github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

fix: map caddy healthcheck headers and apply tls-internal

Browse Source 
Caddy healthchecks now honor the `attempts` and `httpHeaders` properties of the `app.json` readiness healthcheck, matching openresty. The `tls-internal` property was also never applied to app containers, and now takes effect for apps served over https.
This commit is contained in:
Jose Diaz-Gonzalez
2026-09-26 01:17:30 -04:00
parent 83c9c4d72e
commit 06f80b1a93
6 changed files with 205 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
plugins/caddy-vhosts/docker-args-process-deploy
View File

@@ -95,7 +95,6 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
ssl_warning_mapping="https:443"
if [[ "$tls_internal" == "true" ]]; then
output="--label caddy.tls=internal"
if [[ "$has_443_mapping" == "false" ]]; then
ssl_warning_mapping="http:80"
proxy_host_https_port_candidate="$proxy_host_http_port_candidate"
@@ -107,6 +106,9 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
scheme="http"
if [[ -n "$letsencrypt_email" ]] && [[ "$has_443_mapping" == "true" ]]; then
output="--label 'caddy=${caddy_domains}'"
if [[ "$tls_internal" == "true" ]]; then
output="$output --label caddy.tls=internal"
fi
scheme="https"
if [[ -z "$proxy_container_https_port" ]]; then
warning_scheme="$(awk -F ':' '{ print $1 }' <<<"$ssl_warning_mapping")"
@@ -129,7 +131,7 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
fi
if [[ "$output" == *"caddy.reverse_proxy="* ]]; then
output="$output$(fn-caddy-healthcheck-labels "$APP" "$app_domains")"
output="$output$(fn-caddy-healthcheck-labels "$APP")"
fi
fi
@@ -146,9 +148,8 @@ trigger-caddy-vhosts-docker-args-process-deploy() {
fn-caddy-healthcheck-labels() {
declare desc="outputs caddy reverse_proxy health check and retry labels derived from the app's web readiness healthcheck"
declare APP="$1" APP_DOMAINS="$2"
local healthcheck hc_path hc_port hc_timeout hc_interval hc_host domain
local -a domains
declare APP="$1"
local healthcheck hc_path hc_port hc_timeout hc_interval hc_attempts hc_host name value
healthcheck="$(fn-proxy-get-readiness-healthcheck "$APP")"
if [[ -z "$healthcheck" ]]; then
@@ -159,28 +160,44 @@ fn-caddy-healthcheck-labels() {
hc_port="$(echo "$healthcheck" | jq -r ".port // empty")"
hc_timeout="$(echo "$healthcheck" | jq -r ".timeout // 5")"
hc_interval="$(echo "$healthcheck" | jq -r ".wait // 5")"
hc_attempts="$(echo "$healthcheck" | jq -r ".attempts // 3")"
if ! fn-proxy-healthcheck-path-is-valid "$hc_path"; then
dokku_log_fail "Invalid app.json healthcheck path for caddy: path must start with a / and must not contain whitespace, control characters, quotes, or backslashes"
fi
read -r -d '' -a domains <<<"$APP_DOMAINS" || true
for domain in "${domains[@]}"; do
if [[ "$domain" == "localhost" ]] || [[ "$domain" == '*' ]]; then
continue
fi
hc_host="$domain"
break
done
hc_host="$(fn-proxy-get-healthcheck-host "$APP" "$healthcheck")"
echo -n " --label \"caddy.reverse_proxy.health_uri=$hc_path\""
[[ -n "$hc_port" ]] && echo -n " --label caddy.reverse_proxy.health_port=$hc_port"
echo -n " --label caddy.reverse_proxy.health_interval=${hc_interval}s"
echo -n " --label caddy.reverse_proxy.health_timeout=${hc_timeout}s"
[[ -n "$hc_host" ]] && echo -n " --label caddy.reverse_proxy.health_headers.Host=$hc_host"
echo -n " --label caddy.reverse_proxy.health_fails=$hc_attempts"
if [[ -n "$hc_host" ]] && fn-proxy-healthcheck-header-is-valid "Host" "$hc_host" && [[ "$hc_host" != *[[:space:]]* ]]; then
echo -n " --label caddy.reverse_proxy.health_headers.Host=$hc_host"
fi
while IFS=$'\t' read -r name value; do
[[ -z "$name" ]] && continue
if ! fn-caddy-healthcheck-header-name-is-valid "$name" || ! fn-proxy-healthcheck-header-is-valid "$name" "$value"; then
dokku_log_warn "Skipping invalid app.json healthcheck header for caddy: $name"
continue
fi
echo -n " --label 'caddy.reverse_proxy.health_headers.$name=\"$value\"'"
done < <(fn-proxy-get-healthcheck-headers "$healthcheck")
echo -n " --label caddy.reverse_proxy.lb_try_duration=5s"
echo -n " --label caddy.reverse_proxy.lb_try_interval=250ms"
}
fn-caddy-healthcheck-header-name-is-valid() {
declare desc="checks that a healthcheck header name can be used as a caddy label segment, which may not contain dots or end in an _<number> ordering suffix"
declare NAME="$1"
[[ "$NAME" == *.* ]] && return 1
[[ "$NAME" =~ _[0-9]+$ ]] && return 1
return 0
}
trigger-caddy-vhosts-docker-args-process-deploy "$@"