Skip to content

Commit 083b1e6

Browse files
vityamanvityaman
authored
#92 Add HAProxy as a private gateway (#96)
Signed-off-by: vityaman <vityaman.dev@yandex.ru>
1 parent adc39e8 commit 083b1e6

File tree

6 files changed

+94
-26
lines changed

6 files changed

+94
-26
lines changed

‎backend/haproxy/Dockerfile

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
FROM haproxy:latest
2+
3+
COPY ./config/itmo-dating-backend.pem /usr/local/etc/haproxy/itmo-dating-backend.pem
4+
COPY ./config/itmo-dating-backend-ca.crt /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
5+
6+
COPY ./config/haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg

‎backend/haproxy/config/haproxy.cfg

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
global
2+
log stdout format raw local0 debug
3+
4+
defaults
5+
log global
6+
option httplog
7+
option dontlognull
8+
option logasap
9+
mode http
10+
11+
timeout client 10s
12+
timeout connect 5s
13+
timeout server 10s
14+
timeout http-request 10s
15+
16+
default-server check inter 10s fall 2 rise 1
17+
18+
frontend internal
19+
bind :8445 ssl crt /usr/local/etc/haproxy/itmo-dating-backend.pem
20+
bind :8446 ssl crt /usr/local/etc/haproxy/itmo-dating-backend.pem
21+
bind :8455 ssl crt /usr/local/etc/haproxy/itmo-dating-backend.pem
22+
bind :8456 ssl crt /usr/local/etc/haproxy/itmo-dating-backend.pem
23+
bind :8457 ssl crt /usr/local/etc/haproxy/itmo-dating-backend.pem
24+
25+
use_backend vault if { dst_port 8445 }
26+
use_backend consul if { dst_port 8446 }
27+
use_backend authik if { dst_port 8455 }
28+
use_backend matchmaker if { dst_port 8456 }
29+
use_backend people if { dst_port 8457 }
30+
31+
backend vault
32+
option httpchk GET /v1/sys/health?standbycode=200&sealedcode=200&uninitcode=200&drsecondarycode=200&performancestandbycode=200
33+
server vault vault.dating.se.ifmo.ru:8200 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
34+
35+
backend consul
36+
option httpchk GET /ui
37+
server consul server.dc1.consul:8500 check init-addr last,libc,none
38+
39+
backend authik
40+
balance roundrobin
41+
option httpchk GET /actuator/health
42+
server authik-0 authik-0.dating.se.ifmo.ru:8080 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
43+
server authik-1 authik-1.dating.se.ifmo.ru:8080 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
44+
45+
backend matchmaker
46+
balance roundrobin
47+
option httpchk GET /actuator/health
48+
server matchmaker-0 matchmaker-0.dating.se.ifmo.ru:8080 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
49+
server matchmaker-1 matchmaker-1.dating.se.ifmo.ru:8080 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
50+
51+
backend people
52+
balance roundrobin
53+
option httpchk GET /actuator/health
54+
server people-0 people-0.dating.se.ifmo.ru:8080 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt
55+
server people-1 people-1.dating.se.ifmo.ru:8080 check init-addr last,libc,none ssl verify required ca-file /usr/local/etc/haproxy/itmo-dating-backend-ca.crt

‎backend/script/crypto/keys.bash

+16-4
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ STARTER_SERVICE_DISCOVERY_INSTALL_PATH="starter-service-discovery/$INTERNAL_INST
1818
GATEWAY_INSTALL_PATH="gateway/$INTERNAL_INSTALL_PATH"
1919
CONSUL_INSTALL_PATH="consul/config"
2020
VAULT_INSTALL_PATH="vault/config"
21+
HAPROXY_INSTALL_PATH="haproxy/config"
2122

2223
function generate() {
2324
echo "Phase: Generate"
@@ -74,8 +75,11 @@ function generate() {
7475
-destkeystore "$ALIAS_BACKEND.jks" \
7576
-deststorepass "$PASSWORD"
7677

