enable https with caddy root ca
This commit is contained in:
parent
fc86424caa
commit
e2666bdfad
4 changed files with 167 additions and 41 deletions
117
proxy/Caddyfile
117
proxy/Caddyfile
|
|
@ -1,51 +1,86 @@
|
|||
{
|
||||
auto_https off
|
||||
auto_https disable_redirects
|
||||
local_certs
|
||||
pki {
|
||||
ca local {
|
||||
name "{$LOCAL_CA_NAME}"
|
||||
}
|
||||
}
|
||||
log default {
|
||||
output stdout
|
||||
format console
|
||||
}
|
||||
}
|
||||
|
||||
http://whoami.{$DOMAIN} {
|
||||
reverse_proxy whoami:80
|
||||
}
|
||||
|
||||
http://dashboard.{$DOMAIN} {
|
||||
reverse_proxy homer:8080
|
||||
}
|
||||
|
||||
http://hassi.{$DOMAIN} {
|
||||
# reverse_proxy homeassistant:8123
|
||||
reverse_proxy {host}:8123
|
||||
}
|
||||
|
||||
http://zigbee2mqtt.{$DOMAIN} {
|
||||
reverse_proxy zigbee2mqtt:8080
|
||||
}
|
||||
|
||||
http://jellyfin.{$DOMAIN} {
|
||||
reverse_proxy jellyfin:8096
|
||||
}
|
||||
|
||||
http://paperless.{$DOMAIN} {
|
||||
reverse_proxy paperless-ngx:8000
|
||||
}
|
||||
|
||||
http://download.{$DOMAIN} {
|
||||
reverse_proxy pyload:8000
|
||||
}
|
||||
|
||||
http://uptime.{$DOMAIN} {
|
||||
reverse_proxy uptime-kuma:3001
|
||||
}
|
||||
|
||||
http://torrent.{$DOMAIN} {
|
||||
reverse_proxy transmission:9091
|
||||
}
|
||||
|
||||
:80, :443 {
|
||||
respond "404 Not Found" 404
|
||||
(errorhandler) {
|
||||
handle_errors {
|
||||
respond "{err.status_code} {err.status_text}" {err.status_code}
|
||||
root * /usr/share/caddy/web
|
||||
rewrite * /error.html
|
||||
templates
|
||||
file_server {
|
||||
status {err.status_code}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
(localtls) {
|
||||
tls internal
|
||||
}
|
||||
|
||||
whoami.{$DOMAIN} http://whoami.{$DOMAIN} {
|
||||
reverse_proxy whoami:80
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
dashboard.{$DOMAIN} http://dashboard.{$DOMAIN} {
|
||||
reverse_proxy homer:8080
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
hassi.{$DOMAIN} http://hassi.{$DOMAIN} {
|
||||
# reverse_proxy homeassistant:8123
|
||||
reverse_proxy {host}:8123
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
zigbee2mqtt.{$DOMAIN} http://zigbee2mqtt.{$DOMAIN} {
|
||||
reverse_proxy zigbee2mqtt:8080
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
jellyfin.{$DOMAIN} http://jellyfin.{$DOMAIN} {
|
||||
reverse_proxy jellyfin:8096
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
paperless.{$DOMAIN} http://paperless.{$DOMAIN} {
|
||||
reverse_proxy paperless-ngx:8000
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
download.{$DOMAIN} http://download.{$DOMAIN} {
|
||||
reverse_proxy pyload:8000
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
uptime.{$DOMAIN} http://uptime.{$DOMAIN} {
|
||||
reverse_proxy uptime-kuma:3001
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
torrent.{$DOMAIN} http://torrent.{$DOMAIN} {
|
||||
reverse_proxy transmission:9091
|
||||
import errorhandler
|
||||
}
|
||||
|
||||
root-ca.{$DOMAIN} http://root-ca.{$DOMAIN} {
|
||||
file_server * {
|
||||
root /usr/share/caddy/web
|
||||
hide .git Readme.md
|
||||
}
|
||||
file_server /root.crt {
|
||||
root /data/caddy/pki/authorities/local/
|
||||
hide *.key
|
||||
}
|
||||
import errorhandler
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,14 +5,20 @@ services:
