Support automatic Let's Encrypt

.travis.yml

@@ -1,15 +1,23 @@
 language: python
 cache:
   - pip
+addons:
+  hosts:
+    - jupyter.test
 env:
   global:
     - ETCDCTL_API=3
+    - LEGO_CA_SERVER_NAME=pebble
+    - LEGO_CA_CERTIFICATES=$GOPATH/src/github.com/letsencrypt/pebble/test/certs/localhost/cert.pem
 
 # installing dependencies
 before_install:
   - pip install --upgrade setuptools pip
   - pip install --pre -r dev-requirements.txt --upgrade .
   - pip install pytest-cov
+  # Install pebble
+  - go get -u github.com/letsencrypt/pebble/...
+  - (cd $GOPATH/src/github.com/letsencrypt/pebble && go install ./...)
 install:
   - python -m jupyterhub_traefik_proxy.install --traefik --etcd --consul --output=./bin
   - export PATH=$PWD/bin:$PATH

jupyterhub_traefik_proxy/proxy.py

@@ -23,7 +23,7 @@
 from subprocess import Popen
 from urllib.parse import urlparse
 
-from traitlets import Any, Bool, Dict, Integer, Unicode, default
+from traitlets import Any, Bool, Dict, Integer, List, Unicode, default
 from tornado.httpclient import AsyncHTTPClient
 
 from jupyterhub.utils import exponential_backoff, url_path_join, new_token
@@ -47,15 +47,29 @@ class TraefikProxy(Proxy):
     )
 
     traefik_api_validate_cert = Bool(
-        True,
-        config=True,
-        help="""validate SSL certificate of traefik api endpoint""",
+        True, config=True, help="""validate SSL certificate of traefik api endpoint"""
     )
 
     traefik_log_level = Unicode("ERROR", config=True, help="""traefik's log level""")
 
+    traefik_https_port = Integer(8443, config=True, help="""https port""")
+
+    traefik_auto_https = Bool(
+        False, config=True, help="""enable automatic HTTPS with Let's Encrypt"""
+    )
+
+    traefik_letsencrypt_email = Unicode(config=True, help="""Let's Encrypt email""")
+
+    traefik_letsencrypt_domains = List(config=True, help="""domains list""")
+
+    traefik_acme_server = Unicode(config=True, help="""the CA server to use""")
+
+    traefik_acme_storage = Unicode(
+        "acme.json", config=True, help="""file used for certificates storage"""
+    )
+
     traefik_api_password = Unicode(
-        config=True, help="""The password for traefik api login"""
+        config=True, help="""the password for traefik api login"""
     )
 
     @default("traefik_api_password")
@@ -217,21 +231,49 @@ async def _setup_traefik_static_config(self):
         self.static_config = {}
         self.static_config["debug"] = True
         self.static_config["logLevel"] = self.traefik_log_level
+
         entryPoints = {}
+        self.static_config["defaultentrypoints"] = ["http"]
+        entryPoints["http"] = {"address": ":" + str(urlparse(self.public_url).port)}
+
+        if self.traefik_auto_https:
+            self.static_config["defaultentrypoints"].append("https")
+
+            entryPoints["http"].update({"redirect": {"entrypoint": "https"}})
+
+            entryPoints["https"] = {
+                "address": ":" + str(self.traefik_https_port),
+                "tls": {},
+            }
+
+            acme = {
+                "email": self.traefik_letsencrypt_email,
+                "storage": self.traefik_acme_storage,
+                "entryPoint": "https",
+                "caServer": self.traefik_acme_server,
+                "httpChallenge": {"entryPoint": "http"},
+            }
+
+            acme["domains"] = []
+
+            for domain in self.traefik_letsencrypt_domains:
+                acme["domains"].append({"main": domain})
+
+            self.static_config["acme"] = acme
 
         if self.ssl_cert and self.ssl_key:
-            self.static_config["defaultentrypoints"] = ["https"]
+            self.static_config["defaultentrypoints"].append("https")
+
+            entryPoints["http"].update({"redirect": {"entrypoint": "https"}})
+
             entryPoints["https"] = {
-                "address": ":" + str(urlparse(self.public_url).port),
+                "address": ":" + str(self.traefik_https_port),
                 "tls": {
                     "certificates": [
                         {"certFile": self.ssl_cert, "keyFile": self.ssl_key}
                     ]
                 },
             }
-        else:
-            self.static_config["defaultentrypoints"] = ["http"]
-            entryPoints["http"] = {"address": ":" + str(urlparse(self.public_url).port)}
 
         auth = {
             "basic": {
@@ -248,20 +290,17 @@ async def _setup_traefik_static_config(self):
         self.static_config["api"] = {"dashboard": True, "entrypoint": "auth_api"}
         self.static_config["wss"] = {"protocol": "http"}
 
