Skip to content

Consul key/value collision #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Consul key/value collision #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c7572ee
Use SERVICE_NAME to make it possible to run several nginx servers on …
sberryman Apr 11, 2017
37f720e
Need service name in 1 more location!
sberryman Apr 11, 2017
a2e6afb
[WARN] -consul has been renamed to -consul-addr
sberryman Apr 11, 2017
91b5d21
Turns out the service name is hard coded everywhere!
sberryman Apr 11, 2017
7029bef
Add some documentation for SERVICE_NAME
sberryman Apr 11, 2017
55fd2e1
Add default service_name of "nginx" to templates
sberryman Apr 12, 2017
b2e346a
Merge remote-tracking branch 'autopilotpattern/master' into acme-cons…
sberryman Jun 16, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,50 @@ services:
network_mode: bridge
```

#### Multiple nginx, same consul cluster

To run more than one Nginx balancer against the same consul cluster you'll need
to namespace them using the `SERVICE_NAME` environment variable. (Default: `nginx`)

Example:

```yaml
nginx_1:
image: autopilotpattern/nginx
restart: always
mem_limit: 512m
env_file: _env
environment:
- BACKEND=example
- CONSUL_AGENT=1
- ACME_ENV=staging
- ACME_DOMAIN=example.com
- SERVICE_NAME=nginx_1
ports:
- 80
- 443
- 9090
labels:
- triton.cns.services=nginx-1
nginx_2:
image: autopilotpattern/nginx
restart: always
mem_limit: 512m
env_file: _env
environment:
- BACKEND=example
- CONSUL_AGENT=1
- ACME_ENV=staging
- ACME_DOMAIN=dev.example.com
- SERVICE_NAME=nginx_2
ports:
- 80
- 443
- 9090
labels:
- triton.cns.services=nginx-2
```

### Examples

The `examples/` directory includes a manifest for deploying via Docker Compose to a local Docker environment and a manifest for deploying to Joyent's Triton Cloud. The `examples/backend` directory is a simple Node.js application that acts as a demonstration for registering backends and updating the Nginx configuration via watching Consul. You can build the example applications with `make build/examples`.
Expand Down
9 changes: 5 additions & 4 deletions bin/acme
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,14 @@ pushd `dirname $0` > /dev/null
SCRIPTPATH=`pwd -P`
popd > /dev/null

SERVICE_NAME_DEFAULT=${SERVICE_NAME:-nginx}
CONSUL_HOST_DEFAULT=${CONSUL:-consul}
if [ "${CONSUL_AGENT}" != "" ]; then
CONSUL_HOST_DEFAULT="localhost"
fi
CONSUL_HOST=${CONSUL_HOST:-$CONSUL_HOST_DEFAULT}
CONSUL_ROOT="http://${CONSUL_HOST}:8500/v1"
CONSUL_KEY_ROOT="${CONSUL_ROOT}/kv/nginx"
CONSUL_KEY_ROOT="${CONSUL_ROOT}/kv/${SERVICE_NAME:-$SERVICE_NAME_DEFAULT}"

SESSION_DIR_DEFAULT="/var/consul"
SESSION_DIR=${SESSION_DIR:-$SESSION_DIR_DEFAULT}
Expand All @@ -22,7 +23,7 @@ CERT_DIR="/var/www/ssl"
ACME_ENV=${ACME_ENV:-staging}

function getConsulSession () {
if [ -f $SESSION_FILE ]; then
if [ -f $SESSION_FILE ]; then
SID=$(cat ${SESSION_DIR}/session)
local STATUS=$(curl -s ${CONSUL_ROOT}/session/info/${SID})
if [ "${STATUS}" != "[]" ]; then
Expand All @@ -39,7 +40,7 @@ function getConsulSession () {
function renewConsulSession () {
local SID="$(getConsulSession)"
rc=$?
if [ $rc -ne 0 ]; then
if [ $rc -ne 0 ]; then
createConsulSession
return $?