|
|||
restart: unless-stopped
|
||||
ports:
|
||||
- 80:80
|
||||
- 443:443
|
||||
- "443:443/udp"
|
||||
volumes:
|
||||
- ${VOLUMES_PATH}/proxy/caddy/data:/data
|
||||
- ${VOLUMES_PATH}/proxy/caddy/config:/config
|
||||
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
||||
- ./web:/usr/share/caddy/web:ro
|
||||
networks:
|
||||
- web
|
||||
environment:
|
||||
- DOMAIN=${DOMAIN}
|
||||
- LOCAL_CA_NAME=${LOCAL_CA_NAME}
|
||||
cap_add:
|
||||
- cap_net_bind_service
|
||||
|
||||
|
||||
whoami:
|
||||
|
|
|
|||
13
proxy/web/default.css
Normal file
13
proxy/web/default.css
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
:root {
|
||||
max-width: 80ch;
|
||||
padding: 3em 1em;
|
||||
margin: auto;
|
||||
font-size: 1.25em;
|
||||
font-family: Arial, Helvetica, sans-serif;
|
||||
}
|
||||
|
||||
footer {
|
||||
position: absolute;
|
||||
bottom: 0;
|
||||
height: 50px;
|
||||
}
|
||||
72
proxy/web/index.html
Normal file
72
proxy/web/index.html
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
<!DOCTYPE html>”
|
||||
<html lang="de">
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<title>Containerize Root-CA</title>
|
||||
<link rel="stylesheet" href="default.css">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h1>Containerize Root-CA</h1>
|
||||
|
||||
<p>
|
||||
Caddy dient als lokale Zertifizierungsstelle (CA) um eigene lokale Zertifikate zu signieren.
|
||||
Details siehe <a href="https://caddyserver.com/docs/automatic-https#local-https">Caddy Doku</a>.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
Führe folgendes aus:
|
||||
<ol>
|
||||
<li>
|
||||
Klicken sie <a href="/root.crt" download="caddy-root-ca.crt">hier</a> um das CA-Zertifikat von Caddy herunter
|
||||
zu laden.<br>
|
||||
</li>
|
||||
|
||||
<li>
|
||||
Installiere das caddy-root-ca.crt in den Windwos Truststore. <br>
|
||||
Öffne die Datei mit Doppelklick und drücke "Zertifikat installieren". <br>
|
||||
Wähle "Aktueller Benutzer" und den Zertifikatspeicher "Vertrauenswürdige Stammzertifizierungsstellen"
|
||||
</li>
|
||||
|
||||
<li>
|
||||
Installiere das caddy-root-ca.crt manuell in deinen Browser. Chrome benutzt den Zertifikatsspeicher vom
|
||||
Betriebsystem.
|
||||
</li>
|
||||
|
||||
<li>
|
||||
Um das CA-Certifikat in den Linux-Truststore zu installieren führen Sie folgende Befehle aus:
|
||||
<pre><code>curl -o caddy-root-ca.crt <span id="url">http://example.lan/</span>root.crt
|
||||
sudo mkdir -p /usr/local/share/ca-certificates/extra
|
||||
sudo cp caddy-root-ca.crt /usr/local/share/ca-certificates/extra/
|
||||
sudo update-ca-certificates
|
||||
</code>
|
||||
</pre>
|
||||
<script>
|
||||
let url = new URL(window.location);
|
||||
url.protocol = 'http:';
|
||||
url.port = '80';
|
||||
document.getElementById("url").innerHTML = url.toString();
|
||||
</script>
|
||||
</li>
|
||||
<li>
|
||||
Fertig.
|
||||
<a>Wechsle jetzt zu https
|
||||
<script>
|
||||
let httpsurl = new URL(window.location);
|
||||
httpsurl.protocol = 'https:';
|
||||
httpsurl.port = '443';
|
||||
document.currentScript.parentElement.href = httpsurl.toString();
|
||||
</script>
|
||||
</a>.
|
||||
</li>
|
||||
|
||||
</ol>
|
||||
</p>
|
||||
|
||||
</body>
|
||||
|
||||
|
||||
|
||||
</html>
|
||||
Loading…
Add table
Reference in a new issue