ixc/letsencrypt-dockercloud-haproxy

A fork of Docker Cloud's HAproxy image and a companion Let's Encrypt image that automate SSL termination.

DEPRECATED

Do not use this repository. Use https://github.com/ixc/letsencrypt-docker instead, which works with the official dockercloud-haproxy image and fixes a few problems and limitations with this letsencrypt image.

Overview

The haproxy image will:

• Create a self signed default certificate, so HAproxy can start before we have any real certificates.

• Watch the /etc/letsencrypt/live directory and when changes are detected, install combined certificates and reload HAproxy.

The letsencrypt image will:

• Automatically create or renew certificates on startup and daily thereafter.

Usage

In your stack file:

• Link to the letsencrypt service from the haproxy service.

• Use volumes_from: letsencrypt in the haproxy service.

• Define a DOMAINS environment variable in the letsencrypt service. Certificates are separated by semi-colon (;) and domains are separated by comma (,).

• Define an EMAIL environment variable in the letsencrypt service. It will be used for all certificates.

• Define an OPTIONS environment variable in the letsencrypt service, if you want to pass additional arguments to certbot (e.g. --staging).

Several environment variables are hard coded, and don't need to be defined in your stack file:

• The DEFAULT_SSL_CERT environment variable is set to the value of the default/first Let's Encrypt certificate (if not already explicitly set), to ensure SSL termination is enabled.

• The VIRTUAL_HOST and VIRTUAL_HOST_WEIGHT environment variables are hard coded in the letsencrypt image, to ensure challenge requests for all domains are proxied to the letsencrypt service.

A sample stack file is provided.

letsencrypt-dockercloud-haproxy's Issues

haproxy and lets encrypt error

docker_letsencrypt_1 exited with code 1
letsencrypt_1  | [FATAL tini (5)] Executing child process 'entrypoint.sh' failed: 'Permission denied'

Im receiving this error if i tried to use this repo to build my image manually
and not one in dockerhub.

im using version 2 of docker-compose

but when i use version 1

i can use this properly

can you help me out how to properly build this...

seems like im missing something out

Staying within letsencypt rate limits

I want to spawn a discussion for potential improvements to this image regarding letencrypt protocol.

To quote this: https://letsencrypt.org/docs/rate-limits/

We also have a Duplicate Certificate limit of 5 certificates per week. A certificate is considered a duplicate of an earlier certificate if they contain the exact same set of hostnames, ignoring capitalization and ordering of hostnames. For instance, if you requested a certificate for the names [www.example.com, example.com], you could request four more certificates for [www.example.com, example.com] during the week. If you changed the set of names by adding [blog.example.com], you would be able to request additional certificates.

In current implement there's a daily call to create a certificate, so we have 7 call per week. Doesn't it violate Duplicate Certificate limit ?

Also what is the reason to renew ceritificates daily? According to https://certbot.eff.org/docs/using.html#renewing-certificates:

Let’s Encrypt CA issues short-lived certificates (90 days). Make sure you renew the certificates at least once in 3 months.

Certbot errors fail silently, certbot.sh

I'm testing this on Docker Cloud. One month ago, it worked seamlessly. Today it is failing silently. Seems like the certbot error logs are not appearing in docker's logs.

Can anyone confirm this is working for them?

haproxy complains when there are more than 1 SSL certs/domains coming through

I wasn't getting this error when I requested just one cert from letsencrypt. FYI, no errors in letsencrypt or my web servers. Not sure if haproxy is the real problem or not here... Here is the snippet from the lb when the haproxy complains:

