Support automatic Let's Encrypt

.travis.yml

@@ -1,15 +1,23 @@
 language: python
 cache:
   - pip
+addons:
+  hosts:
+    - jupyter.test
 env:
   global:
     - ETCDCTL_API=3
+    - LEGO_CA_SERVER_NAME=pebble
+    - LEGO_CA_CERTIFICATES=$GOPATH/src/github.com/letsencrypt/pebble/test/certs/localhost/cert.pem
 
 # installing dependencies
 before_install:
   - pip install --upgrade setuptools pip
   - pip install --pre -r dev-requirements.txt --upgrade .
   - pip install pytest-cov
+  # Install pebble
+  - go get -u github.com/letsencrypt/pebble/...
+  - (cd $GOPATH/src/github.com/letsencrypt/pebble && go install ./...)
 install:
   - python -m jupyterhub_traefik_proxy.install --traefik --etcd --consul --output=./bin
   - export PATH=$PWD/bin:$PATH

docs/source/https.md

@@ -0,0 +1,53 @@
+# Enabling HTTPS
+
+In order to protect the data and passwords transfered over the public network, you should not run JupyterHub without enabling **HTTPS**.
+
+JupyterHub Traefik-Proxy supports **automatically** configuring HTTPS via [Let’s Encrypt](https://letsencrypt.org/docs/), or setting it
+up **manually** with your own key and certificate.
+
+## How-To HTTPS for JupyterHub managed Traefik-Proxy
+1. Via **Let'Encrypt**:
+    * Enable automatic https:
+    ```python
+    c.Proxy.traefik_auto_https=True
+    ```
+    * Configure a HTTPS port. This is where all the traffic coming through the HTTP entrypoint will be redirected to:
+    ```python
+    c.Proxy.traefik_https_port=443
+    ```
+    * Set the email address used for Let's Encrypt registration:
+    ```python
+    c.Proxy.traefik_letsencrypt_email="[email protected]"
+    ```
+    * Set the domain list:
+    ```python
+    c.Proxy.traefik_letsencrypt_domains=["jupyter.test"]
+    ```
+    * Set the the CA server to be used:
+    ```python
+    c.Proxy.traefik_acme_server="https://acme-v02.api.letsencrypt.org/directory"
+    ```
+    <span style="color:green">**Note !**</span>
+
+    **TraefikProxy**, supports only the most common challenge type, i.e. the [HTTP-01 ACME challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge).
+    If other challenge type is needed, one could setup the proxy to be externally managed to get access to all the Traefik's configuration options (including the
+    ACME challenge type).
+
+2. **Manually**, by providing your own key and certificate:
+
+    Providing a certificate and key can be done by configuring JupyterHub to enable SSL encryption as specified in [the docs](https://jupyterhub.readthedocs.io/en/stable/getting-started/security-basics.html?highlight=https#enabling-ssl-encryption). Example:
+    ```python
+      c.JupyterHub.ssl_key = '/path/to/my.key'
+      c.JupyterHub.ssl_cert = '/path/to/my.cert'
+    ```
+
+    Traefik will then redirect all HTTP traffic to the HTTPS entrypoint. The default HTTPS entrypoint port is 8843, but can be configured through:
+    ```python
+    c.Proxy.traefik_https_port=443
+    ```
+
+## How-To HTTPS for external Traefik-Proxy
+If the proxy isn't managed by JupyterHub, HTTPS can be enabled through Traefik's static configuration file.
+Checkout Traefik's documentation for:
+* [Setting up ACME (Let's Encrypt) Configuration](https://docs.traefik.io/v1.7/configuration/acme/)
+* [How to redirect HTTP traffic to HTTPS](https://docs.traefik.io/v1.7/user-guide/examples/#http-redirect-on-https)

docs/source/index.rst

@@ -39,11 +39,12 @@ Installation Guide
 Getting Started
 ---------------
 .. toctree::
-   :maxdepth: 1
+   :maxdepth: 2
 
    toml
    etcd
    consul
+   https
 
 API Reference
 -------------

docs/source/toml.md

@@ -69,9 +69,9 @@ c.TraefikTomlProxy.toml_dynamic_config_file="/path/to/dynamic_config_filename.to
 ---
 <span style="color:green">**Note !**</span>
 
-**When JupyterHub starts the proxy**, it writes the static config once, then only edits the routes config file. 
+* **When JupyterHub starts the proxy**, it writes the static config once, then only edits the routes config file.
 
