Merge pull request #54 from itk-dev/feature/ssl

Enabled self-signed cert in treafik

Author: turegjorup

README.md

@@ -110,6 +110,18 @@ REMOTE_EXCLUDE=(ting styles advagg_*)
 LOCAL_PATH='sites/default/files'
 ```
 
+## SSL certification support
+
+This setup comes with self-signed wildcard certificates for *.local.itkdev.dk, but other certificates can be generated by using this openssl command on Mac, just change the two places where the domain is written.
+
+```sh
+openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout docker.key -out docker.crt -subj "/CN=*.local.itkdev.dk" -reqexts SAN -extensions SAN -config <(cat /usr/local/etc/openssl/openssl.cnf <(printf '[SAN]\nsubjectAltName=DNS:*.local.itkdev.dk'))
+```
+
+To mac browser trust this certificate you need to open it with key-chain right click and select "Get info" and then open the "Trust" tab and select "Always trust".
+
+The certificate is located in `./treafik/ssl/docker.crt` in this repository.
+
 ## Completions
 
 ### Bash

traefik/docker-compose.yml

@@ -7,7 +7,7 @@ networks:
 
 services:
   traefik:
-    image: traefik:v2.3
+    image: traefik:v2.5
     container_name: traefik
     restart: unless-stopped
     security_opt:
@@ -17,9 +17,12 @@ services:
     ports:
       - 80:80
       - 8080:8080
+      - 443:443
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - $PWD/traefik.yml:/traefik.yml:ro
+      - $PWD/dynamic-conf.yaml:/config/dynamic-conf.yaml:ro
+      - $PWD/ssl:/certs:ro
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.traefik.rule=Host(`traefik.local.itkdev.dk`)"

traefik/dynamic-conf.yaml

@@ -0,0 +1,4 @@
+tls:
+  certificates:
+    - certFile: /certs/docker.crt
+      keyFile: /certs/docker.key

traefik/ssl/docker.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAcOgAwIBAgIJAIgOJvRHdQq+MA0GCSqGSIb3DQEBCwUAMBwxGjAYBgNV
+BAMMESoubG9jYWwuaXRrZGV2LmRrMB4XDTIxMDkwNjExMDMxN1oXDTMxMDkwNDEx
+MDMxN1owHDEaMBgGA1UEAwwRKi5sb2NhbC5pdGtkZXYuZGswggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCrL/r+/VrPnqjmgwGDRCdHV111UIlQ/Px0UqMP
+TLvDuLOJe2spNqhXMuAV+naMk6d3dMu6wVZoiJU6cD5XiK4RMxwyu2voMlTPWHDV
+lIvgh17/Vh80Aw31VcZL8FYL0RbY6AM0aSDgHI8Mx+JDgndj+L6yBpZD0Rsm3spl
+sZc7fw5bXzaAEtbT3uDr/7XIwvTBgaK4SVv4zTFb1LtRLS2lwnkI6ALgKdPxvpuQ
+bIilKMsvbl+b8xZo5JTUWH0obvBWHAalQDcnzXTFZIMxdHIz5WJPTBBsjS5T3Hi7
+CIvA96o9qi6z8dE837fsuFLUCjisyrOPu9hZfjHHF9D4/0NPAgMBAAGjIDAeMBwG