-
     def _routespec_to_traefik_path(self, routespec):
         path = self.validate_routespec(routespec)
-        if path != '/' and path.endswith('/'):
-            path = path.rstrip('/')
+        if path != "/" and path.endswith("/"):
+            path = path.rstrip("/")
         return path
 
-
     def _routespec_from_traefik_path(self, routespec):
-        if not routespec.endswith('/'):
-            routespec = routespec + '/'
+        if not routespec.endswith("/"):
+            routespec = routespec + "/"
         return routespec
 
-
     async def start(self):
         """Start the proxy.
 

jupyterhub_traefik_proxy/toml.py

@@ -94,6 +94,8 @@ def _clean_resources(self):
         try:
             if self.should_start:
                 os.remove(self.toml_static_config_file)
+                if self.traefik_auto_https:
+                    os.remove(self.traefik_acme_storage)
             os.remove(self.toml_dynamic_config_file)
         except:
             self.log.error("Failed to remove traefik's configuration files")

tests/config_files/pebble-config.json

@@ -0,0 +1,12 @@
+{
+  "pebble": {
+    "listenAddress": "0.0.0.0:14000",
+    "managementListenAddress": "0.0.0.0:15000",
+    "certificate": "$GOPATH/src/github.com/letsencrypt/pebble/test/certs/localhost/cert.pem",
+    "privateKey": "$GOPATH/src/github.com/letsencrypt/pebble/test/certs/localhost/key.pem",
+    "httpPort": 8000,
+    "tlsPort": 8443,
+    "ocspResponderURL": "",
+    "externalAccountBindingRequired": false
+  }
+}

tests/conftest.py

@@ -13,6 +13,39 @@
 from jupyterhub_traefik_proxy import TraefikTomlProxy
 
 
+@pytest.fixture
+async def autohttps_toml_proxy():
+    """Fixture returning a configured Let's Encrypt TraefikTomlProxy"""
+    proxy = TraefikTomlProxy(
+        public_url="http://127.0.0.1:8000",
+        traefik_api_password="admin",
+        traefik_api_username="api_admin",
+        should_start=True,
+        traefik_auto_https=True,
+        traefik_letsencrypt_email="[email protected]",
+        traefik_letsencrypt_domains=["jupyter.test"],
+        traefik_acme_server="https://0.0.0.0:14000/dir",
+        traefik_https_port=8443,
+    )
+
+    await proxy.start()
+    yield proxy
+    await proxy.stop()
+
+
+@pytest.fixture
+async def pebble():
+    pebble_server = subprocess.Popen(
+        ["pebble", "-config", "./tests/config_files/pebble-config.json"],
+        stdout=None,
+        stderr=None,
+    )
+    yield pebble_server
+
+    pebble_server.kill()
+    pebble_server.wait()
+
+
 @pytest.fixture
 async def no_auth_consul_proxy(consul_no_acl):
     """

tests/proxytest.py

@@ -356,3 +356,36 @@ async def test_websockets(proxy, launch_backend):
         port = await websocket.recv()
 
     assert port == str(default_backend_port)
+
+
+async def test_autohttps(autohttps_toml_proxy, pebble, launch_backend):
+    proxy = autohttps_toml_proxy
+
+    routespec = "/autohttps"
+    target = "http://127.0.0.1:9900"
+
+    backend_port = 9900
+    launch_backend(backend_port)
+
+    await wait_for_services([proxy.public_url, target])
+
+    await proxy.add_route(routespec, target, {})
+
+    # Test the actual routing
+    req = HTTPRequest(proxy.public_url + routespec, method="GET", validate_cert=False)
+    resp = await AsyncHTTPClient().fetch(req)
+    backend_response = int(resp.body.decode("utf-8"))
+
+    # Test we were redirected to https
+    # https://127.0.0.1:8443/autohttps
+    expected_final_redirect_url = (
+        "https://"
+        + urlparse(proxy.public_url).hostname
+        + ":"
+        + str(proxy.traefik_https_port)
+        + routespec
+    )
+    assert resp.effective_url == expected_final_redirect_url
+
+    # Test redirection to the route added
+    assert backend_response == backend_port