77-
echo "Copying PKCS12 as external certificate"
78+
echo "Copying PKCS12 as external certificate..."
7879
cp "$ALIAS_BACKEND.p12" "$ALIAS_EXTERNAL.p12"
80+
81+
echo "Creating unified .pem..."
82+
cat "$ALIAS_BACKEND.crt" "$ALIAS_BACKEND.key" > "$ALIAS_BACKEND.pem"
7983
}
8084

8185
function copy() {
@@ -107,6 +111,10 @@ function distribute() {
107111
copy "$VAULT_INSTALL_PATH" "$ALIAS_BACKEND.key"
108112
copy "$VAULT_INSTALL_PATH" "$ALIAS_BACKEND.crt"
109113
copy "$VAULT_INSTALL_PATH" "$ALIAS_BACKEND-ca.crt"
114+
115+
echo "Copying keys to the HAProxy..."
116+
copy "$HAPROXY_INSTALL_PATH" "$ALIAS_BACKEND.pem"
117+
copy "$HAPROXY_INSTALL_PATH" "$ALIAS_BACKEND-ca.crt"
110118
}
111119

112120
function remove() {
@@ -126,19 +134,23 @@ function clear() {
126134
echo "Removing package from the starter-service-discovery..."
127135
remove "$STARTER_SERVICE_DISCOVERY_INSTALL_PATH" "$ALIAS_BACKEND.jks"
128136

129-
echo "Removing package from the gateway..."
137+
echo "Removing package from the Gateway..."
130138
remove "$GATEWAY_INSTALL_PATH" "$ALIAS_EXTERNAL.p12"
131139

132-
echo "Removing keys from the consul..."
140+
echo "Removing keys from the Consul..."
133141
remove "$CONSUL_INSTALL_PATH" "$ALIAS_BACKEND.key"
134142
remove "$CONSUL_INSTALL_PATH" "$ALIAS_BACKEND.crt"
135143
remove "$CONSUL_INSTALL_PATH" "$ALIAS_BACKEND-ca.crt"
136144

137-
echo "Removing keys from the vault..."
145+
echo "Removing keys from the Vault..."
138146
remove "$VAULT_INSTALL_PATH" "$ALIAS_BACKEND.key"
139147
remove "$VAULT_INSTALL_PATH" "$ALIAS_BACKEND.crt"
140148
remove "$VAULT_INSTALL_PATH" "$ALIAS_BACKEND-ca.crt"
141149

150+
echo "Removing keys from the HAProxy..."
151+
remove "$HAPROXY_INSTALL_PATH" "$ALIAS_BACKEND.pem"
152+
remove "$HAPROXY_INSTALL_PATH" "$ALIAS_BACKEND-ca.crt"
153+
142154
echo "Removing local outputs..."
143155
rm -rf "$ALIAS_BACKEND.crt"
144156
rm -rf "$ALIAS_BACKEND.csr"

‎backend/starter-tls/src/main/resources/application-tls-test.yml

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
client:
2+
ssl:
3+
key-store-password: testing-keystore-password
14
server:
25
ssl:
36
key-store-password: testing-keystore-password

‎backend/starter-tls/src/main/resources/application-tls.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ client:
1010
ssl:
1111
key-store-type: PKCS12
1212
key-store: classpath:keystore/itmo-dating-backend.p12
13-
key-store-password: ${server.ssl.key-store-password}
13+
key-store-password: ${ITMO_DATING_KEY_STORE_PASSWORD}
1414
protocol: TLSv1.3

