exception handling

README.md

@@ -1,5 +1,5 @@
 # Alpine :: Traefik Labels
-![size](https://img.shields.io/docker/image-size/11notes/traefik-labels/amd64-0.1.8?color=0eb305) ![version](https://img.shields.io/docker/v/11notes/traefik-labels/amd64-0.1.8?color=eb7a09) ![pulls](https://img.shields.io/docker/pulls/11notes/traefik-labels?color=2b75d6) ![activity](https://img.shields.io/github/commit-activity/m/11notes/docker-traefik-labels?color=c91cb8) ![commit-last](https://img.shields.io/github/last-commit/11notes/docker-traefik-labels?color=c91cb8)
+![size](https://img.shields.io/docker/image-size/11notes/traefik-labels/amd64-0.1.10?color=0eb305) ![version](https://img.shields.io/docker/v/11notes/traefik-labels/amd64-0.1.10?color=eb7a09) ![pulls](https://img.shields.io/docker/pulls/11notes/traefik-labels?color=2b75d6) ![activity](https://img.shields.io/github/commit-activity/m/11notes/docker-traefik-labels?color=c91cb8) ![commit-last](https://img.shields.io/github/last-commit/11notes/docker-traefik-labels?color=c91cb8)
 
 Run Traefik Labels based on Alpine Linux. Small, lightweight, secure and fast 🏔️
 
@@ -10,6 +10,9 @@ In order to use this image, you need to setup Traefik with a Redis provider and
 
 This image provides the ability to call a webhook for each container for each event or poll after the data was updates in Redis and or nsupdate.
 
+## Volumes
+* **/labels/ssl** - Directory of ssl certificates for TLS<sup>1</sup>
+
 ## Run
 ```shell
 docker run --name traefik-labels \
@@ -27,6 +30,15 @@ docker run --name traefik-labels \
   -d 11notes/traefik-labels:[tag]
 ```
 
+```shell
+docker run --name traefik-labels \
+  -v .../ssl:/labels/ssl \
+  -e LABELS_REDIS_URL="rediss://foo:bar@10.127.198.254:6379/0" \
+  -e LABELS_WEBHOOK="https://domain.com/traefik/labels" \
+  -e LABELS_WEBHOOK_AUTH_BASIC="foo:bar" \
+  -d 11notes/traefik-labels:[tag]
+```
+
 ## Examples
 ```shell
 docker run --name traefik-demo \
@@ -49,11 +61,11 @@ docker run --name traefik-rfc2136-demo \
   -l "traefik/http/services/demo.domain.com/loadbalancer/servers/0/url=http://fqdn-of-docker-node:8080" \
   -l "rfc2136/WAN/server=ns.domain.com" \
   -l "rfc2136/WAN/key=algo:name:secret" \
-  -l "rfc2136/WAN/nsupdate=update add foo.domain.com A 175.12.41.11" \
-  -l "rfc2136/WAN/nsupdate=update add foo.domain.com TXT \"hello from traefik-labels!\"" \
+  -l "rfc2136/WAN/nsupdate=update add foo.domain.com 300 A 175.12.41.11" \
+  -l "rfc2136/WAN/nsupdate=update add foo.domain.com 300 TXT \"hello from traefik-labels!\"" \
   -l "rfc2136/LAN/server=ns.domain.local" \
   -l "rfc2136/LAN/key=algo:name:secret" \
-  -l "rfc2136/LAN/nsupdate=update add foo.domain.local A 192.168.12.54" \
+  -l "rfc2136/LAN/nsupdate=update add foo.domain.local 300 A 192.168.12.54" \
   -d 11notes/nginx:stable
 ```
 
@@ -65,16 +77,23 @@ docker run --name traefik-rfc2136-demo \
 | `gid` | 1000 | group id 1000 |
 | `home` | /labels | home directory of user docker |
 | `api` | https://${IP}:5000 | HTTPS endpoint of Docker registry |
+| `ca.crt` | /labels/ssl/ca.crt | Certificate of CA for TLS<sup>1</sup> |
+| `labels.crt` | /labels/ssl/labels.crt | Certificate of client for TLS<sup>1</sup> |
+| `labels.key` | /labels/ssl/labels.key | Private key of client for TLS<sup>1</sup> |
 
