Add auth label

certs/deployer.go

@@ -90,7 +90,7 @@ func (c *CertificateDeployer) deployFile(name string, content []byte, modTime ti
 	if err != nil {
 		c.logger.Warnf("Unable to write certificate %s - %s", target, err.Error())
 	} else {
-		c.logger.Info("Updated certificate file %s", target)
+		c.logger.Infof("Updated certificate file %s", target)
 	}
 }
 

dotege.go

@@ -48,7 +48,8 @@ func main() {
 
 	config := model.Config{
 		Labels: model.LabelConfig{
-			Hostnames: "com.chameth.vhost",
+			Hostnames:   "com.chameth.vhost",
+			RequireAuth: "com.chameth.auth",
 		},
 		DefaultCertActions:     model.COMBINE | model.FLATTEN,
 		DefaultCertDestination: "/data/certs/",
@@ -125,6 +126,11 @@ func getHostnames(containers map[string]model.Container, config model.Config) (h
 				}
 			}
 			addAlternatives(hostnames[names[0]], names[1:])
+
+			if label, ok = container.Labels[config.Labels.RequireAuth]; ok {
+				hostnames[names[0]].RequiresAuth = true
+				hostnames[names[0]].AuthGroup = label
+			}
 		}
 	}
 	return

model/model.go

@@ -24,7 +24,8 @@ type Container struct {
 
 // LabelConfig describes the labels used for various properties.
 type LabelConfig struct {
-	Hostnames string
+	Hostnames   string
+	RequireAuth string
 }
 
 // Hostname describes a DNS name used for proxying, retrieving certificates, etc.
@@ -34,6 +35,8 @@ type Hostname struct {
 	Containers      []Container
 	CertActions     CertActions
 	CertDestination string
+	RequiresAuth    bool
+	AuthGroup       string
 }
 
 // Config is the user-definable configuration for Dotege.

templates/haproxy.cfg.tpl

@@ -26,8 +26,9 @@ frontend main
     use_backend {{ .Name | replace "." "_" }} if {hdr(host) -i {{ .Name }}
         {{- range $san, $_ := .Alternatives }} || hdr(host) -i {{ $san }} {{- end -}}
     }
-{{- end }}
-{{- range .Hostnames }}
+{{- end -}}
+
+{{ range .Hostnames }}
 
 backend {{ .Name | replace "." "_" }}
     mode http
@@ -36,4 +37,8 @@ backend {{ .Name | replace "." "_" }}
     server server1 {{ .Name }}:{{ index .Labels "com.chameth.proxy" }} check resolvers docker_resolver
         {{- end -}}
     {{- end -}}
+    {{- if .RequiresAuth }}
+    acl authed_{{ .Name | replace "." "_" }} http_auth({{ .AuthGroup }})
+    http-request auth if !authed_{{ .Name | replace "." "_" }}
+    {{- end -}}
 {{ end }}