+A1UdEQQVMBOCESoubG9jYWwuaXRrZGV2LmRrMA0GCSqGSIb3DQEBCwUAA4IBAQAW
+llDU8INVpT5fJwkdi4sno7sk8snjbXBGOlUjcEQYG8q2fC6TUKlqmgTAXiAJHgff
+/IyzObWK1DzJrIqbU3lFGu7TtWr7oGqz7BO7gRPPm1Cj3QxrdhsL7tbRtxFTOz87
+zaO3/Ljtaha9ONYIkHqqky4ijZZaoX3kThWENK472TlrftjhiTUEi9xFmJ3oxseF
+Ine8S+5y0C83OOIHJajnBsXUkSd7ilrzmqlHi+w6sWI3erbntBQbopU2kPoUpADR
+X8vdjkqVRNbOeiMxUogwcrsOOpIN03v7M3vW0YN/fRObAONv4oUjuOpgbEzj2Lh1
++fA3c3/pU71zlK29XruP
+-----END CERTIFICATE-----

traefik/ssl/docker.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCrL/r+/VrPnqjm
+gwGDRCdHV111UIlQ/Px0UqMPTLvDuLOJe2spNqhXMuAV+naMk6d3dMu6wVZoiJU6
+cD5XiK4RMxwyu2voMlTPWHDVlIvgh17/Vh80Aw31VcZL8FYL0RbY6AM0aSDgHI8M
+x+JDgndj+L6yBpZD0Rsm3splsZc7fw5bXzaAEtbT3uDr/7XIwvTBgaK4SVv4zTFb
+1LtRLS2lwnkI6ALgKdPxvpuQbIilKMsvbl+b8xZo5JTUWH0obvBWHAalQDcnzXTF
+ZIMxdHIz5WJPTBBsjS5T3Hi7CIvA96o9qi6z8dE837fsuFLUCjisyrOPu9hZfjHH
+F9D4/0NPAgMBAAECggEAL2tpEb1IrH58tu3PO3djkgWHY/ndL8wEeoxxkslkscC2
+Kv0/H/l+BDmZjT0GHcbA+vwleyQXNXmwLLHu8vxvi2AnDX6RU46to4oSJ3ewj4+w
+JvbKSfQWp8EM3vhCPZ+7vnX2fUwpySrgDWBJMv4u6Eh9On9MnJiN9uR8GFNrWxVQ
++zH3CNl5LKJUvBJITupzu53GRlPJD8/wklqFdNIGLy1oJ18OZiPCKSrHgLmIQ+/u
+i7MxRtHuy58wln78y1ZZXnbT6awj1fyvlH6mL+LfiABhvYwa6GcABOhDdwE7Scj7
+6EBk2C2g+uZj6GJbzrestOwQa2MOFUsV0FSE8PbksQKBgQDVPH/1uV/dlrsG29q1
+d5OsYpFAMOh+4F5cTgJF6LuUJl1e0RnbguD8jdCvjW8xkbAIMOKhpiUOQQB8fszR
+771DK4EXZHyJLQ/bLKNeYUqRK0wgEJByVTLNek+SxpMGJcQoCjD1JfrktcaCNSoy
+FQ7XVP4+LFlVSKbErxufPnV4iwKBgQDNhLNH9NxKdl8H6mwuPj/p1Tre9a4XrdbP
+1Q/cDGyX7fUBGzCy5Y9YUnVYEKAWKO55jvpXTO98eM5Y87b/tqlRfqXYCOSn8TNa
+r+C4wmKwOtRnh9ZurLClVA+WH0L6S+sWVbU5xai6fOXXK0wSzGn5EUeowP+cal66
+sFV3rgS0zQKBgGomuQipZLjZ3XcXoXPu+Bu74dUTw9nNdgv7ZZRJvH+O7bJS481s
+BPaU3otWHEGP5hLdyyRvokjLQSO4t9vWveAfWx87Def3/8m7GgTU6BsGc9oOhOn1
+0dmKhuxpYC2SRWktUZvocVLDzvNo5f2SkBXQINTwnPQgu6x0A4stu6rrAoGAbT4g
+XhtWDW6mTPrazingp1bkmCdXhtas3ISQjZM9FfUyyoe9dxp2+6e5IDqWHbFcMdlC
+UK1gj3VXmgjSOVLK5brARPlVMcAQYCAk/5C0DKD4zp9x6Bp7OyZXsqCjZZB9Qb4F
+OtRKP/ar5ZfqNAPcQLxirt0IAgi4mdupUph5f/ECgYASsCniBvvUVRk13/xPxbcy
+v4Fh3RZ+/kr378vVDwB1hDwWOj7lWpifhb4EjV4eL3E/V+odPtI6469CenLGeEFa
+UxrCGETbeMqflVMZPJUKOiEB93EQnjbdXSzLUEiEJ269L7UKZbEggyFNe49/FlUL
+8nN4JNQoX3la/78SprRc7A==
+-----END PRIVATE KEY-----

traefik/traefik.yml

@@ -9,8 +9,13 @@ entryPoints:
     address: ":80"
   https:
     address: ":443"
+    http:
+      tls:
+        {}
 
 providers:
+  file:
+    directory: /config
   docker:
     endpoint: "unix:///var/run/docker.sock"
     exposedByDefault: false