 ## Environment
 | Parameter | Value | Default |
 | --- | --- | --- |
-| `TZ` | [Time Zone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) | null |
+| `TZ` | [Time Zone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) | |
+| `DEBUG` | Show debug information | |
 | `LABELS_REDIS_URL` | the redis URL to connect, use rediss:// for SSL | rediss://localhost:6379/0 |
 | `LABELS_INTERVAL` | in what interval container information is pulled in seconds | 300 |
 | `LABELS_TIMEOUT` | how many seconds after an interval the keys should stay till they expire in seconds | 30 |
 | `LABELS_WEBHOOK` | URL to call on each event or poll for each container |  |
 | `LABELS_WEBHOOK_AUTH_BASIC` | Basic authentication to use in the form of "username:password" for the webhook |  |
+| `LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE` | Only update DNS entries if they are new or changed (will use dig on each call to the set server) |  |
+| `LABELS_DOCKER_IP` | Used for TLS<sup>1</sup> authentication against dockerd | localhost |
+| `LABELS_DOCKER_PORT` | Used for TLS<sup>1</sup> authentication against dockerd | 2376 |
 
 ## Parent image
 * [11notes/node:stable](https://hub.docker.com/r/11notes/node)
@@ -88,4 +107,18 @@ docker run --name traefik-rfc2136-demo \
 ## Tips
 * Only use rootless container runtime (podman, rootless docker)
 * Don't bind to ports < 1024 (requires root), use NAT/reverse proxy (haproxy, traefik, nginx)
-* Do not access docker.sock as root
+* Do not access docker.sock as root
+* Use TLS if you can't access docker.sock as non-root
+
+## Disclaimers
+* <sup>1</sup> For TLS to work you need proper certificates in place for your dockerd and your clients. The CN in the certificate needs to match the FQDN or IP you have set on the docker node, you can set multiple by using SAN. See an example of a daemon.json configuration to enable TLS.
+```json
+{
+  "tls": true,
+  "tlsverify": true,
+  "tlscacert": "/etc/docker/ca.crt",
+  "tlscert": "/etc/docker/server.crt",
+  "tlskey": "/etc/docker/server.key",
+  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"]
+}
+```

amd64.dockerfile

@@ -27,6 +27,7 @@
       cd ${APP_ROOT}; \
       npm --save install \
         redis@4.6.11 \
+        js-yaml@4.1.0 \
         dockerode@4.0.0;
 
   # :: update image

arm64v8.dockerfile

@@ -33,6 +33,7 @@
       cd ${APP_ROOT}; \
       npm --save install \
         redis@4.6.11 \
+        js-yaml@4.1.0 \
         dockerode@4.0.0;
 
   # :: update image

hooks/post_push

@@ -0,0 +1,4 @@
+#!/bin/bash
+curl -Lo manifest-tool https://github.com/estesp/manifest-tool/releases/download/v0.9.0/manifest-tool-linux-amd64
+chmod +x manifest-tool
+./manifest-tool push from-spec multi-arch-manifest.yaml

multi-arch-manifest.yaml

@@ -0,0 +1,11 @@
+image: 11notes/traefik-labels:latest
+manifests:
+  - image: 11notes/traefik-labels:amd64-0.2.0
+    platform:
+      architecture: amd64
+      os: linux
+  - image: 11notes/traefik-labels:arm64v8-0.2.0
+    platform:
+      architecture: arm64
+      os: linux
+      variant: v8

