Merge branch 'master' of https://github.com/ChurchDesk/docker-flow-proxy

Dockerfile

@@ -1,16 +1,23 @@
-FROM golang:1.9.6 AS build
+FROM golang:1.11.0-alpine AS build
 ADD . /src
 WORKDIR /src
-RUN go get -d -v -t
-RUN go test --cover ./... --run UnitTest
-RUN go build -v -o docker-flow-proxy
+RUN set -x \
+    && apk add --update --no-cache --no-progress git g++ \
+    && go get -d -v \
+    && go test --cover ./... --run UnitTest \
+    && go build -v -o docker-flow-proxy
 
 
-FROM haproxy:1.8.8-alpine
-MAINTAINER 	Viktor Farcic <[email protected]>
+FROM haproxy:1.8.13-alpine
+LABEL org.opencontainers.image.title="Docker Flow Proxy" \
+    org.opencontainers.image.description="Automated HAProxy Reverse Proxy for Docker" \
+    org.opencontainers.image.url="https://proxy.dockerflow.com" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.authors="Viktor Farcic <[email protected]>" \
+    org.opencontainers.image.source="https://github.com/docker-flow/docker-flow-proxy"
 
-RUN mkdir /lib64 && ln -s /lib/libc.musl-x86_64.so.1 /lib64/ld-linux-x86-64.so.2
-RUN mkdir -p /cfg/tmpl /templates /certs /logs
+RUN apk --update --no-cache --no-progress add tini \
+    && mkdir -p /cfg/tmpl /templates /certs /logs
 
 ENV CERTS="" \
     CAPTURE_REQUEST_HEADER="" \
@@ -39,21 +46,20 @@ ENV CERTS="" \
     TIMEOUT_HTTP_REQUEST="5" TIMEOUT_HTTP_KEEP_ALIVE="15" TIMEOUT_CLIENT="20" TIMEOUT_CONNECT="5" TIMEOUT_QUEUE="30" TIMEOUT_SERVER="20" TIMEOUT_TUNNEL="3600" \
     USERS="" \
     SKIP_ADDRESS_VALIDATION="true" \
-    SSL_BIND_OPTIONS="no-sslv3" SSL_BIND_CIPHERS="ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS"
+    SSL_BIND_OPTIONS="no-sslv3" \
+    SSL_BIND_CIPHERS="ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS"
 
-EXPOSE 80
-EXPOSE 443
-EXPOSE 8080
+EXPOSE 80 \
+    443 \
+    8080
 
-RUN apk --no-cache add tini
 ENTRYPOINT ["/sbin/tini", "-g", "--"]
 CMD ["docker-flow-proxy", "server"]
 HEALTHCHECK --interval=5s --start-period=3s --timeout=10s CMD check.sh
 
 COPY scripts/check.sh /usr/local/bin/check.sh
-RUN chmod +x /usr/local/bin/check.sh
 COPY errorfiles /errorfiles
 COPY haproxy.cfg /cfg/haproxy.cfg
 COPY haproxy.tmpl /cfg/tmpl/haproxy.tmpl
 COPY --from=build /src/docker-flow-proxy /usr/local/bin/docker-flow-proxy
-RUN chmod +x /usr/local/bin/docker-flow-proxy
+RUN chmod +x /usr/local/bin/docker-flow-proxy /usr/local/bin/check.sh

Dockerfile.packetbeat

@@ -7,7 +7,7 @@ RUN apk add --update \
     bash \
     ca-certificates \
   && update-ca-certificates
-RUN wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://raw.githubusercontent.com/sgerrand/alpine-pkg-glibc/master/sgerrand.rsa.pub
+RUN wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub
 RUN wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.25-r0/glibc-2.25-r0.apk
 RUN apk add glibc-2.25-r0.apk
 

Dockerfile.test

@@ -1,8 +1,8 @@
-FROM dockerflow/docker-flow-proxy-test-base
+FROM thomasjpfan/docker-flow-proxy-test-base
 
 COPY . /src
 WORKDIR /src
 RUN chmod +x /src/run-tests.sh
-RUN go get -d -v -t
+RUN go get -d -v
 
 CMD ["sh", "-c", "/src/run-tests.sh"]

Dockerfile.test-base

@@ -1,10 +1,3 @@
-FROM golang:1.8
+FROM golang:1.11.0-alpine3.8
 
-MAINTAINER 	Viktor Farcic <[email protected]>
-
-RUN apt-get update && \
-    apt-get install -y apt-transport-https ca-certificates curl software-properties-common expect && \
-    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - && \
-    add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" && \
-    apt-get update && \
-    apt-get -y install docker-ce
+RUN apk add --no-cache --update git docker gcc libc-dev