[lb-1]2016-11-26T21:56:49.350394180Z INFO:haproxy:Reloading HAProxy
[lb-1]2016-11-26T21:56:49.363492281Z INFO:haproxy:HAProxy has been reloaded(PID: 30)
[lb-1]2016-11-26T21:56:49.364151661Z INFO:haproxy:===========END===========
[lb-1]2016-11-26T21:56:49.406120086Z INFO:haproxy:HAProxy(PID:29) has been terminated
[lb-1]2016-11-26T21:56:49.894737641Z CREATE,ISDIR /etc/letsencrypt/live/markieta.ca
[lb-1]2016-11-26T21:56:49.906073281Z CREATE /etc/letsencrypt/live/markieta.ca/cert.pem
[lb-1]2016-11-26T21:56:49.914332485Z CREATE /etc/letsencrypt/live/markieta.ca/privkey.pem
[lb-1]2016-11-26T21:56:49.922300829Z CREATE /etc/letsencrypt/live/markieta.ca/chain.pem
[lb-1]2016-11-26T21:56:49.928972615Z CREATE /etc/letsencrypt/live/markieta.ca/fullchain.pem
[lb-1]2016-11-26T21:56:59.613760646Z CREATE,ISDIR /etc/letsencrypt/live/spatialanalysis.ca
[lb-1]2016-11-26T21:56:59.621936243Z CREATE /etc/letsencrypt/live/spatialanalysis.ca/cert.pem
[lb-1]2016-11-26T21:56:59.623813928Z CREATE /etc/letsencrypt/live/spatialanalysis.ca/privkey.pem
[lb-1]2016-11-26T21:56:59.625625873Z CREATE /etc/letsencrypt/live/spatialanalysis.ca/chain.pem
[lb-1]2016-11-26T21:56:59.630197100Z CREATE /etc/letsencrypt/live/spatialanalysis.ca/fullchain.pem
[lb-1]2016-11-26T21:57:49.953933838Z INFO:haproxy:==========BEGIN==========
[lb-1]2016-11-26T21:57:49.954814072Z INFO:haproxy:User reload
[lb-1]2016-11-26T21:57:49.968204501Z INFO:haproxy:Impossible to call blocking function in the event loop callback
[lb-1]2016-11-26T21:57:49.978240656Z Traceback (most recent call last):
[lb-1]2016-11-26T21:57:49.979418851Z   File "/usr/lib/python2.7/site-packages/haproxy/eventhandler.py", line 54, in on_user_reload
[lb-1]2016-11-26T21:57:49.983192963Z     run_haproxy("User reload")
[lb-1]2016-11-26T21:57:49.983452483Z   File "/usr/lib/python2.7/site-packages/haproxy/haproxycfg.py", line 24, in run_haproxy
[lb-1]2016-11-26T21:57:49.984560304Z     haproxy = Haproxy(config.LINK_MODE, msg)
[lb-1]2016-11-26T21:57:49.984791724Z   File "/usr/lib/python2.7/site-packages/haproxy/haproxycfg.py", line 48, in __init__
[lb-1]2016-11-26T21:57:49.985134610Z     self.specs = self._initialize(self.link_mode)
[lb-1]2016-11-26T21:57:49.985337307Z   File "/usr/lib/python2.7/site-packages/haproxy/haproxycfg.py", line 53, in _initialize
[lb-1]2016-11-26T21:57:49.985643884Z     links = Haproxy._init_cloud_links()
[lb-1]2016-11-26T21:57:49.985837307Z   File "/usr/lib/python2.7/site-packages/haproxy/haproxycfg.py", line 67, in _init_cloud_links
[lb-1]2016-11-26T21:57:49.986133620Z     haproxy_container = fetch_remote_obj(HAPROXY_CONTAINER_URI)
[lb-1]2016-11-26T21:57:49.986325534Z   File "/usr/lib/python2.7/site-packages/haproxy/utils.py", line 31, in fetch_remote_obj
[lb-1]2016-11-26T21:57:49.987113591Z     time.sleep(config.API_RETRY)
[lb-1]2016-11-26T21:57:49.987380461Z   File "/usr/lib/python2.7/site-packages/gevent/hub.py", line 194, in sleep
[lb-1]2016-11-26T21:57:49.989923072Z     hub.wait(loop.timer(seconds, ref=ref))
[lb-1]2016-11-26T21:57:49.990193096Z   File "/usr/lib/python2.7/site-packages/gevent/hub.py", line 627, in wait
[lb-1]2016-11-26T21:57:49.990570957Z     result = waiter.get()
[lb-1]2016-11-26T21:57:49.990864437Z   File "/usr/lib/python2.7/site-packages/gevent/hub.py", line 875, in get
[lb-1]2016-11-26T21:57:49.991194013Z     return self.hub.switch()
[lb-1]2016-11-26T21:57:49.991395863Z   File "/usr/lib/python2.7/site-packages/gevent/hub.py", line 605, in switch
[lb-1]2016-11-26T21:57:49.991699353Z     switch_out()
[lb-1]2016-11-26T21:57:49.991894467Z   File "/usr/lib/python2.7/site-packages/gevent/hub.py", line 609, in switch_out
[lb-1]2016-11-26T21:57:49.992212473Z     raise BlockingSwitchOutError('Impossible to call blocking function in the event loop callback')
[lb-1]2016-11-26T21:57:49.992822048Z BlockingSwitchOutError: Impossible to call blocking function in the event loop callback
[lb-1]2016-11-26T21:57:50.253027458Z INFO:haproxy:Websocket close

Full log is here: https://gist.github.com/MichaelMarkieta/05dc07b20fa5bc3d15ce8ec915529c2d