fix(traefik): exclude private keys by suffix so -key hostnames are served

CHANGELOG.md

@@ -56,6 +56,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- A certificate whose hostname contains `-key`, such as `my-keycloak.spark.loc`, is served: the key filter in the Traefik entrypoint matches the `-key.pem` suffix instead of the substring ([#163](https://github.com/sparkfabrik/http-proxy/issues/163))
 - `hosts` reports only what Traefik serves, including containers whose rule names several hostnames
 - Commands no longer abort on a state directory Docker created as root; they say how to take it back
 - The certificate scan reports a write it could not make ([#151](https://github.com/sparkfabrik/http-proxy/issues/151))

build/traefik/entrypoint.sh

@@ -49,8 +49,10 @@ generate_tls_config() {
         return
     fi
 
-    # Look for certificate files (both .pem and .crt extensions)
-    cert_files=$(find "${CERTS_DIR}" -name "*.pem" -o -name "*.crt" | grep -v "\-key")
+    # Certificate files, both .pem and .crt. Private keys are <name>-key.pem or
+    # <name>-key.crt, excluded by suffix: a substring match on -key also dropped
+    # certificates for hostnames such as my-keycloak.spark.loc.
+    cert_files=$(find "${CERTS_DIR}" \( -name "*.pem" -o -name "*.crt" \) ! -name "*-key.pem" ! -name "*-key.crt")
 
     if [ -z "$cert_files" ]; then
         echo "No certificate files found in ${CERTS_DIR}"

test/test-certs.sh

@@ -55,7 +55,7 @@ DYNAMIC_DIR="${TEMP_DYNAMIC_DIR}"
 TLS_CONFIG_FILE="${DYNAMIC_DIR}/auto-tls.yml"
 
 # Look for certificate files (both .pem and .crt extensions)
-cert_files=$(find "${CERTS_DIR}" -name "*.pem" -o -name "*.crt" | grep -v "\-key" | head -10)
+cert_files=$(find "${CERTS_DIR}" \( -name "*.pem" -o -name "*.crt" \) ! -name "*-key.pem" ! -name "*-key.crt" | head -10)
 
 if [ -z "$cert_files" ]; then
     echo "❌ ERROR: No certificate files found!"

test/test.sh

@@ -1528,6 +1528,30 @@ STUB
         fi
         rm -rf "${scratch}"
 
+        # A hostname containing -key. The key filter is a suffix match on
+        # -key.pem, so the certificate is served; a substring match dropped it
+        # while certs list showed it installed.
+        scratch="$(mktemp -d)"
+        mkdir -p "${scratch}/certs" "${scratch}/dynamic"
+        touch "${scratch}/certs/my-keycloak.spark.loc.pem" "${scratch}/certs/my-keycloak.spark.loc-key.pem"
+        rc=0
+        docker run --rm \
+            -v "$(pwd)/build/traefik/entrypoint.sh:/ep.sh:ro" \
+            -v "${scratch}/certs:/traefik/certs:ro" \
+            -v "${scratch}/dynamic:/traefik/dynamic" \
+            --entrypoint sh "${traefik_image}" /ep.sh --tls-only >/dev/null 2>&1 || rc=$?
+
+        total=$((total + 1))
+        if [ "${rc}" -eq 0 ] &&
+            grep -q 'certFile: /traefik/certs/my-keycloak.spark.loc.pem$' "${scratch}/dynamic/auto-tls.yml" 2>/dev/null &&
+            [ "$(grep -c 'certFile:' "${scratch}/dynamic/auto-tls.yml")" -eq 1 ]; then
+            success "a certificate whose hostname contains -key is served, and its key is not read as one"
+            passed=$((passed + 1))
+        else
+            error "the -key hostname scan exited ${rc} and left: $(cat "${scratch}/dynamic/auto-tls.yml" 2>&1 | tr '\n' ' ')"
+        fi
+        rm -rf "${scratch}"
+
         # A scan that could not write must say so, because the CLI reads its
         # exit status to decide whether to tell the user the certificates were
         # applied. A read-only dynamic directory is the cheapest way to make the