Jenkinsfile

@@ -15,7 +15,7 @@ pipeline {
           def dateFormat = new SimpleDateFormat("yy.MM.dd")
           currentBuild.displayName = dateFormat.format(new Date()) + "-" + env.BUILD_NUMBER
         }
-        dfBuild2("docker-flow-proxy")
+        dfBuild2("docker-flow-proxy", "thomasjpfan/gox-build:0.1.1-1.11.0-alpine3.8")
         sh "docker image build -t dockerflow/docker-flow-proxy:latest-packet-beat -f Dockerfile.packetbeat ."
         sh "docker image tag dockerflow/docker-flow-proxy:latest-packet-beat dockerflow/docker-flow-proxy:${currentBuild.displayName}-packet-beat"
       }
@@ -53,7 +53,7 @@ pipeline {
         label "prod"
       }
       steps {
-        dfDeploy2("docker-flow-proxy", "proxy_proxy", "proxy_docs")
+        sh "helm upgrade -i docker-flow-proxy helm/docker-flow-proxy --namespace df --set image.tag=${currentBuild.displayName}"
       }
     }
   }

README.md

@@ -1,5 +1,7 @@
 # Docker Flow Proxy
 
+**This project needs adoption. I (@vfarcic) moved to Kubernetes and cannot dedicate time to this project anymore. Similarly, involvement from other contributors dropped as well. Please consider contributing yourself if you think this project is useful.**
+
 [![GitHub release](https://img.shields.io/github/release/docker-flow/docker-flow-proxy.svg)]()
 [![license](https://img.shields.io/github/license/docker-flow/docker-flow-proxy.svg)]()
 [![Docker Pulls](https://img.shields.io/docker/pulls/vfarcic/docker-flow-proxy.svg)]()

actions/fetch.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"strings"
 
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 )
 
 // Fetchable defines interface that fetches information from other sources

actions/fetch_test.go

@@ -1,15 +1,16 @@
 package actions
 
 import (
-	"../proxy"
 	"encoding/json"
 	"fmt"
-	"github.com/stretchr/testify/suite"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
+
+	"github.com/docker-flow/docker-flow-proxy/proxy"
+	"github.com/stretchr/testify/suite"
 )
 
 type FetchTestSuite struct {
@@ -25,12 +26,12 @@ type FetchTestSuite struct {
 func (s *FetchTestSuite) SetupTest() {
 	sd := proxy.ServiceDest{
 		ServicePath: []string{"path/to/my/service/api", "path/to/my/other/service/api"},
+		PathType:    "path_beg",
 	}
 	s.InstanceName = "proxy-test-instance"
 	s.ServiceDest = []proxy.ServiceDest{sd}
 	s.ConfigsPath = "path/to/configs/dir"
 	s.TemplatesPath = "test_configs/tmpl"
-	s.PathType = "path_beg"
 	s.fetch = fetch{
 		BaseReconfigure: BaseReconfigure{
 			TemplatesPath: s.TemplatesPath,

actions/reconfigure.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"
 
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 )
 
 const serviceTemplateFeFilename = "service-formatted-fe.ctmpl"
@@ -59,6 +59,17 @@ func (m *Reconfigure) Execute(reloadAfter bool) error {
 			return err
 		}
 	}
+	// Not global and replicas == 0, the service is not active
+	if !m.Service.IsGlobal && m.Service.Replicas == 0 {
+		action := NewRemove(
+			m.Service.ServiceName,
+			m.Service.AclName,
+			m.ConfigsPath,
+			m.TemplatesPath,
+			m.InstanceName,
+		)
+		return action.Execute([]string{})
+	}
 	if err := m.createConfigsAddService(); err != nil {
 		return err
 	}

actions/reconfigure_test.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"testing"
 