rootfs/labels/dig.js

@@ -0,0 +1,27 @@
+const { spawn } = require('node:child_process');
+const { elevenLogJSON } = require('/labels/lib/util.js');
+
+exports.dig = async(resolver, type, record) => {
+  return(new Promise((resolve, reject) => {
+    const dig = spawn('/usr/bin/dig', ['+short', '+answer', type, record, `@${resolver}`]);
+    const io = {stdout:'', stderr:''};
+    dig.stderr.on('data', data => {io.stderr += data.toString()});
+    dig.stdout.on('data', data => {io.stdout += (data.toString()).replace(/[\r\n]*$/ig, '')});
+    dig.on('error', error => {reject(error)});
+    dig.on('close', code =>{
+      elevenLogJSON('debug', {method:'dig()', params:{resolver:resolver, type:type, record:record}, io:io});
+      switch(true){
+        case /no servers could be reached/ig.test(io.stdout): io.stderr += io.stdout; break;
+      }
+      if(code === 0){
+        if(io.stderr.length > 0){
+          reject(io.stderr);
+        }else{
+          resolve(io.stdout);
+        }
+      }else{
+        reject(io.stderr);
+      }
+    });
+  }));
+}

rootfs/labels/etc/config.yaml

@@ -0,0 +1,20 @@
+labels:
+  redis:
+    url: rediss://foo:bar@10.127.198.254:6379/0
+  webhook:
+    url: https://my.cool.webhook/v1
+    auth:
+      basic: labels:*****
+  nodes:
+    - 192.168.18.12
+    - 10.14.120.1
+  rfc2136:
+    update-only: true
+  poll:
+    interval: 300
+  ping:
+    interval: 2.5
+  tls:
+    ca: /labels/ssl/ca.crt
+    crt: /labels/ssl/server.crt
+    key: /labels/ssl/server.key

rootfs/labels/main.js

@@ -1,126 +1,179 @@
-process.once('SIGTERM', () => process.exit(0));
-process.once('SIGINT', () => process.exit(0));
-
+const fs = require('fs');
+const util = require('util');
 const Docker = require('dockerode');
+const yaml = require('js-yaml');
 const redis = require('redis');
 const { nsupdate } = require('./nsupdate');
+const { dig } = require('./dig');
 const { elevenLogJSON } = require('/labels/lib/util.js');
 
-const ENV_REDIS_INTERVAL = parseInt(process.env?.LABELS_INTERVAL || 300);
-const ENV_REDIS_TIMEOUT = parseInt(process.env?.LABELS_TIMEOUT|| 30);
-const ENV_LABELS_WEBHOOK = process.env?.LABELS_WEBHOOK;
-const ENV_LABELS_WEBHOOK_AUTH_BASIC = process.env?.LABELS_WEBHOOK_AUTH_BASIC;
-
-elevenLogJSON('info', {config:{
-  LABELS_INTERVAL :ENV_REDIS_INTERVAL,
-  LABELS_TIMEOUT:ENV_REDIS_TIMEOUT,
-  LABELS_WEBHOOK:ENV_LABELS_WEBHOOK,
-  LABELS_WEBHOOK_AUTH_BASIC:((ENV_LABELS_WEBHOOK_AUTH_BASIC) ? true: false)
-}});
-
 class Labels{
-  #docker;
+  #config = yaml.load(fs.readFileSync(`${process.env.APP_ROOT}/etc/config.yaml`, 'utf8'))?.labels;
+  #defaults = {
+      tls:{
+        ca:`${process.env.APP_ROOT}/ssl/ca.crt`,
+        crt:`${process.env.APP_ROOT}/ssl/labels.crt`,
+        key:`${process.env.APP_ROOT}/ssl/labels.key`,
+        port:2376
+      },poll:{interval:300}, ping:{interval:2.5}, redis:{url:'rediss://localhost:6379/0'}, rfc2136:{'update-only':false}};
+  #intervals = {ping:false, poll:false};
+  #loops = {ping:false, poll:false};
   #redis;
-  #poll = false;
-  #webhook = {
-    headers:{'Content-Type':'application/json'}
-  };
+  #nodes = {};
 
