Compare commits

...

13 Commits

2 changed files with 49 additions and 34 deletions

View File

@ -1,8 +1,8 @@
<div align="center"> <div align="center">
<img src="https://git.max-richter.dev/attachments/3cea8ffa-57cc-4faf-a973-7a3b34a012e0" width="30%"/> <img src="https://git.max-richter.dev/attachments/91cbb502-e4e1-4861-ad56-efc8f1d11e0a" width="30%"/>
<h2 align="center">LocalCerts</h2> <h2 align="center">LocalCerts</h2>
<p align="center"> <p align="center">
Automatic HTTPS and local domain routing for Docker Compose services using Traefik and Step-CA. Automatic HTTPS and local domain routing for Docker Compose services using <a href="https://github.com/traefik/traefik">Traefik</a>, <a href="https://github.com/mageddo/dns-proxy-server">DPS</a> and <a href="https://github.com/smallstep/certificates">Step-CA</a>.
</p> </p>
<p align="center"> <p align="center">
Created by <a href="https://github.com/Sajito">@Sajito</a> Created by <a href="https://github.com/Sajito">@Sajito</a>
@ -15,15 +15,28 @@
1. Clone this repository and navigate into the directory. 1. Clone this repository and navigate into the directory.
2. Start the services: 2. Start the services:
```bash ```shell
docker compose up -d docker compose up -d
``` ```
3. Trust the Step-CA root certificate: 3. Trust the Step-CA root certificate:
```bash
curl -k https://localhost:9000/roots.pem -o roots.pem Download the `roots.pem` from [https://localhost:9000/roots.pem](https://localhost:9000/roots.pem) and trust it on your system.
This is necessary for the certificates to be trusted by your browser.
- Linux
```shell
sudo trust anchor --store roots.pem sudo trust anchor --store roots.pem
rm roots.pem ```
- Windows
```powershell
Import-Certificate -FilePath "roots.pem" -CertStoreLocation "Cert:\LocalMachine\Root"
```
- macOS
```shell
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain roots.pem
``` ```
## How to Use ## How to Use
@ -49,7 +62,7 @@ labels:
> For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected. > For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected.
- If certificates are not renewed or have expired - If certificates are not renewed or have expired
```bash ```shell
docker compose up -d --force-recreate traefik docker compose up -d --force-recreate traefik
``` ```
@ -60,40 +73,43 @@ docker compose up -d --force-recreate traefik
For example `dev.cool` 😎 For example `dev.cool` 😎
Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file: Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file:
```yaml ```diff
... docker:
docker: defaultRule: |
defaultRule: | - Host(`{{ trim (index .Labels "serviceName") }}.dev.local`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}} + Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
... constraints: LabelRegex(`serviceName`, `.+`) && !Label(`com.docker.compose.oneoff`, `True`)
``` ```
Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file: Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file:
```json ```diff
... {
{ "id": 2,
"id": 2, - "hostname": ".dev.local",
"hostname": ".dev.cool", + "hostname": ".dev.cool",
"ip": "", "ip": "",
"target": "host.docker",
"ttl": 3600,
"type": "CNAME"
}
...
``` ```
Remove the dns_config volume Restart the docker services to apply the changes:
```bash ```shell
docker compose down docker compose up -d --force-recreate
docker compose volukme rm dns_config
docker compose up -d
``` ```
### Custom Domain Per Service
If you want a single service to have a custom domain you can use the `serviceDomains` label. This will override the default domain suffix:
```yaml
labels:
serviceName: my-app
serviceDomains: my-app.very.cool
```
The service would now be reachable at `https://my-app.very.cool` and `https://my-app.dev.local`.
### Certificate Lifetime ### Certificate Lifetime
To ensure Traefik has enough time to renew certificates, increase their duration: To ensure Traefik has enough time to renew certificates, increase their duration:
```bash ```shell
docker compose exec step step ca provisioner update acme \ docker compose exec step step ca provisioner update acme \
--x509-min-dur=20m \ --x509-min-dur=20m \
--x509-max-dur=8760h \ --x509-max-dur=8760h \
@ -102,9 +118,8 @@ docker compose exec step step ca provisioner update acme \
### Use the preconfigured services ### Use the preconfigured services
If you use the preconfigured services, you can add the following snippet to you `.bashrc/.zshrc` to easily start, stop, and manage the services. If you use the preconfigured services, you can add the following snippet to you `.bashrc`/`.zshrc` to easily start, stop, and manage the services.
```shell
```bash
dev () { dev () {
PROJECT_DIR="$HOME/Projects/dev/services" PROJECT_DIR="$HOME/Projects/dev/services"
case "$1" in case "$1" in

View File

@ -38,4 +38,4 @@
] ]
} }
] ]
}, }