support internal ssl

jupyterhub_traefik_proxy/proxy.py

@@ -69,7 +69,7 @@ def _concurrency_changed(self, change):
 
     extra_static_config = Dict(
         config=True,
-        help="""Extra static configuration for treafik.
+        help="""Extra static configuration for traefik.
 
         Merged with the default static config before writing to `.static_config_file`.
 
@@ -79,7 +79,7 @@ def _concurrency_changed(self, change):
 
     extra_dynamic_config = Dict(
         config=True,
-        help="""Extra dynamic configuration for treafik.
+        help="""Extra dynamic configuration for traefik.
 
         Merged with the default dynamic config during startup.
 
@@ -202,6 +202,12 @@ def __init__(self, **kwargs):
         """,
     )
 
+    traefik_http_servers_transport = Unicode(
+        "jupyterhub",
+        config=True,
+        help="The name of the servers transport to use for internal SSL",
+    )
+
     provider_name = Unicode(
         help="""The provider name that Traefik expects, e.g. file, consul, etcd"""
     )
@@ -364,7 +370,7 @@ async def _check_traefik_dynamic_conf_ready():
             scale_factor=1.2,
             timeout=self.check_route_timeout,
         )
-        self.log.debug("Treafik route for %s: registered", routespec)
+        self.log.debug("Traefik route for %s: registered", routespec)
 
     async def _traefik_api_request(self, path):
         """Make an API request to traefik"""
@@ -551,13 +557,39 @@ async def _setup_traefik_dynamic_config(self):
                     }
                 }
             }
+        if getattr(self.app, "internal_ssl", False):
+
+            def _resolve_path(path):
+                if os.path.isabs(path):
+                    return path
+                return url_path_join(os.getcwd(), path)
+
+            client_key = _resolve_path(
+                self.app.internal_proxy_certs["proxy-client"]['keyfile']
+            )
+            client_cert = _resolve_path(
+                self.app.internal_proxy_certs["proxy-client"]['certfile']
+            )
+            client_ca = _resolve_path(
+                self.app.internal_trust_bundles["proxy-client-ca"]
+            )
+            dynamic_config["http"]["serversTransports"] = {
+                self.traefik_http_servers_transport: {
+                    "certificates": [
+                        {
+                            "certfile": client_cert,
+                            "keyfile": client_key,
+                        }
+                    ],
+                    "rootCAs": client_ca,
+                }
+            }
 
         self.dynamic_config = deep_merge(dynamic_config, self.dynamic_config)
         if self.extra_dynamic_config:
             self.dynamic_config = deep_merge(
                 self.dynamic_config, self.extra_dynamic_config
             )
-
         await self._apply_dynamic_config(self.dynamic_config, None)
 
     def validate_routespec(self, routespec):
@@ -652,6 +684,10 @@ def _dynamic_config_for_route(self, routespec, target, data):
         traefik_config["http"]["services"][service_alias] = {
             "loadBalancer": {"servers": [{"url": target}], "passHostHeader": True}
         }
+        if getattr(self.app, "internal_ssl", False):
+            traefik_config["http"]["services"][service_alias]["loadBalancer"][
+                "serversTransport"
+            ] = self.traefik_http_servers_transport
 
         # Add the data node to a separate top-level node, so traefik doesn't see it.
         # key needs to be key-value safe (no '/')