-**When JupyterHub does not start the proxy**, the user is totally responsible for the static config and 
+* **When JupyterHub does not start the proxy**, the user is totally responsible for the static config and
 JupyterHub is responsible exclusively for the routes.
 ---
 

jupyterhub_traefik_proxy/proxy.py

@@ -23,7 +23,7 @@
 from subprocess import Popen
 from urllib.parse import urlparse
 
-from traitlets import Any, Bool, Dict, Integer, Unicode, default
+from traitlets import Any, Bool, Dict, Integer, List, Unicode, default
 from tornado.httpclient import AsyncHTTPClient
 
 from jupyterhub.utils import exponential_backoff, url_path_join, new_token
@@ -47,15 +47,29 @@ class TraefikProxy(Proxy):
     )
 
     traefik_api_validate_cert = Bool(
-        True,
-        config=True,
-        help="""validate SSL certificate of traefik api endpoint""",
+        True, config=True, help="""validate SSL certificate of traefik api endpoint"""
     )
 
     traefik_log_level = Unicode("ERROR", config=True, help="""traefik's log level""")
 
+    traefik_https_port = Integer(8443, config=True, help="""https port""")
+
+    traefik_auto_https = Bool(
+        False, config=True, help="""enable automatic HTTPS with Let's Encrypt"""
+    )
+
+    traefik_letsencrypt_email = Unicode(config=True, help="""Let's Encrypt email""")
+
+    traefik_letsencrypt_domains = List(config=True, help="""domains list""")
+
+    traefik_acme_server = Unicode(config=True, help="""the CA server to use""")
+
+    traefik_acme_storage = Unicode(
+        "acme.json", config=True, help="""file used for certificates storage"""
+    )
+
     traefik_api_password = Unicode(
-        config=True, help="""The password for traefik api login"""
+        config=True, help="""the password for traefik api login"""
     )
 
     @default("traefik_api_password")
@@ -217,21 +231,49 @@ async def _setup_traefik_static_config(self):
         self.static_config = {}
         self.static_config["debug"] = True
         self.static_config["logLevel"] = self.traefik_log_level
+
         entryPoints = {}
+        self.static_config["defaultentrypoints"] = ["http"]
+        entryPoints["http"] = {"address": ":" + str(urlparse(self.public_url).port)}
+
+        if self.traefik_auto_https:
+            self.static_config["defaultentrypoints"].append("https")
+
+            entryPoints["http"].update({"redirect": {"entrypoint": "https"}})
+
+            entryPoints["https"] = {
+                "address": ":" + str(self.traefik_https_port),
+                "tls": {},
+            }
+
+            acme = {
+                "email": self.traefik_letsencrypt_email,
+                "storage": self.traefik_acme_storage,
+                "entryPoint": "https",
+                "caServer": self.traefik_acme_server,
+                "httpChallenge": {"entryPoint": "http"},
+            }
+
+            acme["domains"] = []
+
+            for domain in self.traefik_letsencrypt_domains:
+                acme["domains"].append({"main": domain})
+
+            self.static_config["acme"] = acme
 
         if self.ssl_cert and self.ssl_key:
-            self.static_config["defaultentrypoints"] = ["https"]
+            self.static_config["defaultentrypoints"].append("https")
+
+            entryPoints["http"].update({"redirect": {"entrypoint": "https"}})
+
             entryPoints["https"] = {
-                "address": ":" + str(urlparse(self.public_url).port),
+                "address": ":" + str(self.traefik_https_port),
                 "tls": {
                     "certificates": [
                         {"certFile": self.ssl_cert, "keyFile": self.ssl_key}
                     ]
                 },
             }
-        else:
-            self.static_config["defaultentrypoints"] = ["http"]
-            entryPoints["http"] = {"address": ":" + str(urlparse(self.public_url).port)}
 
         auth = {
             "basic": {
@@ -248,20 +290,17 @@ async def _setup_traefik_static_config(self):
         self.static_config["api"] = {"dashboard": True, "entrypoint": "auth_api"}
         self.static_config["wss"] = {"protocol": "http"}
 
