Joachim Lusiardi
973abaeb23
The required domains are now extracted at startup of the container via the docker socket. A certificate that contains all domains as common or alternative name is generated and used.
139 lines
4.2 KiB
Python
139 lines
4.2 KiB
Python
#!/usr/bin/python3.4
|
|
|
|
import os
|
|
import sys
|
|
import signal
|
|
import logging
|
|
import time
|
|
import hashlib
|
|
|
|
import list_domains
|
|
from docker import Client
|
|
|
|
cert_path='/data/haproxy'
|
|
cert_file='/data/haproxy/cert.pem'
|
|
pid_file='/haproxy.pid'
|
|
|
|
|
|
def hash_cert_file():
|
|
"""Creates the sha256 hash of the certifcate file for haproxy. If the file
|
|
does not exist, an empty string is returned.
|
|
"""
|
|
if not os.path.isfile(cert_file):
|
|
return ''
|
|
aFile = open(cert_file, 'rb')
|
|
hasher = hashlib.sha256()
|
|
buf = aFile.read(65536)
|
|
while len(buf) > 0:
|
|
hasher.update(buf)
|
|
buf = aFile.read(65536)
|
|
return hasher.digest()
|
|
|
|
def setup_logging():
|
|
"""Sets up logging with a nice format"""
|
|
logging.basicConfig(format='%(asctime)s [%(levelname)s]: %(message)s', level=logging.INFO)
|
|
|
|
def get_pid():
|
|
"""This function reads the process id from the given file and returns as int."""
|
|
with open(pid_file, 'r') as file:
|
|
return int(file.read())
|
|
|
|
def kill_haproxy():
|
|
"""Stops the currently running instance of haproxy by issueing a kill signal to its pid."""
|
|
logging.info('killing haproxy')
|
|
try:
|
|
os.kill(get_pid(), signal.SIGKILL)
|
|
except OSError:
|
|
pass
|
|
|
|
def start_haproxy_ssl():
|
|
logging.info('starting haproxy SSL')
|
|
os.system('/usr/sbin/haproxy -f /haproxy_ssl.conf -p /haproxy.pid')
|
|
return is_haproxy_running()
|
|
|
|
def start_haproxy():
|
|
logging.info('starting haproxy NON SSL')
|
|
os.system('/usr/sbin/haproxy -f /haproxy.conf -p /haproxy.pid')
|
|
return False
|
|
|
|
def is_haproxy_running():
|
|
try:
|
|
os.kill(get_pid(), 0)
|
|
return True
|
|
except OSError:
|
|
return False
|
|
|
|
def ssl_possible():
|
|
"""Check if a certificate is available."""
|
|
if not os.path.exists(cert_path):
|
|
logging.info('creating cert_path path: %s', cert_path)
|
|
os.mkdir(cert_path)
|
|
|
|
if not os.path.isfile(cert_file):
|
|
return False
|
|
else:
|
|
return True
|
|
|
|
def create_haproxy_cert():
|
|
"""Combines the freshly created fullchain.pem and privkey.pem into /data/haproxy/cert.pem"""
|
|
os.system('DIR=`ls -td /data/config/live/*/ | head -1`; cat ${DIR}/fullchain.pem ${DIR}/privkey.pem > /data/haproxy/cert.pem')
|
|
|
|
def create_cert_data_standalone(domains):
|
|
domains = " -d ".join(domains)
|
|
os.system('/letsencrypt/letsencrypt-auto --config letencrypt.conf certonly -d ' + domains)
|
|
|
|
if __name__ == '__main__':
|
|
setup_logging()
|
|
|
|
logging.info('starting')
|
|
|
|
cert_file_hash = hash_cert_file()
|
|
|
|
# try to start in SSL mode, no problem if that fails
|
|
logging.info('try in SSL mode')
|
|
SSL_RUNNING = start_haproxy_ssl()
|
|
if not SSL_RUNNING:
|
|
logging.info('SSL mode failed')
|
|
|
|
if not is_haproxy_running():
|
|
# tried to start haproxy and this failed, so we need to create a certificate and try again:
|
|
# - start non ssl haproxy to be able to get a valid cert
|
|
logging.info('try in NON SSL mode')
|
|
SSL_RUNNING = start_haproxy()
|
|
# - get all domains
|
|
client = Client(base_url='unix://var/run/docker.sock', version='1.15')
|
|
resolved_domains = list_domains.get_resolving_domains_from_containers(client)
|
|
# - create cert
|
|
create_cert_data_standalone(resolved_domains)
|
|
create_haproxy_cert()
|
|
|
|
# now we should have it up and running or something weird happened.
|
|
if not is_haproxy_running():
|
|
logging.error('could not start after generating cert. See output above.')
|
|
sys.exit(1)
|
|
|
|
while True:
|
|
time.sleep(10)
|
|
if ssl_possible() and not SSL_RUNNING:
|
|
kill_haproxy()
|
|
start_haproxy_ssl()
|
|
if is_haproxy_running():
|
|
cert_file_hash = hash_cert_file()
|
|
logging.info('NON SSL -> SSL')
|
|
SSL_RUNNING=True
|
|
else:
|
|
start_haproxy()
|
|
SSL_RUNNING=False
|
|
if SSL_RUNNING and cert_file_hash != hash_cert_file():
|
|
logging.info('cert has changed')
|
|
kill_haproxy()
|
|
start_haproxy_ssl()
|
|
if is_haproxy_running():
|
|
cert_file_hash = hash_cert_file()
|
|
logging.info('SSL -> SSL')
|
|
SSL_RUNNING=True
|
|
else:
|
|
start_haproxy()
|
|
logging.info('SSL -> NON SSL')
|
|
SSL_RUNNING=False
|