aboutsummaryrefslogtreecommitdiffstats
path: root/terminaldweller.com/haproxy
diff options
context:
space:
mode:
authorterminaldweller <thabogre@gmail.com>2021-09-10 07:30:16 +0000
committerterminaldweller <thabogre@gmail.com>2021-09-10 07:30:16 +0000
commit118106cf745167db7e17654e0402721939631be7 (patch)
tree72927b53141eabee87a0160420f720b49a744076 /terminaldweller.com/haproxy
parentupdate (diff)
downloadscripts-118106cf745167db7e17654e0402721939631be7.tar.gz
scripts-118106cf745167db7e17654e0402721939631be7.zip
update
Diffstat (limited to '')
-rw-r--r--terminaldweller.com/haproxy/certbot/Dockerfile2
-rwxr-xr-xterminaldweller.com/haproxy/certbot/certbot-entrypoint.sh30
-rw-r--r--terminaldweller.com/haproxy/docker-compose.yaml35
-rw-r--r--terminaldweller.com/haproxy/haproxy.cfg103
4 files changed, 125 insertions, 45 deletions
diff --git a/terminaldweller.com/haproxy/certbot/Dockerfile b/terminaldweller.com/haproxy/certbot/Dockerfile
new file mode 100644
index 0000000..b6fb68a
--- /dev/null
+++ b/terminaldweller.com/haproxy/certbot/Dockerfile
@@ -0,0 +1,2 @@
+FROM certbot/certbot
+COPY ./certbot-entrypoint.sh /certbot-entrypoint.sh
diff --git a/terminaldweller.com/haproxy/certbot/certbot-entrypoint.sh b/terminaldweller.com/haproxy/certbot/certbot-entrypoint.sh
new file mode 100755
index 0000000..2be858f
--- /dev/null
+++ b/terminaldweller.com/haproxy/certbot/certbot-entrypoint.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -ex
+
+cat_cert() {
+ dir="/etc/letsencrypt/live/$1"
+ cat "$dir/privkey.pem" "$dir/fullchain.pem" > "/certs/$1.pem"
+}
+
+while :;do
+ echo starting...
+ if [ -e /certs/$DOMAIN.pem ]; then
+ certbot \
+ certonly \
+ --test-cert \
+ --webroot -w /webroot \
+ -d $DOMAIN \
+ --email $EMAIL \
+ --non-interactive \
+ --agree-tos
+
+ cat_cert $DOMAIN
+ else
+ certbot renew -w /webroot
+
+ for dir in /etc/letsencrypt/live/*/; do
+ cat_cert $(basename "$dir")
+ done
+ fi
+ sleep 12h
+done
diff --git a/terminaldweller.com/haproxy/docker-compose.yaml b/terminaldweller.com/haproxy/docker-compose.yaml
index 95752c8..571fa7c 100644
--- a/terminaldweller.com/haproxy/docker-compose.yaml
+++ b/terminaldweller.com/haproxy/docker-compose.yaml
@@ -1,12 +1,43 @@
-version: "3.4"
+version: "3.4"
services:
haproxy:
image: haproxy
ports:
- "80:80"
+ - "443:443"
volumes:
- ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+ - ./certs:/usr/local/etc/certs:ro
networks:
- haproxynet
+ restart: unless-stopped
+ certbot:
+ image: certbot
+ build:
+ context: ./certbot
+ ports:
+ - "127.0.0.1:9080:80"
+ - "127.0.0.1:9443:443"
+ networks:
+ - haproxynet
+ # restart: unless-stopped
+ volumes:
+ - ./letsencrypt:/etc/letsencrypt
+ - ./webroot:/webroot
+ - ./certs:/certs
+ # command: ["certonly","--test-cert","--webroot","-w","/webroot","-d","chat.terminaldweller.com","--email","thabogre@gmail.com","--non-interactive","--agree-tos"]
+ entrypoint: ["/certbot-entrypoint.sh"]
+ environment:
+ - DOMAIN=chat.terminaldweller.com
+ - EMAIL=thabogre@gmail.com
+ nginx:
+ image: nginx
+ ports:
+ - "127.0.0.1:8080:80"
+ networks:
+ - haproxynet
+ restart: unless-stopped
+ volumes:
+ - ./webroot:/usr/share/nginx/html
networks:
- - haproxynet
+ haproxynet:
diff --git a/terminaldweller.com/haproxy/haproxy.cfg b/terminaldweller.com/haproxy/haproxy.cfg
index 19e7bac..f1c288e 100644
--- a/terminaldweller.com/haproxy/haproxy.cfg
+++ b/terminaldweller.com/haproxy/haproxy.cfg
@@ -1,60 +1,77 @@
global
-log 127.0.0.1 local0
+ log 127.0.0.1 local0
+ ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
defaults
-timeout connect 5000ms
-timeout client 50000ms
-timeout server 50000ms
-mode tcp
-option tcplog
-option dontlognull
+ timeout connect 5000ms
+ timeout client 50000ms
+ timeout server 50000ms
+ mode tcp
+ option tcplog
+ option dontlognull
+
+resolvers docker_resolver
+ nameserver dns 127.0.0.11:53
#Frontends
frontend front
-bind *:80
-bind: *.443
-mode tcp
-timeout client 60s
-
-#ACLs
-acl blog-host hdr_sub(host) -i blog.terminaldweller.com
-acl mail-host hdr_sub(host) -i mail.terminaldweller.com
-acl api-host hdr_sub(host) -i api.terminaldweller.com
-acl chat-host hdr_sub(host) -i chat.terminaldweller.com
-acl chat-host-s req.ssl_sni -i chat.terminaldweller.com
-
-#Consitions
-use_backend blog-backend if blog-host
-use_backend mail-backend if mail-host
-use_backend api-backend if api-host
-use_backend chat-backend-s if chat-host-s
-default_backend blog-backend
+ bind *:80
+ bind *:443
+ mode tcp
+ timeout client 60s
+ #ACLs
+ acl letsencrypt-acl path_beg /.well-known/acme-challenge/
+ acl blog-host hdr_sub(host) -i blog.terminaldweller.com
+ acl mail-host hdr_sub(host) -i mail.terminaldweller.com
+ acl mail-host-s req.ssl_sni -i mail.terminaldweller.com
+ acl api-host hdr_sub(host) -i api.terminaldweller.com
+ acl chat-host hdr_sub(host) -i chat.terminaldweller.com
+ acl chat-host-s req.ssl_sni -i chat.terminaldweller.com
+ #Consitions
+ use_backend certbot-backend if letsencrypt-acl
+ use_backend blog-backend if blog-host
+ use_backend mail-backend if mail-host
+ use_backend mail-backend-s if mail-host-s
+ use_backend api-backend if api-host
+ use_backend chat-backend-s if chat-host-s
+ default_backend blog-backend
#Backends
+backend certbot-backend
+ server nginx nginx:80 resolvers docker_resolver check init-addr none
+
backend blog-backend
-mode http
-option forwardfor
-server blog-host 192.99.102.52:9000 check
+ mode http
+ option forwardfor
+ server blog-host 192.99.102.52:9000 check
backend mail-backend
-mode http
-option forwardfor
-server mail-host 185.126.202.69:80 check
+ mode http
+ option forwardfor
+ server mail-host 185.126.202.69:80 check
+
+backend mail-backend-s
+ timeout server 60s
+ timeout client 60s
+ mode tcp
+ option forwardfor
+ option ssl-hello-chk
+ server mail-host-s 185.126.202.69:443 check
backend api-backend
-mode http
-option forwardfor
-server api-host 192.99.102.52:8008 check
+ mode http
+ option forwardfor
+ server api-host 192.99.102.52:8008 check
backend chat-backend
-mode http
-option forwardfor
-server chat-host 87.236.209.206:5280 check
+ mode http
+ option forwardfor
+ server chat-host 87.236.209.206:5280 check
backend chat-backend-s
-timeout server 60s
-timeout client 60s
-mode tcp
-option forwardfor
-option ssl-hello-chk
-server chat-host 87.236.209.206:5281 check
+ timeout server 60s
+ timeout client 60s
+ mode tcp
+ option forwardfor
+ option ssl-hello-chk
+ server chat-host-s 87.236.209.206:5280 check