-
     def _routespec_to_traefik_path(self, routespec):
         path = self.validate_routespec(routespec)
-        if path != '/' and path.endswith('/'):
-            path = path.rstrip('/')
+        if path != "/" and path.endswith("/"):
+            path = path.rstrip("/")
         return path
 
-
     def _routespec_from_traefik_path(self, routespec):
-        if not routespec.endswith('/'):
-            routespec = routespec + '/'
+        if not routespec.endswith("/"):
+            routespec = routespec + "/"
         return routespec
 
-
     async def start(self):
         """Start the proxy.
 

tests/config_files/pebble-config.json

@@ -0,0 +1,12 @@
+{
+  "pebble": {
+    "listenAddress": "0.0.0.0:14000",
+    "managementListenAddress": "0.0.0.0:15000",
+    "certificate": "$GOPATH/src/github.com/letsencrypt/pebble/test/certs/localhost/cert.pem",
+    "privateKey": "$GOPATH/src/github.com/letsencrypt/pebble/test/certs/localhost/key.pem",
+    "httpPort": 8000,
+    "tlsPort": 8443,
+    "ocspResponderURL": "",
+    "externalAccountBindingRequired": false
+  }
+}

tests/conftest.py

@@ -13,6 +13,41 @@
 from jupyterhub_traefik_proxy import TraefikTomlProxy
 
 
+@pytest.fixture
+async def autohttps_toml_proxy():
+    """Fixture returning a configured Let's Encrypt TraefikTomlProxy"""
+    proxy = TraefikTomlProxy(
+        public_url="http://127.0.0.1:8000",
+        traefik_api_password="admin",
+        traefik_api_username="api_admin",
+        should_start=True,
+        traefik_auto_https=True,
+        traefik_letsencrypt_email="[email protected]",
+        traefik_letsencrypt_domains=["jupyter.test"],
+        traefik_acme_server="https://0.0.0.0:14000/dir",
+    )
+
+    await proxy.start()
+    yield proxy
+    await proxy.stop()
+    if os.path.exists("acme.json"):
+        os.remove("acme.json")
+
+
+
+@pytest.fixture
+async def pebble():
+    pebble_server = subprocess.Popen(
+        ["pebble", "-config", "./tests/config_files/pebble-config.json"],
+        stdout=None,
+        stderr=None,
+    )
+    yield pebble_server
+
+    pebble_server.kill()
+    pebble_server.wait()
+
+
 @pytest.fixture
 async def no_auth_consul_proxy(consul_no_acl):
     """

tests/proxytest.py

@@ -356,3 +356,36 @@ async def test_websockets(proxy, launch_backend):
         port = await websocket.recv()
 
     assert port == str(default_backend_port)
+
+
+async def test_autohttps(autohttps_toml_proxy, pebble, launch_backend):
+    proxy = autohttps_toml_proxy
+
+    routespec = "/autohttps"
+    target = "http://127.0.0.1:9900"
+
+    backend_port = 9900
+    launch_backend(backend_port)
+
+    await wait_for_services([proxy.public_url, target])
+
+    await proxy.add_route(routespec, target, {})
+
+    # Test the actual routing
+    req = HTTPRequest(proxy.public_url + routespec, method="GET", validate_cert=False)
+    resp = await AsyncHTTPClient().fetch(req)
+    backend_response = int(resp.body.decode("utf-8"))
+
+    # Test we were redirected to https
+    # https://127.0.0.1:8443/autohttps
+    expected_final_redirect_url = (
+        "https://"
+        + urlparse(proxy.public_url).hostname
+        + ":"
+        + str(proxy.traefik_https_port)
+        + routespec
+    )
+    assert resp.effective_url == expected_final_redirect_url
+
+    # Test redirection to the route added
+    assert backend_response == backend_port