Compare commits
13 Commits
8fa5b7c57b
...
beb4088c51
Author | SHA1 | Date | |
---|---|---|---|
beb4088c51 | |||
9f40e247b9 | |||
a46b00bd07 | |||
90587ed5d1 | |||
3f6b504dfc | |||
0db871b63f | |||
55eb86ff0c | |||
ed099f6f1a | |||
30e207a87c | |||
7b881e5da1 | |||
69b2ddf40b | |||
f13cdaff60 | |||
4915eac171 |
81
README.md
81
README.md
@ -1,8 +1,8 @@
|
||||
<div align="center">
|
||||
<img src="https://git.max-richter.dev/attachments/3cea8ffa-57cc-4faf-a973-7a3b34a012e0" width="30%"/>
|
||||
<img src="https://git.max-richter.dev/attachments/91cbb502-e4e1-4861-ad56-efc8f1d11e0a" width="30%"/>
|
||||
<h2 align="center">LocalCerts</h2>
|
||||
<p align="center">
|
||||
Automatic HTTPS and local domain routing for Docker Compose services using Traefik and Step-CA.
|
||||
Automatic HTTPS and local domain routing for Docker Compose services using <a href="https://github.com/traefik/traefik">Traefik</a>, <a href="https://github.com/mageddo/dns-proxy-server">DPS</a> and <a href="https://github.com/smallstep/certificates">Step-CA</a>.
|
||||
</p>
|
||||
<p align="center">
|
||||
Created by <a href="https://github.com/Sajito">@Sajito</a>
|
||||
@ -15,15 +15,28 @@
|
||||
1. Clone this repository and navigate into the directory.
|
||||
|
||||
2. Start the services:
|
||||
```bash
|
||||
```shell
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
3. Trust the Step-CA root certificate:
|
||||
```bash
|
||||
curl -k https://localhost:9000/roots.pem -o roots.pem
|
||||
|
||||
Download the `roots.pem` from [https://localhost:9000/roots.pem](https://localhost:9000/roots.pem) and trust it on your system.
|
||||
This is necessary for the certificates to be trusted by your browser.
|
||||
|
||||
- Linux
|
||||
```shell
|
||||
sudo trust anchor --store roots.pem
|
||||
rm roots.pem
|
||||
```
|
||||
|
||||
- Windows
|
||||
```powershell
|
||||
Import-Certificate -FilePath "roots.pem" -CertStoreLocation "Cert:\LocalMachine\Root"
|
||||
```
|
||||
|
||||
- macOS
|
||||
```shell
|
||||
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain roots.pem
|
||||
```
|
||||
|
||||
## How to Use
|
||||
@ -49,7 +62,7 @@ labels:
|
||||
> For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected.
|
||||
|
||||
- If certificates are not renewed or have expired
|
||||
```bash
|
||||
```shell
|
||||
docker compose up -d --force-recreate traefik
|
||||
```
|
||||
|
||||
@ -60,40 +73,43 @@ docker compose up -d --force-recreate traefik
|
||||
For example `dev.cool` 😎
|
||||
|
||||
Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file:
|
||||
```yaml
|
||||
...
|
||||
docker:
|
||||
defaultRule: |
|
||||
Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
||||
...
|
||||
```diff
|
||||
docker:
|
||||
defaultRule: |
|
||||
- Host(`{{ trim (index .Labels "serviceName") }}.dev.local`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
||||
+ Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
||||
constraints: LabelRegex(`serviceName`, `.+`) && !Label(`com.docker.compose.oneoff`, `True`)
|
||||
```
|
||||
|
||||
Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file:
|
||||
```json
|
||||
...
|
||||
{
|
||||
"id": 2,
|
||||
"hostname": ".dev.cool",
|
||||
"ip": "",
|
||||
"target": "host.docker",
|
||||
"ttl": 3600,
|
||||
"type": "CNAME"
|
||||
}
|
||||
...
|
||||
```diff
|
||||
{
|
||||
"id": 2,
|
||||
- "hostname": ".dev.local",
|
||||
+ "hostname": ".dev.cool",
|
||||
"ip": "",
|
||||
```
|
||||
|
||||
Remove the dns_config volume
|
||||
```bash
|
||||
docker compose down
|
||||
docker compose volukme rm dns_config
|
||||
docker compose up -d
|
||||
Restart the docker services to apply the changes:
|
||||
```shell
|
||||
docker compose up -d --force-recreate
|
||||
```
|
||||
|
||||
### Custom Domain Per Service
|
||||
|
||||
If you want a single service to have a custom domain you can use the `serviceDomains` label. This will override the default domain suffix:
|
||||
```yaml
|
||||
labels:
|
||||
serviceName: my-app
|
||||
serviceDomains: my-app.very.cool
|
||||
```
|
||||
|
||||
The service would now be reachable at `https://my-app.very.cool` and `https://my-app.dev.local`.
|
||||
|
||||
### Certificate Lifetime
|
||||
|
||||
To ensure Traefik has enough time to renew certificates, increase their duration:
|
||||
```bash
|
||||
```shell
|
||||
docker compose exec step step ca provisioner update acme \
|
||||
--x509-min-dur=20m \
|
||||
--x509-max-dur=8760h \
|
||||
@ -102,9 +118,8 @@ docker compose exec step step ca provisioner update acme \
|
||||
|
||||
### Use the preconfigured services
|
||||
|
||||
If you use the preconfigured services, you can add the following snippet to you `.bashrc/.zshrc` to easily start, stop, and manage the services.
|
||||
|
||||
```bash
|
||||
If you use the preconfigured services, you can add the following snippet to you `.bashrc`/`.zshrc` to easily start, stop, and manage the services.
|
||||
```shell
|
||||
dev () {
|
||||
PROJECT_DIR="$HOME/Projects/dev/services"
|
||||
case "$1" in
|
||||
|
@ -38,4 +38,4 @@
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
}
|
||||
|
Loading…
x
Reference in New Issue
Block a user