   constructor(){
-    this.#docker = new Docker({socketPath:'/run/docker.sock'});
-    if(ENV_LABELS_WEBHOOK_AUTH_BASIC){
-      this.#webhook.headers['Authorization'] = 'Basic ' + Buffer.from(ENV_LABELS_WEBHOOK_AUTH_BASIC).toString('base64')
+    for(const node of this.#config?.nodes){
+      this.#nodes[node] = new Docker({
+        protocol:'https',
+        host:node,
+        port:this.#config?.tls?.port || this.#defaults.tls.port,
+        ca:fs.readFileSync(this.#config?.tls?.ca || this.#defaults.tls.ca),
+        cert:fs.readFileSync(this.#config?.tls?.crt || this.#defaults.tls.crt),
+        key:fs.readFileSync(this.#config?.tls?.key || this.#defaults.tls.key),
+      });
+      this.#nodes[node].labels = {ping:false, firstConnect:true};
+    }
+
+    if(this.#config?.webhook?.url){
+      this.#config.webhook.headers = {'Content-Type':'application/json'};
+      switch(true){
+        case this.#config?.webhook?.auth?.basic:
+          this.#config.webhook.headers['Authorization'] = 'Basic ' + Buffer.from(this.#config.webhook.auth.basic).toString('base64');
+          break;
+      }      
     }
   }
 
-  async watch(){
+  async watch(){  
     this.#redis = await redis.createClient({
-      url:process.env.LABELS_REDIS_URL,
+      url:this.#config?.redis?.url || this.#defaults.redis.url,
       pingInterval:30000,
       socket:{
         rejectUnauthorized: false,
       }
     });
 
-    this.#redis.connect();
-    this.#redis.on('ready', ()=>{
-      (async() => {
-        await this.dockerPoll();
-      })();
-      this.dockerEvents();
+    this.#redis.on('ready', async()=>{
+      elevenLogJSON('info', `connected to redis`);
+      await this.#ping();
+      await this.#poll();
     });
 
     this.#redis.on('error', error =>{
-      elevenLogJSON('error', error);
+      elevenLogJSON('error', JSON.stringify({redis:{exception:e.toString()}}));
     });
 
-    setInterval(async() => {
-      await this.dockerPoll();
-    }, ENV_REDIS_INTERVAL*1000);
+    this.#redis.connect();
   }
 
-  dockerEvents(){
-    this.#docker.getEvents({}, (error, data) => {
-      if(error){
-        elevenLogJSON('error', error);
-      }else{
-        data.on('data', async(chunk) => {
-          const event = JSON.parse(chunk.toString('utf8'));
-          if(/Container/i.test(event?.Type) && /^(start|kill)$/i.test(event?.status)){
-            await this.dockerInspect(event.id, event.status);
+  async #ping(){
+    if(!this.#intervals.ping){
+      this.#intervals.ping = true;
+      setInterval(async() => {
+        if(!this.#loops.ping){
+          this.#loops.ping = true;
+          try{
+            await this.#ping()
+          }catch(e){
+            elevenLogJSON('error', JSON.stringify({ping:{exception:e.toString()}}));
+          }finally{
+            this.#loops.ping = false;
           }
-        });
-      }
-    });
-  }
+        }
+      }, (this.#config?.ping?.interval || this.#defaults.ping.interval)*1000);
+    }
 
-  async dockerPoll(){
-    if(!this.#poll){
+    for(const node in this.#nodes){
       try{
-        this.#poll = true;
-        this.#docker.listContainers((error, containers) => {
-          if(!error){
-            containers.forEach(async(container) => {
-              await this.dockerInspect(container.Id, 'poll');
-            });
-          }
-        });
+        await this.#nodes[node].ping();
+        if(!this.#nodes[node].labels.ping){
+          elevenLogJSON('info', `connected to node [${node}]`);
+          this.#nodes[node].getEvents({}, (error, data) => {
+            if(!error){
+              data.on('data', async(chunk) =>{
+                const event = JSON.parse(chunk.toString('utf8'));
+                if(/Container/i.test(event?.Type) && /^(start|die)$/i.test(event?.status)){
+                  await this.#inspect(node, event.id, event.status);
+                }
+              });
+            }else{
+              elevenLogJSON('error', JSON.stringify({getEvents:{exception:error.toString()}}));
+            }
+          });
+        }
+        this.#nodes[node].labels.ping = true;
       }catch(e){
-        elevenLogJSON('error', e);
-      }finally{
-        this.#poll = false;
+        elevenLogJSON('error', JSON.stringify({ping:{exception:e.toString()}}));
+        if(this.#nodes[node].labels.ping){
+          elevenLogJSON('warning', `connection to node [${node}] lost!`);
+        }else if(this.#nodes[node].labels.firstConnect){
+          this.#nodes[node].labels.firstConnect = false;
+          elevenLogJSON('warning', `connection to node [${node}] failed!`);
+        }
+        this.#nodes[node].labels.ping = false;
       }
     }
   }
 
