12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364 |
- #!/usr/bin/env python3
-
- import argparse
- import etcdlib
- import jinja2
- import os
- import os.path
-
- parser = argparse.ArgumentParser()
- parser.add_argument('--name', help='Name of the docker host to request certificates for', default='unknown')
- parser.add_argument('--etcd-port', type=int, help='Port to connect to etcd on', default=2379)
- parser.add_argument('--etcd-host', help='Host to connect to etcd on', default='etcd')
- parser.add_argument('--etcd-prefix', help='Prefix to use when retrieving keys from etcd', default='/docker')
- parser.add_argument('--trusted-cert-path', help='Path to use for trusted CA certificate. Use "%s" for hostname', default='/letsencrypt/certs/%s/chain.pem')
- parser.add_argument('--cert-path', help='Path to use for certificates. Use "%s" for hostname', default='/letsencrypt/certs/%s/fullchain.pem')
- parser.add_argument('--cert-key-path', help='Path to use for certificate private keys. Use "%s" for hostname', default='/letsencrypt/certs/%s/privkey.pem')
- parser.add_argument('--wellknown-path', help='Path to use for wellknown directory for http-01 challenge.', default='/letsencrypt/well-known/')
- args = parser.parse_args()
-
- jinja_env = jinja2.Environment(loader=jinja2.FileSystemLoader('/'))
- template = jinja_env.get_template('nginx.tpl')
- fetcher = etcdlib.Connection(args.etcd_host, args.etcd_port, args.etcd_prefix)
-
- while True:
- wroteConfig = False;
- services = {}
- domains = {k: v.split(',') for k, v in fetcher.get_label('com.chameth.vhost').items()}
- protocols = fetcher.get_label('com.chameth.proxy.protocol')
- defaults = fetcher.get_label('com.chameth.proxy.default')
- loadbalance = fetcher.get_label('com.chameth.proxy.loadbalance')
- for container, values in fetcher.get_label('com.chameth.proxy').items():
- networks = fetcher.get_networks(container)
- certfile = args.cert_path % domains[container][0];
- up = 'lb_' + loadbalance[container] if container in loadbalance else 'ct_' + container
- if os.path.isfile(certfile):
- if not up in services:
- services[up] = {
- 'protocol': protocols[container] if container in protocols else 'http',
- 'vhosts': domains[container],
- 'hosts': [],
- 'certificate': args.cert_path % domains[container][0],
- 'trusted_certificate': args.trusted_cert_path % domains[container][0],
- 'certificate_key': args.cert_key_path % domains[container][0],
- 'default': container in defaults,
- }
-
- services[up]['hosts'].append({
- 'host': next(iter(networks.values())), # TODO: Pick a bridge sensibly?
- 'port': values,
- })
-
- if wroteConfig or len(services) > 0 or not os.path.isfile('/nginx-config/vhosts.conf'):
- with open('/nginx-config/vhosts.conf', 'w') as f:
- print('Writing vhosts.conf...', flush=True)
- f.write(template.render(services=services, wellknown_path=args.wellknown_path))
- wroteConfig = True;
- print('Done writing config.', flush=True)
- else:
- print('Not writing empty config. Ensure that your letsencrypt certificates are accessible to this container.')
-
- print('Done writing config.', flush=True)
-
- fetcher.wait_for_update()
|