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/suite"
 )
@@ -24,12 +24,12 @@ func (s *ReconfigureTestSuite) SetupTest() {
 	sd := proxy.ServiceDest{
 		ServicePath: []string{"path/to/my/service/api", "path/to/my/other/service/api"},
 		Index:       0,
+		PathType:    "path_beg",
 	}
 	s.InstanceName = "proxy-test-instance"
 	s.ServiceDest = []proxy.ServiceDest{sd}
 	s.ConfigsPath = "path/to/configs/dir"
 	s.TemplatesPath = "test_configs/tmpl"
-	s.PathType = "path_beg"
 	s.reconfigure = Reconfigure{
 		BaseReconfigure: BaseReconfigure{
 			TemplatesPath: s.TemplatesPath,
@@ -40,7 +40,7 @@ func (s *ReconfigureTestSuite) SetupTest() {
 			ServiceName: s.ServiceName,
 			AclName:     s.ServiceName,
 			ServiceDest: []proxy.ServiceDest{sd},
-			PathType:    s.PathType,
+			Replicas:    1,
 		},
 	}
 	os.Setenv("SKIP_ADDRESS_VALIDATION", "true")
@@ -122,6 +122,7 @@ func (s ReconfigureTestSuite) Test_GetTemplates_UsesServerTemplate_WhenDiscovery
 	s.reconfigure.Service.ServiceDest[0].Port = "1234"
 	s.reconfigure.Service.DiscoveryType = "DNS"
 	s.reconfigure.Service.Replicas = 0
+	s.reconfigure.Service.IsGlobal = true
 	expected := `
 backend myService-be1234_0
     mode http
@@ -428,6 +429,7 @@ backend https-myService-be4321_0
 	s.reconfigure.ServiceDest[0].Port = "1234"
 	s.reconfigure.ServiceDest[0].HttpsPort = 4321
 	s.reconfigure.Replicas = 0
+	s.reconfigure.IsGlobal = true
 	s.reconfigure.DiscoveryType = "DNS"
 	actualFront, actualBack, _ := s.reconfigure.GetTemplates()
 
@@ -739,7 +741,8 @@ func (s ReconfigureTestSuite) Test_Execute_WritesServerSession() {
 	s.reconfigure.AclName = "my-service"
 	s.reconfigure.ServiceDest[0].Port = "1111"
 	s.reconfigure.ServiceDest[0].HttpsPort = 2222
-	s.reconfigure.Tasks = []string{"1.2.3.4", "4.3.2.1"}
+	// The expectedData will place these ips in order
+	s.reconfigure.Tasks = []string{"4.3.2.1", "1.2.3.4"}
 	s.reconfigure.SessionType = "sticky-server"
 	var actualData string
 	expectedData := `
@@ -1033,6 +1036,19 @@ func (s ReconfigureTestSuite) Test_Execute_RemovesService_WhenProxyFails() {
 	mockObj.AssertCalled(s.T(), "RemoveService", s.ServiceName)
 }
 
+func (s ReconfigureTestSuite) Test_Execute_RemovesService_WhenReplicasIs0() {
+	s.reconfigure.Service.Replicas = 0
+
+	mockObj := getProxyMock("")
+	proxyOrig := proxy.Instance
+	defer func() { proxy.Instance = proxyOrig }()
+	proxy.Instance = mockObj
+
+	s.reconfigure.Execute(true)
+
+	mockObj.AssertCalled(s.T(), "RemoveService", s.ServiceName)
+}
+
 func (s ReconfigureTestSuite) Test_Execute_ReloadsAgain_WhenProxyFails() {
 	mockObj := getProxyMock("Reload")
 	mockObj.On("Reload").Return(fmt.Errorf("This is an error"))
@@ -1052,11 +1068,12 @@ func (s ReconfigureTestSuite) Test_Execute_AddsService() {
 	proxy.Instance = mockObj
 	sd := proxy.ServiceDest{
 		ServicePath: []string{"path/to/my/service/api", "path/to/my/other/service/api"},
+		PathType:    "path_beg",
 	}
 	expected := proxy.Service{
 		ServiceName: "s.ServiceName",
 		ServiceDest: []proxy.ServiceDest{sd},
-		PathType:    s.PathType,
+		Replicas:    1,
 	}
 	r := NewReconfigure(
 		BaseReconfigure{
@@ -1135,12 +1152,13 @@ func (s *ReconfigureTestSuite) Test_Execute_WhenFilterProxyInstanceIsTrue_SamePr
 	proxy.Instance = mockObj
 	sd := proxy.ServiceDest{
 		ServicePath: []string{"path/to/my/service/api", "path/to/my/other/service/api"},
+		PathType:    "path_beg",
 	}
 	expected := proxy.Service{
 		ServiceName:       s.ServiceName,
 		ServiceDest:       []proxy.ServiceDest{sd},
-		PathType:          s.PathType,
 		ProxyInstanceName: s.InstanceName,
+		Replicas:          1,
 	}
 	r := NewReconfigure(
 		BaseReconfigure{
@@ -1167,11 +1185,11 @@ func (s *ReconfigureTestSuite) Test_Execute_WhenFilterProxyInstanceIsTrue_Differ
 	proxy.Instance = mockObj
 	sd := proxy.ServiceDest{
 		ServicePath: []string{"path/to/my/service/api", "path/to/my/other/service/api"},
+		PathType:    "path_beg",
 	}
 	expected := proxy.Service{
 		ServiceName:       s.ServiceName,
 		ServiceDest:       []proxy.ServiceDest{sd},
-		PathType:          s.PathType,
 		ProxyInstanceName: "another-docker-flow",
 	}
 	r := NewReconfigure(

actions/reload.go

@@ -1,7 +1,7 @@
 package actions
 
 import (
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 )
 