else
Expand Down Expand Up @@ -127,7 +128,7 @@ case "$1" in
acquireLeader
;;
watch)
/usr/local/bin/consul-template -config /etc/acme/watch.hcl -consul $CONSUL_HOST:8500
/usr/local/bin/consul-template -config /etc/acme/watch.hcl -consul-addr $CONSUL_HOST:8500
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was changed as a warning was output to stdout by consul-template

;;
init)
if [ -f ${CERT_DIR}/fullchain.pem -a -f ${CERT_DIR}/privkey.pem ]; then
Expand Down
3 changes: 2 additions & 1 deletion etc/acme/dehydrated/hook.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,14 @@
#!/usr/bin/env bash
set -o pipefail

SERVICE_NAME_DEFAULT=${SERVICE_NAME:-nginx}
CONSUL_HOST_DEFAULT=${CONSUL:-consul}
if [ "${CONSUL_AGENT}" != "" ]; then
CONSUL_HOST_DEFAULT="localhost"
fi
CONSUL_HOST=${CONSUL_HOST:-$CONSUL_HOST_DEFAULT}
CONSUL_ROOT="http://${CONSUL_HOST}:8500/v1"
CONSUL_KEY_ROOT="${CONSUL_ROOT}/kv/nginx"
CONSUL_KEY_ROOT="${CONSUL_ROOT}/kv/${SERVICE_NAME:-$SERVICE_NAME_DEFAULT}"
CHALLENGE_PATH="/.well-known/acme-challenge"

function deploy_challenge {
Expand Down
4 changes: 3 additions & 1 deletion etc/acme/templates/cert.ctmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
{{if key "nginx/acme/cert"}}{{key "nginx/acme/cert"}}{{end}}
{{ $service_name := env "SERVICE_NAME" }}
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WARNING!!! No default SERVICE_NAME

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should have a default service name nginx.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, honestly I'm not sure how to do it and I didn't have time yesterday to look. Just needed it working to show off a few things

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This appears fixed with {{ $service_name := or $service_name "nginx" }} below.

{{ $service_name := or $service_name "nginx" }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not saying the following with certainty, but there's a chance we'll also (or alternatively) want to set SERVICE_NAME to nginx as a default value in the Dockerfile. That would result in reliably getting a env var, even if the user doesn't supply one.

If I remember correctly, that syntax would look like:

ENV SERVICE_NAME =${SERVICE_NAME:-nginx}

{{if key (print $service_name "/acme/cert")}}{{key (print $service_name "/acme/key")}}{{end}}
4 changes: 3 additions & 1 deletion etc/acme/templates/chain.ctmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
{{if key "nginx/acme/chain"}}{{key "nginx/acme/chain"}}{{end}}
{{ $service_name := env "SERVICE_NAME" }}
{{ $service_name := or $service_name "nginx" }}
{{if key (print $service_name "/acme/chain")}}{{key (print $service_name "/acme/chain")}}{{end}}
8 changes: 5 additions & 3 deletions etc/acme/templates/challenge-token.ctmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
{{if key "nginx/acme/challenge/token-filename"}}{{key "nginx/acme/challenge/token-filename"}}{{end}}
{{if key "nginx/acme/challenge/token-value"}}{{key "nginx/acme/challenge/token-value"}}{{end}}
{{if key "nginx/acme/challenge/last-token-filename"}}{{key "nginx/acme/challenge/last-token-filename"}}{{end}}
{{ $service_name := env "SERVICE_NAME" }}
{{ $service_name := or $service_name "nginx" }}
{{if key (print $service_name "/acme/token-filename")}}{{key (print $service_name "/acme/token-filename")}}{{end}}
{{if key (print $service_name "/acme/token-value")}}{{key (print $service_name "/acme/token-value")}}{{end}}
{{if key (print $service_name "/acme/last-token-filename")}}{{key (print $service_name "/acme/last-token-filename")}}{{end}}
4 changes: 3 additions & 1 deletion etc/acme/templates/fullchain.ctmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
{{if key "nginx/acme/fullchain"}}{{key "nginx/acme/fullchain"}}{{end}}
{{ $service_name := env "SERVICE_NAME" }}
{{ $service_name := or $service_name "nginx" }}
{{if key (print $service_name "/acme/fullchain")}}{{key (print $service_name "/acme/fullchain")}}{{end}}
4 changes: 3 additions & 1 deletion etc/acme/templates/privkey.ctmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
{{if key "nginx/acme/key"}}{{key "nginx/acme/key"}}{{end}}
{{ $service_name := env "SERVICE_NAME" }}
{{ $service_name := or $service_name "nginx" }}
{{if key (print $service_name "/acme/key")}}{{key (print $service_name "/acme/key")}}{{end}}
1 change: 1 addition & 0 deletions test/testing
Open in desktop
Submodule testing added at 196e0e
1 change: 0 additions & 1 deletion test/triton-docker-cli
Open in desktop
Submodule triton-docker-cli deleted from 031e98