I'm currently working on getting this setup myself. I eventually decided to exposing /var/run/docker.sock to my Certbot container and have a posthook that sends -HUP to the HAProxy container, which has a wrapper script that forwards HUP to haproxy's PID.
It would be nice if I could just do this via the HAProxy admin socket .. or not even reloading the whole config but just tell it to rescan the SSL certs.
Re:HAProxy 1.8
by mschuster91 on Thursday November 02, 2017 @05:32AM
(#15608942)
> I eventually decided to exposing /var/run/docker.sock to my Certbot container
Don't do this, please. It is a security risk as access to the docker socket can be used to take over the entire system as root.
Out of curiosity, do you use host networking for higher performance (latency, conn/s, etc.) on those containers, or use the default docker-proxy forwarding?
Re:HAProxy 1.8
by mschuster91 on Thursday November 02, 2017 @02:10AM
(#15608205)
I use --net=host for the haproxy container because I dont want to restart the container every time I need to expose a new frontend port.
In fact this is my biggest issue with docker - that properties like bound ports or volumes cant be changed on the fly and without deleting the container.
I run haproxy in docker - create a shellscript that allows your jenkins (or whatever you use) to send a SIGHUP to the haproxy container, and it will reload the config.