 // Reloader defines the interface for reloading HAProxy

actions/reload_test.go

@@ -1,7 +1,7 @@
 package actions
 
 import (
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 	"fmt"
 	"github.com/stretchr/testify/suite"
 	"testing"

actions/remove.go

@@ -3,7 +3,7 @@ package actions
 import (
 	"fmt"
 
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 )
 
 // Removable defines functions that must be implemented by any struct in charge of removing services from the proxy.

actions/remove_test.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"testing"
 
-	"../proxy"
+	"github.com/docker-flow/docker-flow-proxy/proxy"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/suite"
 )

docs/config.md

@@ -29,12 +29,13 @@ The following environment variables can be used to configure the *Docker Flow Pr
 |DEFAULT_REQ_MODE   |The default request mode used by the proxy.<br>**Default value:** `http`|
 |DO_NOT_RESOLVE_ADDR|Whether not to resolve addresses. If set to `true`, the proxy will NOT fail if the service is not available.<br>**Default value:** `false`|
 |ENABLE_H2          |Whether to enable http/2<br>**Example:** `false`<br>**Default:** `true`|
-|EXTRA_FRONTEND     |Value will be added to the default `frontend` configuration. Multiple lines should be separated with comma (*,*).|
-|EXTRA_GLOBAL       |Value will be added to the default `global` configuration. Multiple lines should be separated with comma (*,*).|
+|EXTRA_FRONTEND     |Value will be added to the default `frontend` configuration. Multiple lines should be separated with comma (*,*). If you are setting `maxconn`, be sure to add `maxcoon` to `EXTRA_GLOBAL` as well.|
+|EXTRA_GLOBAL       |Value will be added to the default `global` configuration. Multiple lines should be separated with comma (*,*). If you are setting `maxconn`, be sure to add `maxcoon` to `EXTRA_FRONTEND` as well.|
 |FILTER_PROXY_INSTANCE_NAME|If set to `true`, only services with `com.df.proxyInstanceName` equal to env variable `PROXY_INSTANCE_NAME` will be processed by the proxy.<br>**Default:** `false`|
 |HTTPS_ONLY         |If set to true, all requests to all services will be redirected to HTTPS.<br>**Example:** `true`<br>**Default Value:** `false`|
 |LISTENER_ADDRESS   |The address of the [Docker Flow: Swarm Listener](https://github.com/docker-flow/docker-flow-swarm-listener) used for automatic proxy configuration. Multiple values can be separated with comma (`,`). When set to multiple values, the proxy will query each address in order.<br>**Example:** `swarm-listener`|
-PROXY_INSTANCE_NAME|The name of the proxy instance. Useful if multiple proxies are running inside a cluster.<br>**Default value:** `docker-flow`|
+|PREFERRED_CERTIFICATE|A comma separated list of preferred certificates when creating the `crt-list.txt` file used for ssl. The certificates strings supports the `*` glob pattern to match files.<br>**Example:** `dev01.*,dev03.domain.com`|
+|PROXY_INSTANCE_NAME|The name of the proxy instance. Useful if multiple proxies ar running inside a cluster.<br>**Default value:** `docker-flow`|
 |RECONFIGURE_ATTEMPTS|The number of attempts the proxy will try to reconfigure itself before giving up and removing the offending service. The period between reconfigure attempts is 1 second.<br>**Example:** `15`<br>**Default value:** `20`|
 |RELOAD_ATTEMPTS    |The number of attempts the proxy will query a listener addresss during startup. Only used when LISTENER_ADDRESS is a comma seperated list of addresses.<br>**Default value:** `5`|
 |RELOAD_INTERVAL    |Defines the frequency (in milliseconds) between automatic config reloads from Swarm Listener.<br>**Default value:** `5000`|
@@ -44,8 +45,8 @@ PROXY_INSTANCE_NAME|The name of the proxy instance. Useful if multiple proxies a
 |SERVICE_DOMAIN_ALGO|The default algorithm applied to domain ACLs. It can be overwritten for a service through the `serviceDomainAlgo` parameter.<br>**Examples:**<br>`hdr(host)`: matches only if domain is the same as `serviceDomain`<br>`hdr_dom(host)`: matches the specified `serviceDomain` and any subdomain (a string either isolated or delimited by dots).<br>`req.ssl_sni`: matches Server Name TLS extension<br>**Default Value:** `hdr_beg(host)`|
 |SERVICE_NAME       |The name of the service. It must be the same as the value of the `--name` argument used to create the proxy service. Used only in the *swarm* mode.<br>**Example:** `my-proxy`<br>**Default value:** `proxy`|
 |SKIP_ADDRESS_VALIDATION|Whether to skip validating service address before reconfiguring the proxy.<br>**Example:** false<br>**Default value:** `true`|
-|SSL_BIND_CIPHERS   |Sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake for all "bind" lines which do not explicitly define theirs. The format of the string is defined in "man 1 ciphers" from OpenSSL man pages, and can be for instance a string such as `AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH`.<br>**Default value:** see [Dockerfile](https://github.com/docker-flow/docker-flow-proxy/blob/master/Dockerfile#L31)|
-|SSL_BIND_OPTIONS   |Sets default ssl-options to force on all "bind" lines.<br>**Default value:** `no-sslv3`|
+|SSL_BIND_CIPHERS   |Sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake for all "bind" lines which do not explicitly define theirs. The format of the string is defined in "man 1 ciphers" from OpenSSL man pages, and can be for instance a string such as `EECDH+AESGCM:EDH+AESGCM`.<br>**Default value:** see [Dockerfile](https://github.com/docker-flow/docker-flow-proxy/blob/master/Dockerfile#L42)|
+|SSL_BIND_OPTIONS   |Sets default ssl-options to force on all "bind" lines.<br>**Default value:** `ssl-min-ver TLSv1.2 no-tls-tickets`|
 |STATS_USER         |Username for the statistics page. If not set, stats will not be available. If both `STATS_USER` and `STATS_PASS` are set to `none`, statistics will be available without authentication.<br>**Example:** my-user<br>**Default value:** `admin`|
 |STATS_USER_ENV     |The name of the environment variable that holds the username for the statistics page.<br>**Example:** MY_USER<br>**Default value:** `STATS_USER`|
 |STATS_PASS         |Password for the statistics page. If not set, stats will not be available. If both `STATS_USER` and `STATS_PASS` are set to `none`, statistics will be available without authentication.<br>**Example:** my-pass<br>**Default value:** `admin`|