-  async dockerInspect(id, status = null){
+  async #poll(){
+    if(!this.#intervals.poll){
+      this.#intervals.poll = true;
+      setInterval(async() => {
+        if(!this.#loops.poll){
+          this.#loops.poll = true;
+          try{
+            await this.#poll()
+          }catch(e){
+            elevenLogJSON('error', JSON.stringify({poll:{exception:e.toString()}}));
+          }finally{
+            this.#loops.poll = false;
+          }
+        }
+      }, (this.#config?.poll?.interval || this.#defaults.poll.interval)*1000);
+    }
+
+    for(const node in this.#nodes){
+      try{
+        await this.#nodes[node].listContainers((error, containers) => {
+          if(!error){
+            containers.forEach(async(container) => {
+              await this.#inspect(node, container.Id, 'poll');
+            });
+          }
+        });
+      }catch(e){
+        elevenLogJSON('error', JSON.stringify({listContainers:{exception:e.toString()}}));
+      }
+    }
+  }
+
+  async #inspect(node, id, event){
     return(new Promise((resolve, reject) => {
-      const container = this.#docker.getContainer(id);
+      const container = this.#nodes[node].getContainer(id);
       container.inspect(async(error, data) => {
         if(!error){
-          const update = (/start|poll/i.test(status)) ? true : false;
           const container = {
-            event:status,
+            name:(data?.Name || data?.id).replace(/^\//i, ''),
+            event:event,
+            run:(/start|poll/i.test(event)) ? true : false,
             labels:{
               traefik:[],
               rfc2136:[],
             },
           };
 
+          elevenLogJSON('info', `[${node}] container [${container.name}] event [${container.event}]`);
+
           const rfc2136 = {
             WAN:{server:'', key:'', commands:[]},
             LAN:{server:'', key:'', commands:[]},
           }
-
-          elevenLogJSON('info', `inspect container {${(data?.Name || data?.id).replace(/^\//i, '')}}${(
-            (null === status) ? '' : ` event[${status}]`
-          )}`);
-      
+          
           for(const label in data?.Config?.Labels){
             switch(true){
               case /traefik\//i.test(label):
-                if(update){
-                  await this.#redis.set(label, data.Config.Labels[label], {EX:ENV_REDIS_INTERVAL + ENV_REDIS_TIMEOUT});
+                if(container.run){
+                  await this.#redis.set(label, data.Config.Labels[label], {EX:(this.#config?.poll?.interval || this.#defaults.poll.interval) + 30});
                 }else{
                   await this.#redis.del(label);
                 }
@@ -140,7 +193,7 @@ class Labels{
                   break;
 
                   default:
-                    if(!update){
+                    if(!container.run){
                       data.Config.Labels[label] = data.Config.Labels[label].replace(/update add/i, 'update delete');
                     }
                     rfc2136[type].commands.push(data.Config.Labels[label]);
@@ -149,31 +202,61 @@ class Labels{
             }
           }
 
-          for(const type in rfc2136){
-            if(rfc2136[type].commands.length > 0 && rfc2136[type].server && rfc2136[type].key){
-              try{
-                await nsupdate(rfc2136[type].server, rfc2136[type].key, rfc2136[type].commands);
-              }catch(e){
-                elevenLogJSON('error', e);
-              }
-            }
+          if(rfc2136.LAN.commands.length > 0 || rfc2136.WAN.commands.length){
+            await this.#rfc2136(rfc2136);
           }
 
