Merge lp:~erik-lonroth/charm-haproxy/certdirs into lp:~haproxy-team/charm-haproxy/trunk-old-use-git

[Tom Haddon]

Add support for directory with SSL pem certs

Add support for directory with SSL pem certs

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

LGTM, thx

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change cannot be self approved, setting status to needs review.

[lp:~erik-lonroth/charm-haproxy/certdirs]

168. By Erik Lönroth on 2023-10-24

Indent bind_stanza

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 164

=== modified file 'README.md'
--- README.md	2022-02-04 23:08:05 +0000
+++ README.md	2023-10-24 08:46:12 +0000
@@ -145,6 +145,55 @@
 the `source` configuration option to `backports` or to whatever PPA/archive you
 wish to use.
 
+## SSL Termination with directory for certs
+
+You can configure services to use a filesystem path in the *crts*. This is a good fit when you might have certbot or acme.sh to maintain certificates outside of haproxy itself.
+
+This is an example of this:
+
+Create a services.yaml file for the microsample service:
+
+```
+- service_name: microsample
+  service_host: "0.0.0.0"
+  service_port: 443
+  service_options:
+    - mode http
+    - balance leastconn
+  crts: [/var/lib/haproxy/certs]
+```
+
+```
+juju deploy microsample
+juju deploy haproxy
+juju relate haproxy microsample
+```
+
+Create the directory and self signed certificate in haproxy/0
+```
+juju exec --unit haproxy/0 -- sudo mkdir -p /var/lib/haproxy/certs
+openssl genpkey -algorithm RSA -out example.key
+openssl req -x509 -new -key example.key -out example.crt
+cat example.key example.crt > /var/lib/haproxy/certs/example.pem
+```
+
+Configure haproxy with the services.yaml content.
+
+`juju config haproxy services="$(cat services.yaml)"`
+
+This produces a stanza in haproxy.cfg as:
+
+```
+frontend haproxy-0-443
+    bind 0.0.0.0:443 ssl crt /var/lib/haproxy/certs no-sslv3
+    default_backend microsample
+    mode http
+```
+
+Once you have valid certs in the directory, they will be used.
+
+You can validate with `curl -k https://haproxy/` which should now reply with "Online".
+
 ## Monitoring
 
 Telegraf is recommended for monitoring HAProxy. To do so, deploy the

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2023-08-30 07:16:33 +0000
+++ hooks/hooks.py	2023-10-24 08:46:12 +0000
@@ -416,14 +416,19 @@
         # Enable SSL termination for this frontend, using the given
         # certificates.
         bind_stanza += " ssl"
-        for i, crt in enumerate(service_crts):
-            if crt == "DEFAULT":
-                path = os.path.join(default_haproxy_lib_dir, "default.pem")
-            else:
-                path = os.path.join(default_haproxy_lib_dir,
-                                    "service_%s" % service_name, "%d.pem" % i)
-            # SSLv3 is always off, since it's vulnerable to POODLE attacks
+        if len(service_crts) == 1 and os.path.isdir(service_crts[0]):
+            log("Service configured to use '%s' for certificates in haproxy.cfg." % service_crts[0])
+            path = service_crts[0]
             bind_stanza += " crt %s no-sslv3" % path
+        else:
+            for i, crt in enumerate(service_crts):
+                if crt == "DEFAULT":
+                    path = os.path.join(default_haproxy_lib_dir, "default.pem")
+                else:
+                    path = os.path.join(default_haproxy_lib_dir,
+                                        "service_%s" % service_name, "%d.pem" % i)
+                # SSLv3 is always off, since it's vulnerable to POODLE attacks
+                bind_stanza += " crt %s no-sslv3" % path
     service_config.append(bind_stanza)
     service_config.append("    default_backend %s" % (service_name,))
     service_config.extend("    %s" % service_option.strip()
@@ -836,17 +841,21 @@
                 f.write(base64.b64decode(errorfile["content"]))
 
         # Write to disk the content of the given SSL certificates
+        # or use a single path element to search for them.
         crts = service_config.get('crts', [])
-        for i, crt in enumerate(crts):
-            if crt == "DEFAULT" or crt == "EXTERNAL":
-                continue
-            content = base64.b64decode(crt)
-            path = get_service_lib_path(service_name)
-            full_path = os.path.join(path, "%d.pem" % i)
-            write_ssl_pem(full_path, content)
-            with open(full_path, 'w') as f:
-                f.write(content.decode('utf-8'))
-
+        if len(crts) == 1 and os.path.isdir(crts[0]):
+            log("Service configured to use path to look for certificates in haproxy.cfg.")
+        else:
+            for i, crt in enumerate(crts):
+                if crt == "DEFAULT" or crt == "EXTERNAL":
+                    continue
+                content = base64.b64decode(crt)
+                path = get_service_lib_path(service_name)
+                full_path = os.path.join(path, "%d.pem" % i)
+                write_ssl_pem(full_path, content)
+                with open(full_path, 'w') as f:
+                    f.write(content.decode('utf-8'))
+            
         if not os.path.exists(default_haproxy_service_config_dir):
             os.mkdir(default_haproxy_service_config_dir, 0o600)
         with open(os.path.join(default_haproxy_service_config_dir,