‎compose.yml

+13-21
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ services:
88
ITMO_DATING_KEY_STORE_PASSWORD: ${ITMO_DATING_KEYSTORE_PASSWORD?:err}
99
tty: true
1010
hostname: authik-0.dating.se.ifmo.ru
11-
ports:
12-
- "127.0.0.1:18000:8080"
1311
depends_on:
1412
database:
1513
condition: service_healthy
@@ -21,8 +19,6 @@ services:
2119
extends:
2220
service: authik-0
2321
hostname: authik-1.dating.se.ifmo.ru
24-
ports:
25-
- "127.0.0.1:18001:8080"
2622
profiles:
2723
- reliability
2824
matchmaker-0:
@@ -34,8 +30,6 @@ services:
3430
ITMO_DATING_KEY_STORE_PASSWORD: ${ITMO_DATING_KEYSTORE_PASSWORD?:err}
3531
tty: true
3632
hostname: matchmaker-0.dating.se.ifmo.ru
37-
ports:
38-
- "127.0.0.1:18010:8080"
3933
depends_on:
4034
database:
4135
condition: service_healthy
@@ -45,8 +39,6 @@ services:
4539
extends:
4640
service: matchmaker-0
4741
hostname: matchmaker-1.dating.se.ifmo.ru
48-
ports:
49-
- "127.0.0.1:18011:8080"
5042
profiles:
5143
- reliability
5244
people-0:
@@ -58,8 +50,6 @@ services:
5850
ITMO_DATING_KEY_STORE_PASSWORD: ${ITMO_DATING_KEYSTORE_PASSWORD?:err}
5951
tty: true
6052
hostname: people-0.dating.se.ifmo.ru
61-
ports:
62-
- "127.0.0.1:18020:8080"
6353
depends_on:
6454
database:
6555
condition: service_healthy
@@ -71,8 +61,6 @@ services:
7161
extends:
7262
service: people-0
7363
hostname: people-1.dating.se.ifmo.ru
74-
ports:
75-
- "127.0.0.1:18021:8080"
7664
profiles:
7765
- reliability
7866
object-storage:
@@ -93,8 +81,6 @@ services:
9381
timeout: 5s
9482
retries: 5
9583
hostname: object-storage.dating.se.ifmo.ru
96-
ports:
97-
- "127.0.0.1:9001:9001"
9884
database:
9985
image: postgres
10086
environment:
@@ -115,9 +101,10 @@ services:
115101
build:
116102
context: ./backend/gateway
117103
environment:
118-
ITMO_DATING_EXT_KEY_STORE_PASSWORD: ${ITMO_DATING_KEYSTORE_PASSWORD?:err}
104+
ITMO_DATING_EXT_KEY_STORE_PASSWORD: ${ITMO_DATING_EXT_KEY_STORE_PASSWORD?:err}
119105
ITMO_DATING_KEY_STORE_PASSWORD: ${ITMO_DATING_KEYSTORE_PASSWORD?:err}
120106
tty: true
107+
hostname: gateway.dating.se.ifmo.ru
121108
ports:
122109
- "444:8080"
123110
config:
@@ -128,8 +115,6 @@ services:
128115
ITMO_DATING_KEY_STORE_PASSWORD: ${ITMO_DATING_KEYSTORE_PASSWORD?:err}
129116
tty: true
130117
hostname: config.dating.se.ifmo.ru
131-
ports:
132-
- "127.0.0.1:445:8080"
133118
depends_on:
134119
vault:
135120
condition: service_started
@@ -143,17 +128,24 @@ services:
143128
- consul-data:/opt/consul/data
144129
tty: true
145130
hostname: server.dc1.consul
146-
ports:
147-
- "127.0.0.1:8500:8500"
148-
- "127.0.0.1:8501:8501"
149131
vault:
150132
image: ghcr.io/secs-dev/itmo-dating-vault:latest
151133
build:
152134
context: ./backend/vault
153135
tty: true
154136
hostname: vault.dating.se.ifmo.ru
137+
haproxy:
138+
image: ghcr.io/secs-dev/itmo-dating-haproxy:latest
139+
build:
140+
context: ./backend/haproxy
141+
tty: true
142+
hostname: haproxy.dating.se.ifmo.ru
155143
ports:
156-
- "127.0.0.1:8200:8200"
144+
- "127.0.0.1:8445:8445"
145+
- "127.0.0.1:8446:8446"
146+
- "127.0.0.1:8455:8455"
147+
- "127.0.0.1:8456:8456"
148+
- "127.0.0.1:8457:8457"
157149
tg-miniapp:
158150
image: ghcr.io/secs-dev/itmo-dating-tg-miniapp:latest
159151
build:

0 commit comments

Comments
 (0)