Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make the ACME developments testing easier #1769

Merged
merged 6 commits into from Jul 7, 2017
Merged

Make the ACME developments testing easier #1769

merged 6 commits into from Jul 7, 2017

Conversation

nmengin
Copy link
Contributor

@nmengin nmengin commented Jun 19, 2017

Description

The goal of this PR is to allow users to test easier the ACME develoments by providing :

  • A Docker-Compose environment which contains Traefik and all the Boulder stack,
  • A Traefik configuration file,
  • A script shell which does all needed checks and manages the docker-compose environment (start, stop, restart).

@nmengin nmengin self-assigned this Jun 19, 2017
emilevauge
emilevauge requested changes Jun 21, 2017
View reviewed changes
Copy link
Member

@emilevauge emilevauge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @nmengin ! Thanks for these useful scripts :)
I made few comments on typos.

examples/acme/Docker_Acme.md Outdated

## Objectives

In the way to test the integration to ACME, it exist containers to get a Let's encrypt simulated environment (named *boulder* below) .
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion:

In our integration ACME tests, we use a simulated Let's Encrypt container based stack named boulder.

examples/acme/Docker_Acme.md Outdated
In the way to test the integration to ACME, it exist containers to get a Let's encrypt simulated environment (named *boulder* below) .

The goal of this directory is to provide to developer a Traefik-boulder full stack environment.
This environment may be used in the way to test quickly developments on the ACME certificates management.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion:

This environment may be used in order to quickly test developments on ACME certificates management.

examples/acme/Docker_Acme.md Outdated
The goal of this directory is to provide to developer a Traefik-boulder full stack environment.
This environment may be used in the way to test quickly developments on the ACME certificates management.

Boulder stack provided is based on the environment used during integration tests.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The provided Boulder stack

examples/acme/Docker_Acme.md Outdated
The script **manage_acme_docker_environment.sh** requires one argument. This argument can have 3 values :

* **--start** : Check environment and launch Docker environment.
* **--stop** : Stop and delete current docker environment.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the current Docker

examples/acme/manage_acme_docker_environment.sh Outdated
echo "[ERROR] Impossible to stop the Docker environment" && exit 11
}

# Create dans start (up) environment of subpart of its services
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/dans/and
environment of subpart of its services not sure to understand this part

@ldez ldez added this to the 1.4 milestone Jun 26, 2017
ldez
ldez approved these changes Jun 27, 2017
View reviewed changes
Copy link
Member

@ldez ldez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

juliens
juliens approved these changes Jun 30, 2017
View reviewed changes
Copy link
Member

@juliens juliens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

dtomcej
dtomcej suggested changes Jul 4, 2017
View reviewed changes
examples/acme/compose-acme.yml Outdated
RABBITMQ_NODE_IP_ADDRESS: "0.0.0.0"

traefik:
image: traefik
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Friends don't let friends use :latest

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed @dtomcej 😉

In fact, I used containous/traefik:latest for my tests because it's the image generated with the make image command.
I will change the image to use containous/traefik:latest, either the user will use it's own generated image or he will use the last master branch image.

@dtomcej what is your mind about this?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wouldn't you want to use the compose build directive? build a docker container with the locally built binary?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dtomcej : done 😉

@ldez
Copy link
Member

ldez commented Jul 6, 2017

@nmengin you need to rebase dur to SemaphoreCI

@nmengin nmengin force-pushed the add-docker-compose-traefik-boulder-stack branch from d4ac53d to e64f417 Compare July 6, 2017 19:32
emilevauge
emilevauge reviewed Jul 6, 2017
View reviewed changes
Copy link
Member

@emilevauge emilevauge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry small typos again :)

examples/acme/Docker_Acme.md Outdated

In our integration ACME tests, we use a simulated Let's Encrypt container based stack named boulder.

The goal of this directory is to provide to developer a Traefik-boulder full stack environment.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

*developers

examples/acme/Docker_Acme.md Outdated

### Description

To work fine, boulder needs domain name, with related IP and storage file. The shell script allows to check the environment before to launch the Docker environment with the rights parameters and to manage this environment.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs a domain...with a related IP

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

before launching the...and managing

emilevauge
emilevauge approved these changes Jul 7, 2017
View reviewed changes
Copy link
Member

@emilevauge emilevauge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot @nmengin
LGTM

@guillemcanal
Copy link

@nmengin Very nice work. However, even if I add the "Happy Hacker Fake CA" in my trusted root certificates, the https://traefik.localhost.com certificate verification fail.

