github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Merge pull request #9176 from byjg/haproxy-easyhaproxy-6.5.1

Browse Source 
Haproxy letsencrypt integration and upgrade EasyHAProxy to 6.5.1
This commit is contained in:
Jose Diaz-Gonzalez
2026-10-23 16:02:34 -04:00
committed by GitHub
parent a73e6b67bc 4887cf458e
commit ad931ea817
6 changed files with 19 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/networking/proxies/haproxy.md
View File

@@ -185,6 +185,8 @@ dokku haproxy:set --global letsencrypt-email automated@dokku.sh
After enabling, the Haproxy container will need to be restarted and apps will need to be rebuilt. All http requests will then be redirected to https.
Certificates are requested over http-01 on port 80, so each domain must resolve to the server. They are kept in `/var/lib/dokku/data/haproxy` and renewed automatically.
#### Customizing the letsencrypt server
The letsencrypt integration is set to the production letsencrypt server by default. To change this, set the `letsencrypt-server` property with the `--global` flag:

2
plugins/haproxy-vhosts/Dockerfile
View File

@@ -1 +1 @@
FROM byjg/easy-haproxy:6.1.1
FROM byjg/easy-haproxy:6.5.1

19
plugins/haproxy-vhosts/docker-args-process-deploy
View File

@@ -103,22 +103,11 @@ trigger-haproxy-vhosts-docker-args-process-deploy() {
fi
fi
if [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; then
if [[ -z "$proxy_container_https_port" ]]; then
dokku_log_warn "Warning: https:443 port mapping not found"
dokku_log_warn "Utilizing first https port mapping, http:$proxy_host_https_port_candidate:$proxy_container_https_port_candidate"
proxy_container_https_port="$proxy_container_https_port_candidate"
fi
# EasyHAProxy serves https itself: it requests the certificate (certbot), terminates
# TLS on 443 and forwards to the same container port as http
if [[ -n "$letsencrypt_email" ]] && { [[ -n "$proxy_container_https_port" ]] || [[ -n "$proxy_container_https_port_candidate" ]]; }; then
output="$output --label haproxy.$APP-$PROC_TYPE.redirect_ssl=true"
output="$output --label haproxy.$APP-$PROC_TYPE-https.localport=$proxy_container_https_port"
output="$output --label haproxy.$APP-$PROC_TYPE-https.letsencrypt=true"
output="$output --label haproxy.$APP-$PROC_TYPE-https.mode=http"
output="$output --label haproxy.$APP-$PROC_TYPE-https.port=443"
if [[ -n "$haproxy_domains" ]]; then
output="$output --label haproxy.$APP-$PROC_TYPE-https.host=$haproxy_domains"
fi
output="$output --label haproxy.$APP-$PROC_TYPE.certbot=true"
else
output="$output --label haproxy.$APP-$PROC_TYPE.redirect_ssl=false"
fi

3
plugins/haproxy-vhosts/internal-functions
View File

@@ -39,7 +39,8 @@ fn-haproxy-template-compose-file() {
HAPROXY_LOG_LEVEL="$(fn-haproxy-computed-log-level)"
HAPROXY_LETSENCRYPT_EMAIL="$(fn-haproxy-computed-letsencrypt-email)"
HAPROXY_LETSENCRYPT_SERVER="$(fn-haproxy-computed-letsencrypt-server)"
HAPROXY_REFRESH_CONF="$(fn-haproxy-computed-refresh-conf)")
HAPROXY_REFRESH_CONF="$(fn-haproxy-computed-refresh-conf)"
HAPROXY_DATA_DIR="${DOKKU_LIB_ROOT}/data/haproxy")
sigil -f "$COMPOSE_TEMPLATE" "${SIGIL_PARAMS[@]}" | cat -s >"$OUTPUT_PATH"
}

7
plugins/haproxy-vhosts/templates/compose.yml.sigil
View File

@@ -11,10 +11,10 @@ services:
- CERTBOT_LOG_LEVEL={{ $.HAPROXY_LOG_LEVEL }}
- HAPROXY_LOG_LEVEL={{ $.HAPROXY_LOG_LEVEL }}
{{ if $.HAPROXY_LETSENCRYPT_EMAIL }}
- EASYHAPROXY_LETSENCRYPT_EMAIL={{ $.HAPROXY_LETSENCRYPT_EMAIL }}"
- EASYHAPROXY_LETSENCRYPT_SERVER={{ $.HAPROXY_LETSENCRYPT_SERVER }}
- EASYHAPROXY_CERTBOT_EMAIL={{ $.HAPROXY_LETSENCRYPT_EMAIL }}
- EASYHAPROXY_CERTBOT_SERVER={{ $.HAPROXY_LETSENCRYPT_SERVER }}
{{ end }}
- HAPROXY_STATS_PORT=false
- HAPROXY_STATS_ENABLE=false
network_mode: bridge
@@ -28,3 +28,4 @@ services:
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "{{ $.HAPROXY_DATA_DIR }}:/etc/easyhaproxy/certs/certbot"

6
tests/unit/haproxy.bats
View File

@@ -246,6 +246,12 @@ teardown() {
assert_success
assert_output "true"
run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"haproxy.$TEST_APP-web.certbot\" }}'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "true"
run /bin/bash -c "dokku ports:report $TEST_APP --ports-map"
echo "output: $output"
echo "status: $status"