NOTIFY_CREATE_SERVICE_URL` environment variable defined in the `swarm-listener` service. Finally, a request is sent. In this particular case, the request was made to reconfigure the proxy with the service `go-demo` (the name of the service), using `/demo` as the path, and running on the port `8080`. The `distribute` label is not necessary in this example since we're running only a single instance of the proxy. However, in production we should run at least two proxy instances (for fault tolerance) and the `distribute` argument means that reconfiguration should be applied to all.
+[Docker Flow: Swarm Listener](https://github.com/vfarcic/docker-flow-swarm-listener) is running inside one of the Swarm manager nodes and queries Docker API in search for newly created services. Once it finds a new service, it looks for its labels. If the service contains the `com.df.notify` (it can hold any value), the rest of the labels with keys starting with `com.df.` are retrieved. All those labels are used to form request parameters. Those parameters are appended to the address specified as the `DF_NOTIFY_CREATE_SERVICE_URL` environment variable defined in the `swarm-listener` service. Finally, a request is sent. In this particular case, the request was made to reconfigure the proxy with the service `go-demo` (the name of the service), using `/demo` as the path, and running on the port `8080`.
 
 Please see the [Reconfigure](usage.md#reconfigure) section for the list of all the arguments that can be used with the proxy.
 
@@ -231,7 +230,6 @@ docker service create --name go-demo \
   --network go-demo \
   --network proxy \
   --label com.df.notify=true \
-  --label com.df.distribute=true \
   --label com.df.servicePath=/demo \
   --label com.df.port=8080 \
   --replicas 3 \
@@ -336,9 +334,9 @@ From now on, the username and password are `secret-user` and `secret-pass`. Unli
 
 ## Rewriting Paths
 
-In some cases, you might want to rewrite the path of the incoming request before forwarding it to the destination service. We can do that using request parameters `reqPathSearch` and `reqPathReplace`.
+In some cases, you might want to rewrite the path of the incoming request before forwarding it to the destination service. We can do that using request parameter `reqPathSearchReplace`.
 
-As an example, we'll create the `go-demo` service that will be configured in the proxy to accept requests with the path starting with `/something`. Since the `go-demo` service allows only requests that start with `/demo`, we'll use `reqPathSearch` and `reqPathReplace` to rewrite the path.
+As an example, we'll create the `go-demo` service that will be configured in the proxy to accept requests with the path starting with `/something`. Since the `go-demo` service allows only requests that start with `/demo`, we'll use `reqPathSearchReplace` to rewrite the path.
 
 The command is as follows.
 
@@ -350,16 +348,14 @@ docker service create --name go-demo \
     --network go-demo \
     --network proxy \
     --label com.df.notify=true \
-    --label com.df.distribute=true \
     --label com.df.servicePath=/something \
     --label com.df.port=8080 \
-    --label com.df.reqPathSearch='/something/' \
-    --label com.df.reqPathReplace='/demo/' \
+    --label com.df.reqPathSearchReplace='/something/,/demo/' \
     --replicas 3 \
     vfarcic/go-demo
 ```
 
-Please notice that, this time, the `servicePath` is `/something`. The `reqPathSearch` specifies the regular expression that will be used to search for part of the address and the `reqPathReplace` will replace it. In this case, `/something/` will be replaced with `/demo/`. The proxy uses the *regsub* function within the *http-request set-path* directive to apply a regex-based substitution which operates as the well-known *sed* utility with `"s/<regex>/<subst>/"`. For more information, please consult [Configuration: 4.2 http-request](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4.2-http-request) and [Configuration: 7.3.1 regsub](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#7.3.1-regsub).
+The `reqPathSearchReplace` specifies the regular expression that will be used to search for part of the address and replace it. In this case, `/something/` will be replaced with `/demo/`. The proxy uses the *regsub* function within the *http-request set-path* directive to apply a regex-based substitution which operates as the well-known *sed* utility with `"s/<regex>/<subst>/"`. For more information, please consult [Configuration: 4.2 http-request](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4.2-http-request) and [Configuration: 7.3.1 regsub](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#7.3.1-regsub).
 
 Please wait a few moments until the `go-demo` service is running. You can see the status of the service by executing `docker service ps go-demo`.
 
@@ -382,12 +378,11 @@ hello, world!
 
 We sent a request to `/something/hello`. The proxy accepted the request, rewrote the path to `/demo/hello`, and forwarded it to the `go-demo` service.
 
-The `reqPathSearch` label accepts regular expressions. We can, for example, rewrite any path that starts with `/something/` to `/demo/hello`.
+The `reqPathSearchReplace` label accepts regular expressions. We can, for example, rewrite any path that starts with `/something/` to `/demo/hello`.
 
 ```bash
 docker service update \
-    --label-add com.df.reqPathSearch='/something/.*' \
-    --label-add com.df.reqPathReplace='/demo/hello' \
+    --label-add com.df.reqPathSearchReplace='/something/.*,/demo/hello' \
     go-demo
 ```
 
@@ -423,7 +418,6 @@ docker service create --name go-demo \
   --network go-demo \
   --network proxy \
   --label com.df.notify=true \
-  --label com.df.distribute=true \
   --label com.df.servicePath=/demo \
   --label com.df.port=8080 \
   --replicas 3 \
@@ -527,7 +521,6 @@ docker service create --name go-demo \
     --network go-demo \
     --network proxy \
     --label com.df.notify=true \
-    --label com.df.distribute=true \
     --label com.df.servicePath=/demo \
     --label com.df.port=8080 \
     --label com.df.users=admin:password \
@@ -640,7 +633,6 @@ docker service create --name go-demo \
     --network go-demo \
     --network proxy \
     --label com.df.notify=true \
-    --label com.df.distribute=true \
     --label com.df.servicePath=/demo \
     --label com.df.port=8080 \
     vfarcic/go-demo
@@ -666,7 +658,6 @@ Let us create a service that will allow us to test whether `tcp` protocol works.
 docker service create --name redis \
     --network proxy \
     --label com.df.notify=true \
-    --label com.df.distribute=true \
     --label com.df.port=6379 \
     --label com.df.srcPort=6379 \
     --label com.df.reqMode=tcp \

docs/swarm-mode-stack.md

@@ -141,7 +141,6 @@ services:
       replicas: 3
       labels:
         - com.df.notify=true
-        - com.df.distribute=true
         - com.df.servicePath=/demo
         - com.df.port=8080
 
@@ -190,6 +189,8 @@ Since Mongo database is much bigger than the `main` service, it takes more time
 After a few moments, the `swarm-listener` service will detect the `main` service from the `go-demo` stack and send the `proxy` a request to reconfigure itself. We can see the result by sending an HTTP request to the proxy.
 
 ```bash
+exit
+
 curl -i "$(docker-machine ip node-1)/demo/hello"
 ```