enable https with caddy root ca

2025-03-14 13:45:01 +01:00 · 2025-03-14 13:45:01 +01:00 · e2666bdfad
commit e2666bdfad
parent fc86424caa
4 changed files with 167 additions and 41 deletions
--- a/proxy/Caddyfile
+++ b/proxy/Caddyfile
@ -1,51 +1,86 @@
 {
-	auto_https off
+	auto_https disable_redirects
+	local_certs
+	pki {
+		ca local {
+			name "{$LOCAL_CA_NAME}"
+		}
+	}
 	log default {
 		output stdout
 		format console
 	}
 }

-http://whoami.{$DOMAIN} {
-	reverse_proxy whoami:80
-}
-
-http://dashboard.{$DOMAIN} {
-	reverse_proxy homer:8080
-}
-
-http://hassi.{$DOMAIN} {
-	# reverse_proxy homeassistant:8123
-	reverse_proxy {host}:8123
-}
-
-http://zigbee2mqtt.{$DOMAIN} {
-	reverse_proxy zigbee2mqtt:8080
-}
-
-http://jellyfin.{$DOMAIN} {
-	reverse_proxy jellyfin:8096
-}
-
-http://paperless.{$DOMAIN} {
-	reverse_proxy paperless-ngx:8000
-}
-
-http://download.{$DOMAIN} {
-	reverse_proxy pyload:8000
-}
-
-http://uptime.{$DOMAIN} {
-	reverse_proxy uptime-kuma:3001
-}
-
-http://torrent.{$DOMAIN} {
-	reverse_proxy transmission:9091
-}
-
-:80, :443 {
-	respond "404 Not Found" 404
+(errorhandler) {
 	handle_errors {
-		respond "{err.status_code} {err.status_text}" {err.status_code}
+		root * /usr/share/caddy/web
+		rewrite * /error.html
+		templates
+		file_server {
+			status {err.status_code}
+		}
 	}
 }
+
+(localtls) {
+	tls internal
+}
+
+whoami.{$DOMAIN} http://whoami.{$DOMAIN} {
+	reverse_proxy whoami:80
+	import errorhandler
+}
+
+dashboard.{$DOMAIN}  http://dashboard.{$DOMAIN} {
+	reverse_proxy homer:8080
+	import errorhandler
+}
+
+hassi.{$DOMAIN} http://hassi.{$DOMAIN} {
+	# reverse_proxy homeassistant:8123
+	reverse_proxy {host}:8123
+	import errorhandler
+}
+
+zigbee2mqtt.{$DOMAIN} http://zigbee2mqtt.{$DOMAIN} {
+	reverse_proxy zigbee2mqtt:8080
+	import errorhandler
+}
+
+jellyfin.{$DOMAIN} http://jellyfin.{$DOMAIN} {
+	reverse_proxy jellyfin:8096
+	import errorhandler
+}
+
+paperless.{$DOMAIN} http://paperless.{$DOMAIN} {
+	reverse_proxy paperless-ngx:8000
+	import errorhandler
+}
+
+download.{$DOMAIN} http://download.{$DOMAIN} {
+	reverse_proxy pyload:8000
+	import errorhandler
+}
+
+uptime.{$DOMAIN} http://uptime.{$DOMAIN} {
+	reverse_proxy uptime-kuma:3001
+	import errorhandler
+}
+
+torrent.{$DOMAIN} http://torrent.{$DOMAIN} {
+	reverse_proxy transmission:9091
+	import errorhandler
+}
+
+root-ca.{$DOMAIN} http://root-ca.{$DOMAIN} {
+	file_server * {
+		root /usr/share/caddy/web
+		hide .git Readme.md
+	}
+	file_server /root.crt {
+		root /data/caddy/pki/authorities/local/
+		hide *.key
+	}
+	import errorhandler
+}
--- a/proxy/docker-compose.yaml
+++ b/proxy/docker-compose.yaml
@ -5,14 +5,20 @@ services:
    restart: unless-stopped
    ports:
      - 80:80
+      - 443:443
+      - "443:443/udp"
    volumes:
      - ${VOLUMES_PATH}/proxy/caddy/data:/data
      - ${VOLUMES_PATH}/proxy/caddy/config:/config
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./web:/usr/share/caddy/web:ro
    networks:
      - web
    environment:
      - DOMAIN=${DOMAIN}
+      - LOCAL_CA_NAME=${LOCAL_CA_NAME}
+    cap_add:
+      - cap_net_bind_service


  whoami:
--- a/proxy/web/default.css
+++ b/proxy/web/default.css
@ -0,0 +1,13 @@
+:root {
+   max-width: 80ch;
+   padding: 3em 1em;
+   margin: auto;
+   font-size: 1.25em;
+   font-family: Arial, Helvetica, sans-serif;
+}
+
+footer {
+   position: absolute;
+   bottom: 0;
+   height: 50px;
+}
--- a/proxy/web/index.html
+++ b/proxy/web/index.html
@ -0,0 +1,72 @@
+<!DOCTYPE html>”
+<html lang="de">
+
+<head>
+   <meta charset="UTF-8">
+   <title>Containerize Root-CA</title>
+   <link rel="stylesheet" href="default.css">
+   <meta name="viewport" content="width=device-width, initial-scale=1">
+</head>
+
+<body>
+   <h1>Containerize Root-CA</h1>
+
+   <p>
+      Caddy dient als lokale Zertifizierungsstelle (CA) um eigene lokale Zertifikate zu signieren.
+      Details siehe <a href="https://caddyserver.com/docs/automatic-https#local-https">Caddy Doku</a>.
+   </p>
+
+   <p>
+      Führe folgendes aus:
+   <ol>
+      <li>
+         Klicken sie <a href="/root.crt" download="caddy-root-ca.crt">hier</a> um das CA-Zertifikat von Caddy herunter
+         zu laden.<br>
+      </li>
+
+      <li>
+         Installiere das caddy-root-ca.crt in den Windwos Truststore. <br>
+         Öffne die Datei mit Doppelklick und drücke "Zertifikat installieren". <br>
+         Wähle "Aktueller Benutzer" und den Zertifikatspeicher "Vertrauenswürdige Stammzertifizierungsstellen"
+      </li>
+
+      <li>
+         Installiere das caddy-root-ca.crt manuell in deinen Browser. Chrome benutzt den Zertifikatsspeicher vom
+         Betriebsystem.
+      </li>
+
+      <li>
+         Um das CA-Certifikat in den Linux-Truststore zu installieren führen Sie folgende Befehle aus:
+         <pre><code>curl -o caddy-root-ca.crt <span id="url">http://example.lan/</span>root.crt
+sudo mkdir -p /usr/local/share/ca-certificates/extra
+sudo cp caddy-root-ca.crt /usr/local/share/ca-certificates/extra/
+sudo update-ca-certificates
+         </code>
+         </pre>
+         <script>
+            let url = new URL(window.location);
+            url.protocol = 'http:';
+            url.port = '80';
+            document.getElementById("url").innerHTML = url.toString();
+            </script>
+      </li>
+      <li>
+         Fertig.
+         <a>Wechsle jetzt zu https
+            <script>
+               let httpsurl = new URL(window.location);
+               httpsurl.protocol = 'https:';
+               httpsurl.port = '443';
+               document.currentScript.parentElement.href = httpsurl.toString();
+            </script>
+         </a>.
+      </li>
+
+   </ol>
+   </p>
+
+</body>
+
+
+
+</html>