-          if(ENV_LABELS_WEBHOOK){           
-            try{
-              await fetch(ENV_LABELS_WEBHOOK, {method:(
-                (update) ? 'PUT' : 'DELETE'
-              ), body:JSON.stringify(container), headers:this.#webhook.headers, signal:AbortSignal.timeout(2500)});
-            }catch(e){
-              elevenLogJSON('error', e);
-            }
+          if(this.#config?.webhook?.url){
+            await this.#webhook(container);
           }
-
-          resolve(true);
         }
-      });
+      })
+      resolve(true);
     }));
   }
+
+  async #rfc2136(rfc2136){
+    for(const type in rfc2136){
+      if(rfc2136[type].commands.length > 0 && rfc2136[type].server && rfc2136[type].key){
+        if(this.#config?.rfc2136?.['update-only'] || this.#defaults?.rfc2136?.['update-only']){
+          for(let i=0; i<rfc2136[type].commands.length; i++){
+            if(await this.#rfc2136knownRecord(rfc2136[type].server, rfc2136[type].commands[i])){
+              rfc2136[type].commands.splice(i, 1);
+            }
+          }
+        }
+        try{
+          if(rfc2136[type].commands.length > 0){
+            await nsupdate(rfc2136[type].server, rfc2136[type].key, rfc2136[type].commands);
+          }
+        }catch(e){
+          elevenLogJSON('error', JSON.stringify({nsupdate:{exception:e.toString()}}));
+        }
+      }
+    }
+  }
+
+  async #rfc2136knownRecord(server, nsupdate){
+    const matches = nsupdate.match(/update add (\S+) \d+ (\S+) (\S+)/i);
+    if(matches && matches.length >= 4){
+      try{
+        const record = await dig(server, matches[2], matches[1]);
+        return((record.match(new RegExp(matches[3], 'ig'))));
+      }catch(e){
+        return(false);
+      }
+    }    
+  }
+
+  async #webhook(container){
+    try{
+      await fetch(this.#config.webhook.url, {method:(
+        (container.run) ? 'PUT' : 'DELETE'
+      ), body:JSON.stringify(container), headers:this.#config.webhook.headers, signal:AbortSignal.timeout(2500)});
+    }catch(e){
+      elevenLogJSON('error', JSON.stringify({webhook:{exception:e.toString()}}));
+    }
+  }
 }
 
 new Labels().watch();

rootfs/labels/nsupdate.js

@@ -1,22 +1,28 @@
 const { spawn } = require('node:child_process');
+const { elevenLogJSON } = require('/labels/lib/util.js');
 
 exports.nsupdate = async(server, key, commands) => {
+
   commands.unshift(`server ${server}`);
   commands.push('send');
+  commands.push('quit');
+
   return(new Promise((resolve, reject) => {
+    elevenLogJSON('debug', {method:'nsupdate()', params:{server:server, key:'******', commands:commands}});
     const nsupdate = spawn('/usr/bin/nsupdate', ['-y', key]);
-    let errors = '';
-    nsupdate.stderr.on('data', data  =>{errors += data.toString()});
+    const io = {stdout:'', stderr:''};
+    nsupdate.stderr.on('data', data => {io.stderr += data.toString()});
+    nsupdate.stdout.on('data', data => {io.stdout += (data.toString()).replace(/[\r\n]*$/ig, '')});
     nsupdate.on('error', error => {reject(error)});
-    nsupdate.on('exit', code =>{
+    nsupdate.on('close', code =>{
       if(code === 0){
-        if(errors.length > 0){
-          reject(errors);
+        if(io.stderr.length > 0){
+          reject(io.stderr);
         }else{
-          resolve(true);
+          resolve(io.stdout);
         }
       }else{
-        reject(errors);
+        reject(io.stderr);
       }
     });
     for(const command of commands){