Compare commits
No commits in common. "beb4088c5113fd1fe50e1320d953d179049eb4e6" and "8fa5b7c57b73da7b4aebe80be734339514860add" have entirely different histories.
beb4088c51
...
8fa5b7c57b
81
README.md
81
README.md
@ -1,8 +1,8 @@
|
|||||||
<div align="center">
|
<div align="center">
|
||||||
<img src="https://git.max-richter.dev/attachments/91cbb502-e4e1-4861-ad56-efc8f1d11e0a" width="30%"/>
|
<img src="https://git.max-richter.dev/attachments/3cea8ffa-57cc-4faf-a973-7a3b34a012e0" width="30%"/>
|
||||||
<h2 align="center">LocalCerts</h2>
|
<h2 align="center">LocalCerts</h2>
|
||||||
<p align="center">
|
<p align="center">
|
||||||
Automatic HTTPS and local domain routing for Docker Compose services using <a href="https://github.com/traefik/traefik">Traefik</a>, <a href="https://github.com/mageddo/dns-proxy-server">DPS</a> and <a href="https://github.com/smallstep/certificates">Step-CA</a>.
|
Automatic HTTPS and local domain routing for Docker Compose services using Traefik and Step-CA.
|
||||||
</p>
|
</p>
|
||||||
<p align="center">
|
<p align="center">
|
||||||
Created by <a href="https://github.com/Sajito">@Sajito</a>
|
Created by <a href="https://github.com/Sajito">@Sajito</a>
|
||||||
@ -15,28 +15,15 @@
|
|||||||
1. Clone this repository and navigate into the directory.
|
1. Clone this repository and navigate into the directory.
|
||||||
|
|
||||||
2. Start the services:
|
2. Start the services:
|
||||||
```shell
|
```bash
|
||||||
docker compose up -d
|
docker compose up -d
|
||||||
```
|
```
|
||||||
|
|
||||||
3. Trust the Step-CA root certificate:
|
3. Trust the Step-CA root certificate:
|
||||||
|
```bash
|
||||||
Download the `roots.pem` from [https://localhost:9000/roots.pem](https://localhost:9000/roots.pem) and trust it on your system.
|
curl -k https://localhost:9000/roots.pem -o roots.pem
|
||||||
This is necessary for the certificates to be trusted by your browser.
|
|
||||||
|
|
||||||
- Linux
|
|
||||||
```shell
|
|
||||||
sudo trust anchor --store roots.pem
|
sudo trust anchor --store roots.pem
|
||||||
```
|
rm roots.pem
|
||||||
|
|
||||||
- Windows
|
|
||||||
```powershell
|
|
||||||
Import-Certificate -FilePath "roots.pem" -CertStoreLocation "Cert:\LocalMachine\Root"
|
|
||||||
```
|
|
||||||
|
|
||||||
- macOS
|
|
||||||
```shell
|
|
||||||
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain roots.pem
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## How to Use
|
## How to Use
|
||||||
@ -62,7 +49,7 @@ labels:
|
|||||||
> For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected.
|
> For each overwritten port you need to specify a custom `service-label` `traefik.http.services.[service-label]`. Otherwise the custom port will not be detected.
|
||||||
|
|
||||||
- If certificates are not renewed or have expired
|
- If certificates are not renewed or have expired
|
||||||
```shell
|
```bash
|
||||||
docker compose up -d --force-recreate traefik
|
docker compose up -d --force-recreate traefik
|
||||||
```
|
```
|
||||||
|
|
||||||
@ -73,43 +60,40 @@ docker compose up -d --force-recreate traefik
|
|||||||
For example `dev.cool` 😎
|
For example `dev.cool` 😎
|
||||||
|
|
||||||
Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file:
|
Replace `.dev.local` with your custom domain suffix in the `config/traefik/traefik.yml` file:
|
||||||
```diff
|
```yaml
|
||||||
docker:
|
...
|
||||||
defaultRule: |
|
docker:
|
||||||
- Host(`{{ trim (index .Labels "serviceName") }}.dev.local`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
defaultRule: |
|
||||||
+ Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
Host(`{{ trim (index .Labels "serviceName") }}.dev.cool`) {{range $i, $domain := splitList "," (index .Labels "serviceDomains")}}{{if ne $domain ""}}|| Host(`{{$domain}}`){{end}}{{end}}
|
||||||
constraints: LabelRegex(`serviceName`, `.+`) && !Label(`com.docker.compose.oneoff`, `True`)
|
...
|
||||||
```
|
```
|
||||||
|
|
||||||
Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file:
|
Replace `.dev.local` with your custom domain suffix in the `config/dns/config.sample.json` file:
|
||||||
```diff
|
```json
|
||||||
{
|
...
|
||||||
"id": 2,
|
{
|
||||||
- "hostname": ".dev.local",
|
"id": 2,
|
||||||
+ "hostname": ".dev.cool",
|
"hostname": ".dev.cool",
|
||||||
"ip": "",
|
"ip": "",
|
||||||
|
"target": "host.docker",
|
||||||
|
"ttl": 3600,
|
||||||
|
"type": "CNAME"
|
||||||
|
}
|
||||||
|
...
|
||||||
```
|
```
|
||||||
|
|
||||||
Restart the docker services to apply the changes:
|
Remove the dns_config volume
|
||||||
```shell
|
```bash
|
||||||
docker compose up -d --force-recreate
|
docker compose down
|
||||||
|
docker compose volukme rm dns_config
|
||||||
|
docker compose up -d
|
||||||
```
|
```
|
||||||
|
|
||||||
### Custom Domain Per Service
|
|
||||||
|
|
||||||
If you want a single service to have a custom domain you can use the `serviceDomains` label. This will override the default domain suffix:
|
|
||||||
```yaml
|
|
||||||
labels:
|
|
||||||
serviceName: my-app
|
|
||||||
serviceDomains: my-app.very.cool
|
|
||||||
```
|
|
||||||
|
|
||||||
The service would now be reachable at `https://my-app.very.cool` and `https://my-app.dev.local`.
|
|
||||||
|
|
||||||
### Certificate Lifetime
|
### Certificate Lifetime
|
||||||
|
|
||||||
To ensure Traefik has enough time to renew certificates, increase their duration:
|
To ensure Traefik has enough time to renew certificates, increase their duration:
|
||||||
```shell
|
```bash
|
||||||
docker compose exec step step ca provisioner update acme \
|
docker compose exec step step ca provisioner update acme \
|
||||||
--x509-min-dur=20m \
|
--x509-min-dur=20m \
|
||||||
--x509-max-dur=8760h \
|
--x509-max-dur=8760h \
|
||||||
@ -118,8 +102,9 @@ docker compose exec step step ca provisioner update acme \
|
|||||||
|
|
||||||
### Use the preconfigured services
|
### Use the preconfigured services
|
||||||
|
|
||||||
If you use the preconfigured services, you can add the following snippet to you `.bashrc`/`.zshrc` to easily start, stop, and manage the services.
|
If you use the preconfigured services, you can add the following snippet to you `.bashrc/.zshrc` to easily start, stop, and manage the services.
|
||||||
```shell
|
|
||||||
|
```bash
|
||||||
dev () {
|
dev () {
|
||||||
PROJECT_DIR="$HOME/Projects/dev/services"
|
PROJECT_DIR="$HOME/Projects/dev/services"
|
||||||
case "$1" in
|
case "$1" in
|
||||||
|
@ -38,4 +38,4 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
},
|
||||||
|
Loading…
x
Reference in New Issue
Block a user