Compare commits
13 Commits
8fa5b7c57b
...
beb4088c51
Author | SHA1 | Date | |
---|---|---|---|
beb4088c51 | |||
9f40e247b9 | |||
a46b00bd07 | |||
90587ed5d1 | |||
3f6b504dfc | |||
0db871b63f | |||
55eb86ff0c | |||
ed099f6f1a | |||
30e207a87c | |||
7b881e5da1 | |||
69b2ddf40b | |||
f13cdaff60 | |||
4915eac171 |
73
README.md
73
README.md
@ -1,8 +1,8 @@
|
|||||||
<div align="center">
|
<div align="center">
|
||||||
<img src="https://git.max-richter.dev/attachments/3cea8ffa-57cc-4faf-a973-7a3b34a012e0" width="30%"/>
|
<img src="https://git.max-richter.dev/attachments/91cbb502-e4e1-4861-ad56-efc8f1d11e0a" width="30%"/>
|
||||||
<h2 align="center">LocalCerts</h2>
|
<h2 align="center">LocalCerts</h2>
|
||||||
<p align="center">
|
<p align="center">
|
||||||
Automatic HTTPS and local domain routing for Docker Compose services using Traefik and Step-CA.
|
Automatic HTTPS and local domain routing for Docker Compose services using <a href="https://github.com/traefik/traefik">Traefik</a>, <a href="https://github.com/mageddo/dns-proxy-server">DPS</a> and <a href="https://github.com/smallstep/certificates">Step-CA</a>.
|
||||||
</p>
|
</p>
|
||||||
<p align="center">
|
<p align="center">
|
||||||
Created by <a href="https://github.com/Sajito">@Sajito</a>
|
Created by <a href="https://github.com/Sajito">@Sajito</a>
|
||||||
@ -15,15 +15,28 @@
|
|||||||
1. Clone this repository and navigate into the directory.
|
1. Clone this repository and navigate into the directory.
|
||||||
|
|
||||||
2. Start the services:
|
2. Start the services:
|
||||||
```bash
|
```shell
|
||||||
docker compose up -d
|
docker compose up -d
|
||||||
```
|
```
|
||||||
|
|
||||||
3. Trust the Step-CA root certificate:
|
3. Trust the Step-CA root certificate:
|
||||||
```bash
|
|
||||||
curl -k https://localhost:9000/roots.pem -o roots.pem
|
Download the `roots.pem` from [https://localhost:9000/roots.pem](https://localhost:9000/roots.pem) and trust it on your system.
|
||||||
|
This is necessary for the certificates to be trusted by your browser.
|
||||||
|
|
||||||
|
- Linux
|
||||||
|
```shell
|
||||||
sudo trust anchor --store roots.pem
|
sudo trust anchor --store roots.pem
|
||||||
rm roots.pem
|
```
|
||||||
|
|
||||||
|
- Windows
|
||||||
|
```powershell
|
||||||
|
Import-Certificate -FilePath "roots.pem" -CertStoreLocation "Cert:\LocalMachine\Root"
|
||||||
|
```
|
||||||
|
|
||||||
|
- macOS
|
||||||
|
```shell
|
||||||
|
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain roots.pem
|
||||||
```
|
```
|
||||||
|
|
||||||
## How to Use
|
## How to Use
|
||||||
@ -49,7 +62,7 @@ labels:
|
|||||||
> For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected.
|
> For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected.
|
||||||
|
|
||||||
- If certificates are not renewed or have expired
|
- If certificates are not renewed or have expired
|
||||||
```bash
|
```shell
|
||||||
docker compose up -d --force-recreate traefik
|
docker compose up -d --force-recreate traefik
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -60,40 +73,43 @@ docker compose up -d --force-recreate traefik
|
|||||||
For example `dev.cool` 😎
|
For example `dev.cool` 😎
|
||||||
|
|
||||||
Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file:
|
Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file:
|
||||||
```yaml
|
```diff
|
||||||
...
|
|
||||||
docker:
|
docker:
|
||||||
defaultRule: |
|
defaultRule: |
|
||||||
Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
- Host(`{{ trim (index .Labels "serviceName") }}.dev.local`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
||||||
...
|
+ Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
||||||
|
constraints: LabelRegex(`serviceName`, `.+`) && !Label(`com.docker.compose.oneoff`, `True`)
|
||||||
```
|
```
|
||||||
|
|
||||||
Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file:
|
Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file:
|
||||||
```json
|
```diff
|
||||||
...
|
{
|
||||||
{
|
|
||||||
"id": 2,
|
"id": 2,
|
||||||
"hostname": ".dev.cool",
|
- "hostname": ".dev.local",
|
||||||
|
+ "hostname": ".dev.cool",
|
||||||
"ip": "",
|
"ip": "",
|
||||||
"target": "host.docker",
|
|
||||||
"ttl": 3600,
|
|
||||||
"type": "CNAME"
|
|
||||||
}
|
|
||||||
...
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Remove the dns_config volume
|
Restart the docker services to apply the changes:
|
||||||
```bash
|
```shell
|
||||||
docker compose down
|
docker compose up -d --force-recreate
|
||||||
docker compose volukme rm dns_config
|
|
||||||
docker compose up -d
|
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### Custom Domain Per Service
|
||||||
|
|
||||||
|
If you want a single service to have a custom domain you can use the `serviceDomains` label. This will override the default domain suffix:
|
||||||
|
```yaml
|
||||||
|
labels:
|
||||||
|
serviceName: my-app
|
||||||
|
serviceDomains: my-app.very.cool
|
||||||
|
```
|
||||||
|
|
||||||
|
The service would now be reachable at `https://my-app.very.cool` and `https://my-app.dev.local`.
|
||||||
|
|
||||||
### Certificate Lifetime
|
### Certificate Lifetime
|
||||||
|
|
||||||
To ensure Traefik has enough time to renew certificates, increase their duration:
|
To ensure Traefik has enough time to renew certificates, increase their duration:
|
||||||
```bash
|
```shell
|
||||||
docker compose exec step step ca provisioner update acme \
|
docker compose exec step step ca provisioner update acme \
|
||||||
--x509-min-dur=20m \
|
--x509-min-dur=20m \
|
||||||
--x509-max-dur=8760h \
|
--x509-max-dur=8760h \
|
||||||
@ -102,9 +118,8 @@ docker compose exec step step ca provisioner update acme \
|
|||||||
|
|
||||||
### Use the preconfigured services
|
### Use the preconfigured services
|
||||||
|
|
||||||
If you use the preconfigured services, you can add the following snippet to you `.bashrc/.zshrc` to easily start, stop, and manage the services.
|
If you use the preconfigured services, you can add the following snippet to you `.bashrc`/`.zshrc` to easily start, stop, and manage the services.
|
||||||
|
```shell
|
||||||
```bash
|
|
||||||
dev () {
|
dev () {
|
||||||
PROJECT_DIR="$HOME/Projects/dev/services"
|
PROJECT_DIR="$HOME/Projects/dev/services"
|
||||||
case "$1" in
|
case "$1" in
|
||||||
|
@ -38,4 +38,4 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user