Here is the "Happy Hacker Fake CA" :

-----BEGIN CERTIFICATE-----
MIIEijCCA3KgAwIBAgICEk0wDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgY2Fj
a2xpbmcgY3J5cHRvZ3JhcGhlciBmYWtlIFJPT1QwHhcNMTUxMDIxMjAxMTUyWhcN
MjAxMDE5MjAxMTUyWjAfMR0wGwYDVQQDExRoYXBweSBoYWNrZXIgZmFrZSBDQTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMIKR3maBcUSsncXYzQT13D5
Nr+Z3mLxMMh3TUdt6sACmqbJ0btRlgXfMtNLM2OU1I6a3Ju+tIZSdn2v21JBwvxU
zpZQ4zy2cimIiMQDZCQHJwzC9GZn8HaW091iz9H0Go3A7WDXwYNmsdLNRi00o14U
joaVqaPsYrZWvRKaIRqaU0hHmS0AWwQSvN/93iMIXuyiwywmkwKbWnnxCQ/gsctK
FUtcNrwEx9Wgj6KlhwDTyI1QWSBbxVYNyUgPFzKxrSmwMO0yNff7ho+QT9x5+Y/7
XE59S4Mc4ZXxcXKew/gSlN9U5mvT+D2BhDtkCupdfsZNCQWp27A+b/DmrFI9NqsC
AwEAAaOCAcIwggG+MBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0eBDwwOqE4MAaC
BC5taWwwCocIAAAAAAAAAAAwIocgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAwDgYDVR0PAQH/BAQDAgGGMH8GCCsGAQUFBwEBBHMwcTAyBggrBgEFBQcw
AYYmaHR0cDovL2lzcmcudHJ1c3RpZC5vY3NwLmlkZW50cnVzdC5jb20wOwYIKwYB
BQUHMAKGL2h0dHA6Ly9hcHBzLmlkZW50cnVzdC5jb20vcm9vdHMvZHN0cm9vdGNh
eDMucDdjMB8GA1UdIwQYMBaAFOmkP+6epeby1dd5YDyTpi4kjpeqMFQGA1UdIARN
MEswCAYGZ4EMAQIBMD8GCysGAQQBgt8TAQEBMDAwLgYIKwYBBQUHAgEWImh0dHA6
Ly9jcHMucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcwPAYDVR0fBDUwMzAxoC+gLYYr
aHR0cDovL2NybC5pZGVudHJ1c3QuY29tL0RTVFJPT1RDQVgzQ1JMLmNybDAdBgNV
HQ4EFgQU+3hPEvlgFYMsnxd/NBmzLjbqQYkwDQYJKoZIhvcNAQELBQADggEBAA0Y
AeLXOklx4hhCikUUl+BdnFfn1g0W5AiQLVNIOL6PnqXu0wjnhNyhqdwnfhYMnoy4
idRh4lB6pz8Gf9pnlLd/DnWSV3gS+/I/mAl1dCkKby6H2V790e6IHmIK2KYm3jm+
U++FIdGpBdsQTSdmiX/rAyuxMDM0adMkNBwTfQmZQCz6nGHw1QcSPZMvZpsC8Skv
ekzxsjF1otOrMUPNPQvtTWrVx8GlR2qfx/4xbQa1v2frNvFBCmO59goz+jnWvfTt
j2NjwDZ7vlMBsPm16dbKYC840uvRoZjxqsdc3ChCZjqimFqlNG/xoPA8+dTicZzC
XE9ijPIcvW6y1aa3bGw=
-----END CERTIFICATE-----
  • Added in /usr/local/share/ca-certificates/happy.crt
  • Issued the sudo update-ca-certificates --fresh command
  • And then curl https://traefik.localhost.com

It fail with the message :

curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Thanks for your help ;)

@ldez ldez merged commit cb203f8 into traefik:master Jul 7, 2017
@ldez ldez changed the title Make the ACME developements testing easier Make the ACME developments testing easier Aug 28, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@juliens juliens juliens approved these changes

@ldez ldez ldez approved these changes

@emilevauge emilevauge emilevauge approved these changes

@dtomcej dtomcej dtomcej approved these changes

Assignees
No one assigned
Labels
area/acme kind/enhancement a new or improved feature.
Projects
None yet
Milestone
1.4
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@nmengin @ldez @guillemcanal @juliens @emilevauge @dtomcej