Building penvoyage<\/h2>\n
The penvoyage folder used for building contains <\/p>\n FROM envoyproxy\/envoy:latest EXPOSE 80\/tcp LABEL version=”0.2.0″ \\ Take care with the ” characters, WordPress might mess them up!<\/p>\n I will go into the envoy.yaml in a bit more detail soon. Suffice it to say, that it is in this folder and will be copied into the newly created container image.<\/p>\n To build the container run (from the directory containing the penvoyage directory):<\/p>\n docker build -t jasmine\/penvoyage:0.2.0 -t jasmine\/penvoyage:latest penvoyage<\/p>\n<\/blockquote>\n Your output should terminate with the lines<\/p>\n Successfully tagged jasmine\/penvoyage:0.2.0 <\/p>\n docker network create -d bridge my-bridge-network<\/p>\n<\/blockquote>\n We will use this network to attach both containers to each other, so they see each other.<\/p>\n Containers can talk to each other using their container names, when they are on the same container network. <\/p>\n E.g. you can do <\/p>\n ping taxgod <\/p>\n<\/blockquote>\n where taxgod is the container name.<\/p>\n To add a container to a network after it has been run, do the following:<\/p>\n docker network connect my-bridge-network taxgod<\/p>\n<\/blockquote>\n In this case my-bridge-network is the network, and taxgod is the container to be connected to it.<\/p>\n To see how a container which is run is connected to a particular network, see below.<\/p>\n To see which containers are on a particular Docker network, run the following command:<\/p>\n docker network inspect my-bridge-network<\/p>\n<\/blockquote>\n docker run –rm -it -p 80:80 -p 443:443 -p 9901:9901 –network=my-bridge-network jasmine\/penvoyage<\/p>\n<\/blockquote>\n This will:<\/p>\n What will this container do?<\/strong><\/p>\n It will proxy connections to the host (in my case on IP 192.168.1.2) to the taxgod container, on port 3000.<\/p>\n It will act as a https proxy with the sample certificates, and proxy the connections to the same taxgod container, on port 3000.<\/p>\n Please note: yaml uses whitespace for structure, most likely WordPress will MESS this up. So use this as a reference, rather than a copy & paste thing!<\/p>\n static_resources: <\/p>\n Short explanation of the envoy yaml file:<\/p>\n There are two main sections, static_resources and admin<\/p>\n admin is for the administration of envoy and outside the scope of this article. In a production environment you will probably need to secure it appropriately. DO NOT COPY & PASTE THAT PART!!!<\/p>\n static_resources defines a static configuration for envoy (envoy can also be set up using it\u2019s API)<\/p>\n <\/p>\n in listeners, we define which ports we want to listen on, and what should happen to the connections.<\/p>\n the address and it\u2019s sub configuration is repeated two times, one for port 80, and one for port 443. For port 443 we also add the tls_context and common_tls_context in the filter_chains to inject the certificates.<\/p>\n Note that it still is envoy.http_connection_manager<\/strong>, NOT https_connection_manager for port 443.<\/p>\n <\/p>\n in clusters we define our endpoints we want to be able to connect to \/ proxy traffic to.<\/p>\n The port 3000 is the internal port of the container taxgod, it is not the port which you bind it to on the external host!<\/p>\n <\/p>\n I hope this blog post helps people trying to set up a https:\/\/ setup in envoy.<\/p>\n <\/p>\n Envoy no healthy upstream <\/strong>error message <\/p>\n the envoy container is not on the same Docker network<\/strong> as your target container, as it can\u2019t see it, it can\u2019t connect to it.<\/p>\n <\/p>\n Envoy upstream connect error or disconnect\/reset before headers <\/strong>error<\/p>\n Try to remove<\/strong> <\/p>\n http2_protocol_options: {}<\/p>\n<\/blockquote>\n from your envoy.yaml<\/p>\n <\/p>\n![\"image\"](\"https:\/\/pi3g.com\/wp-content\/uploads\/2019\/01\/image_thumb-31.png\" "\\"image\\"")
<\/a><\/p>\n\n
Dockerfile<\/h3>\n
\n
\nCOPY envoy.yaml \/etc\/envoy\/envoy.yaml
\nCOPY example.crt \/etc\/example-com.crt
\nCOPY example.key \/etc\/example-com.key
\n#VOLUME \/etc\/envoy\/envoy.yaml<\/p>\n
\nEXPOSE 443\/tcp
\n#Educated guess that this is TCP
\nEXPOSE 9901\/tcp<\/p>\n
description=”penvoyage is envoy proxy for PiCockpit” \\
maintainer=”<deleted>”<\/p>\n<\/blockquote>\n\n
\nSuccessfully tagged jasmine\/penvoyage:latest\n<\/p>\nCreate the docker network<\/h2>\n
\n
\n
\n
\n
Run the penvoyage container image<\/h2>\n
\n
\n
envoy.yaml<\/h2>\n
\n
listeners:
– address:
socket_address:
address: 0.0.0.0
port_value: 80
filter_chains:
– filters:
– name: envoy.http_connection_manager
config:
codec_type: auto
stat_prefix: ingress_http
route_config:
name: local_route
virtual_hosts:
– name: local_service
domains: [“*”]
routes:
– match: { prefix: “\/” }
route: { cluster: target_taxgod }
http_filters:
– name: envoy.router
– address:
socket_address:
address: 0.0.0.0
port_value: 443
filter_chains:
– tls_context:
common_tls_context:
tls_certificates:
– certificate_chain: { filename: “\/etc\/example-com.crt” }
private_key: { filename: “\/etc\/example-com.key” }
filters:
– name: envoy.http_connection_manager
config:
stat_prefix: ingress_https
route_config:
virtual_hosts:
– name: default
domains: [“*”]
routes:
– match: { prefix: “\/” }
route: { cluster: target_taxgod }
http_filters:
– name: envoy.router
clusters:
– name: target_taxgod
connect_timeout: 0.25s
type: strict_dns
lb_policy: round_robin
hosts:
– socket_address:
address: taxgod
port_value: 3000
\nadmin:
access_log_path: “\/tmp\/envoy.log”
address:
socket_address:
address: 0.0.0.0
port_value: 9901<\/p>\n
\n\n
\n
\n
Error messages<\/h2>\n
![\"image\"](\"https:\/\/pi3g.com\/wp-content\/uploads\/2019\/01\/image_thumb-32.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/pi3g.com\/wp-content\/uploads\/2019\/01\/image_thumb-33.png\" "\\"image\\"")
<\/a><\/p>\n\n
Useful resources<\/h2>\n
\n
\n
\n
\n
\n