docs/swarm-mode-auto.md

@@ -2,7 +2,7 @@
 
 *Docker Flow Proxy* running in the *Swarm Mode* is designed to leverage the features introduced in *Docker v1.12+*.
 
-The examples that follow assume that you have Docker Machine version v0.8+ that includes Docker Engine v1.12+. The easiest way to get them is through [Docker Toolbox](https://www.docker.com/products/docker-toolbox).
+The examples that follow assume that you have Docker Machine version v0.8+ that includes Docker Engine v1.12+. The easiest way to get them is through [Docker Toolbox](https://docs.docker.com/toolbox/overview/).
 
 !!! info
 	If you are a Windows user, please run all the examples from *Git Bash* (installed through *Docker Toolbox*). Also, make sure that your Git client is configured to check out the code *AS-IS*. Otherwise, Windows might change carriage returns to the Windows format.

docs/swarm-mode-stack.md

@@ -156,7 +156,7 @@ networks:
     external: true
 ```
 
-The stack defines two services (`main` and `db`). They will communicate with each other through the `default` network that will be created automatically by the stack. Since the `main` service is an API, it should be accessible through the proxy, so we're attaching `proxy` network as well. The `main` service defines four service labels. They are the same labels you used in the [Running Docker Flow Proxy In Swarm Mode With Automatic Reconfiguration](swarm-mode-auto.md) tutorial.
+The stack defines two services (`main` and `db`). They will communicate with each other through the `default` network that will be created automatically by the stack. Since the `main` service is an API, it should be accessible through the proxy, so we're attaching `proxy` network as well. The `main` service defines three service labels. They are the same labels you used in the [Running Docker Flow Proxy In Swarm Mode With Automatic Reconfiguration](swarm-mode-auto.md) tutorial.
 
 !!! tip
     Don't confuse **service** with **container** labels. The syntax is the same with the difference that service labels are inside the `deploy` section. *Docker Flow Swarm Listener* supports only service labels.