Using labels to configure haproxy running on a different host

[paulschmeida]

Is it possible to run easy-haproxy in docker to read container labels, but then actually configure haproxy on a different host? I have haproxy running on my opnsense router and I have multiple servers at home. At the moment I'm using traefik but if I could have a single instance of haproxy on the router and it would automatically update when I bring containers up on various hosts, that would be the ideal setup.
If it's not possible, what would be the steps needed to implement something like that?

[byjg]

I believe the easiest way to have your containers "discoverable" by the HAProxy is creating a Docker Swarm cluster and every container you want to access is deployed in this cluster.

A docker swarm cluster won't change a lot how you are working with container. The only difference, you need to deploy "stacks".

TL;DR:

# On master:
docker swarm init    # Copy the join command and apply on Nodes. 

# On master, deploy the HAProxy

# On clients, deploy the stacks (see how to add labels on a docker swarm deployment):
docker stack deploy -c compose.yaml stack-name

Here an example using Docker Swarm:
https://github.com/byjg/docker-easy-haproxy/blob/master/examples/swarm/docker-compose.yml

More info about HAProxy and Docker Swarm:
https://github.com/byjg/docker-easy-haproxy/blob/master/docs/swarm.md

By the end of the week, I am deploying a version that will allow you to deploy your containers in different networks. Currently, you need to make sure both HAProxy and your containers are in the same network.

One important thing to mention it that on a Docker Swarm Cluster, you don't specify WHERE your container will be deployed. If that is the case, try this: https://stackoverflow.com/questions/63681999/how-to-deploy-container-to-subset-of-worker-nodes-in-a-docker-swarm-using-affini

Let me know if that helps you.

[paulschmeida]

Hi, byjg.
Thank you for the write up.
It's very informative but doesn't help with haproxy running as a plugin in OPNSense and not in docker.

[byjg]

In that case, it is possible, but will require extra work.

Let me know if in your environment you have:

• Python 3.9
• Nginx Daemon that you can control
• Docker Client (to connect to other Docker Containers)

[paulschmeida]

Yeah I have all of that and of necessary I can setup any environment I would need. Python 3.10 but if I have to downgrade to 3.9 then not a problem.

…

On Fri, 18 Nov 2022, 22:17 Joao M, ***@***.***> wrote: In that case, it is possible, but will require extra work. Let me know if in your environment you have: - Python 3.9 - Nginx Daemon that you can control - Docker Client (to connect to other Docker Containers) — Reply to this email directly, view it on GitHub <#34 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADHLLUOHUWVBTJ4XADXNNWLWI7553ANCNFSM6AAAAAASCLZ2FQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[byjg]

OK, any python above 3.9 is fine. I never tested this steps below, but I am confident this is the most accurate. I'd appreciate your feedback, so I can include in the documentation too.

Step 1: Clone the Repository

Step 2: Install OS and Python Requirements

Required OS packages:

• haproxy
• python3
• py3-pip
• py-yaml
• certbot
• openssl

cp -r build/assets /

cd src
pip install -r requirements.txt`

openssl dhparam -out /etc/haproxy/dhparam 2048
openssl dhparam -out /etc/haproxy/dhparam-1024 1024

Step 3: Adjust the code to handle HAProxy (start and reload)

EasyHAProxy will start and reload the script by itself. In the container, this is already set up. However, running it in your own installation, you need to find the proper commands to start and reload the HAProxy here.

Step 4: Set up the docker client to connect to the remote Host.

EasyHAProxy get the configuration from the environment. So, if you have a remote docker host where EasyHAProxy should inspect you might need to set up your docker environment. e.g.

export DOCKER_HOST="ssh://user@host"

Step 5: Run EasyHAProxy

python -u main.py

I hope this should be enough to run directly from your machine.

[paulschmeida]

Thank you for instructions, @byjg. I will try them as soon as possible but ATM things are moving slow as I'm changing jobs, redoing my proxmox server as a docker host and redoing my home network at the same time...