docker_nginx_auto_proxy/nginx_proxy.py

#!/usr/bin/env python3

from docker import Client
from docker.errors import APIError
from string import Template
import json
import re
import signal
import os
import logging

target_path = "/tmp/nginx/"
config_path = target_path + "conf/"
pid_file = "/var/run/nginx.pid"
non_location_template = """# proxy for container '$containername'
server {
    listen $listen;
    server_name $names;
    location / {
        client_max_body_size $body_size;
        client_body_timeout 300s;
        if ($$http_x_forwarded_for = "") {
            add_header X-Forwarded-For $$remote_addr;
        }
        proxy_set_header Host $$host;
        proxy_pass http://$ip:$port;
    }
}
"""

location_template = """# proxy for container '$containername'
server {
    listen $listen;
    server_name $names;
    location / {
        return 301 $$scheme://$name/$location;
    }
    location /$location {
        client_max_body_size $body_size;
        client_body_timeout 300s;
        if ($$http_x_forwarded_for = "") {
            add_header X-Forwarded-For $$remote_addr;
        }
        proxy_set_header Host $$host;
        proxy_pass http://$ip:$port;
    }
}
"""


def analyse_env_vars(inspect_data):
    """Extracts the environment variables from the given result of an 'inspect
        container' call."""
    env_data = {}
    counter = 0
    if 'Env' not in inspect_data['Config'] or inspect_data['Config']['Env'] is None:
        return env_data
    for env_var in inspect_data['Config']['Env']:
        t = env_var.split("=")
        key = t[0]
        value = t[1]
        if key == 'PROXY_DATA':
            if key in env_data:
                key = "{key}{postfix}".format(key=key, postfix=counter)
            env_data[key] = value
    return env_data


def analyse_proxy_data(data):
    """Extracts the data for the proxy configuration (envrionment variable
        'PROXY_DATA' and converts it to a dictionary."""
    proxy_data = {}
    for proxy_var in data.split(','):
        t = proxy_var.split(":",1)
        proxy_data[t[0]] = t[1]
    return proxy_data


def check_proxy_data_format(var_content):
    """
    Validates the content of the variable.
    :param var_content: content of the proxy data variable
    :return: True if the content is of valid format, False otherwise
    """
    return re.match(r"^(\w+:[^:,]+,)+\w+:[^:,]+$", var_content) is not None


def extract_ip(inspect_data):
    """extracts the container's ip from the given inspect data"""
    return inspect_data['NetworkSettings']['IPAddress']


def extract_name(inspect_data):
    """extracts the container's name from the given inspect data"""
    return inspect_data['Name']


def get_if_available(dictionary, key, defValue):
    if key in dictionary:
        return dictionary[key]
    else:
        return defValue


def handle_container(id):
    """This function take a container's id and collects all data required
        to create a proper proxy configuration. The configuration is then
        written to the directory of temporary nginx files"""
    inspect_data = client.inspect_container(id)
    env_vars = analyse_env_vars(inspect_data)
    for env_key in env_vars:
        env_data = env_vars[env_key]
        if not check_proxy_data_format(env_data):
            logging.info('cannot handle container with id "%s" named "%s": %s', id, extract_name(inspect_data), env_data)
            return
        proxy_data = analyse_proxy_data(env_data)
        container_listen_ip = get_if_available(proxy_data, 'ip', '0.0.0.0')
        if container_listen_ip != '0.0.0.0' and container_listen_ip not in listen_ips:
            logging.info('container "%s"(%s) does not listen on %s.', extract_name(inspect_data), container_listen_ip, str(listen_ips))
            return
        logging.info('container "%s"(%s) is allowed to listen on %s.', extract_name(inspect_data), container_listen_ip, str(listen_ips))
        substitutes = {
            'containername': '{c} {d}'.format(c=extract_name(inspect_data), d=env_data),
            'ip': extract_ip(inspect_data),
            'location': get_if_available(proxy_data, 'location', ''),
            'names': get_if_available(proxy_data, 'server_names', '').replace(';', ' '),
            'port': get_if_available(proxy_data, 'port', 80),
            'body_size': get_if_available(proxy_data, 'body_size', '1m'),
            'listen': '*:80'
        }
        logging.info('writing to %sproxy_%s', config_path, id)
        with open(config_path + '/proxy_{id}_{code}'.format(id=id,code=env_key), 'w') as file:
            if substitutes['location'] == '':
                del substitutes['location']
                logging.info(Template(non_location_template).safe_substitute(substitutes))
                file.write(Template(non_location_template).safe_substitute(substitutes))
            else:
                # make sure we have a name for the redirect
                substitutes['name'] = substitutes['names'].split(' ')[0]
                logging.info(Template(location_template).safe_substitute(substitutes))
                file.write(Template(location_template).safe_substitute(substitutes))


def reload_nginx_configuration():
    logging.info('HUPing nginx')
    os.kill(pid, signal.SIGHUP)


def get_pid():
    """This function reads the process id from the given file."""
    with open(pid_file, 'r') as file:
        return int(file.read())


def get_docker_id():
    """This function extracts the container's id from /proc/self/cgroup."""
    id = ''
    with open('/proc/self/cgroup', 'r') as file:
        lines = file.read().split('\n')
        for line in lines:
            index = line.find('docker-')
            if index != -1:
                id = line[index+7:-6]
                break
            index = line.find('docker/')
            if index != -1:
                id = line[index+7:]
                break
    if id == '':
        logging.error('could not determine container\'s id!')
    return id


def get_listen_ips():
    inspect_data = client.inspect_container(get_docker_id())
    mappings = inspect_data['NetworkSettings']['Ports']['80/tcp']
    ips = []
    if mappings is None or len(mappings) == 0:
        ips.append('0.0.0.0')
    else:
        logging.info('count %s', len(mappings))
        for data in mappings:
            ips.append(data['HostIp'])
    return ips


def setup_logging():
    logging.basicConfig(format='%(asctime)s [%(levelname)s]: %(message)s', level=logging.INFO)

if __name__ == '__main__':
    setup_logging()

    # prepare required stuff
    pid = get_pid()
    logging.info('nginx pid: %s', str(pid))
    if not os.path.exists(config_path):
        logging.info('creating target path: %s', target_path)
        os.mkdir(target_path)
        logging.info('creating target path: %s', config_path)
        os.mkdir(config_path)

    client = Client(base_url='unix://var/run/docker.sock', version='1.15')

    listen_ips = get_listen_ips()
    logging.info('Listening on %s.', listen_ips)
    if len(listen_ips) != 1:
        logging.error('auto_proxy should only listen on 1 IP at a time, everything else can have security implications.')
        exit()

    # handle all running containers existing at startup of this container
    container_ids = client.containers(quiet=True)
    for container_id in container_ids:
        handle_container(container_id['Id'])
    reload_nginx_configuration()

    # hook to the events
    for line in client.events():
        line_str = line.decode("utf-8")
        event = json.loads(line_str)

        if not 'id' in event:
            continue
        container_id = event['id']
        try:
            inspect_data = client.inspect_container(container_id)
            ip = extract_ip(inspect_data)
        except APIError:
            ip = ''

        if ip == '':
            logging.info('removing data for container %s', container_id)
            # since a container can expose multiple ports per PROXY_DATA it 
            # will generate multiple files. All names contain the container id.
            # This will be used to delete all relevant files for a container
            for filename in os.listdir(config_path):
                if container_id in filename:
                    logging.info('removing file %s%s', config_path, container_id)
                    os.remove(config_path + filename)
        else:
            handle_container(container_id)

        reload_nginx_configuration()