I let Caddy automanage and autorenew certificates for my podman containers, and Caddy itself is in a container. There's no reason to let those exposed in my host, and it's one less thing to manage.
But if I had my own separate certificates, the first thing that would come to mind is simply mounting it as a volume inside the needed containers with :ro,Z.
@btp agree with other poster, ingress server does the certs for all the webservers.
At work we currently use Caddy for ingress, and it just automatically handles certs via letsencrypt. If all you're doing is a reverse proxy to the web service it's like 4 lines total in your Caddy config file.
If you don't need a separate ingress server you can also throw a caddy service into your docker-compose, expose ports 80 and 443, then reverse proxy to the app service.
@mvu Well right now I'm not running any other service that terminates the TSL, but I'm seeing a lot of solutions for using a reverse proxy or ingress solution.
However, this just brings up my same question of getting the certs to the container that terminates the TLS.
@btp As mentioned, caddy self manages the certs if none are provided -- if you need to provide your own certs couldn't you just mount them as a volume?
@mvu Yup, I can. I'm just exploring if there's other options. I don't have a ton of experience in deploying containers to production environments, and I'd like to make sure I'm going the secure route.
@btp I don’t. I run a reverse proxy that acts as an ingress point and terminate the TLS there. Traffic will then be forwarded internally unencrypted. See https://nginxproxymanager.com/ as a simple way to set it up.
@vsaw oh, this is the same principle. I'm moreso interested in how to safely provide SSL certificates to a container, regardless if it's the server itself, or a reverse proxy running inside of it. Looks like this uses the volumes solution to provide the let's encrypt certs to the proxy.
@fedops I could. This would make the container more complex than I'd like it to be, though. It's running a single process. I guess I could just compile the Containerfiles from both the Certbot and the server images, and build my own image with just the server and certbot.
This also gives me less control over the container functionality from compose.
Add comment