From d5085d31563c5008fc61c6180ad77bf0d28983e3 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Wed, 10 Aug 2022 13:56:06 -0400 Subject: [PATCH] feat: expose letsencrypt-server property for traefik plugin --- docs/networking/proxies/traefik.md | 22 +++++++++++++++++-- plugins/traefik-vhosts/command-functions | 1 + plugins/traefik-vhosts/internal-functions | 5 +++++ .../templates/compose.yml.sigil | 2 +- 4 files changed, 27 insertions(+), 3 deletions(-) diff --git a/docs/networking/proxies/traefik.md b/docs/networking/proxies/traefik.md index d1e384e7f..1eb8a2430 100644 --- a/docs/networking/proxies/traefik.md +++ b/docs/networking/proxies/traefik.md @@ -21,7 +21,7 @@ The Traefik plugin has specific rules for routing requests: - While Traefik will respect labels associated with other containers, only `web` containers have Traefik labels injected by the plugin. - Only `http:80` and `https:443` port mappings are supported. - If no `http:80` mapping is found, the first `http` port mapping is used for http requests. -- If no `https:443` mapping is found, the first `https` port mapping is used for http requests. +- If no `https:443` mapping is found, the first `https` port mapping is used for https requests. - If no `https` mapping is found, the container port from `http:80` will be used for https requests. - Requests are routed as soon as the container is running and passing healthchecks. @@ -108,7 +108,11 @@ dokku traefik:set --global log-level DEBUG After modifying, the Traefik container will need to be restarted. -### Enabling letsencrypt integration +### SSL Configuration + +The traefik plugin only supports automatic ssl certificates from it's letsencrypt integration. Managed certificates provided by the `certs` plugin are ignored. + +#### Enabling letsencrypt integration By default, letsencrypt is disabled and https port mappings are ignored. To enable, set the `letsencrypt-email` property with the `--global` flag: @@ -118,6 +122,16 @@ dokku traefik:set --global letsencrypt-email automated@dokku.sh After enabling, apps will need to be rebuilt and the Traefik container will need to be restarted. All http requests will then be redirected to https. +#### Customizing the letsencrypt server + +The letsencrypt integration is set to the production letsencrypt server by default. To change this, set the `letsencrypt-server` property with the `--global` flag: + +```shell +dokku traefik:set --global letsencrypt-server https://acme-staging-v02.api.letsencrypt.org/directory +``` + +After enabling, the Traefik container will need to be restarted and apps will need to be rebuilt to retrieve certificates from the new server. + ### API Access Traefik exposes an API and Dashboard, which Dokku disables by default for security reasons. It can be exposed and customized as described below. @@ -184,6 +198,7 @@ dokku traefik:report Traefik dashboard enabled: false Traefik image: traefik:v2.8 Traefik letsencrypt email: + Traefik letsencrypt server: Traefik log level: ERROR =====> python-app traefik information Traefik api enabled: false @@ -193,6 +208,7 @@ dokku traefik:report Traefik dashboard enabled: false Traefik image: traefik:v2.8 Traefik letsencrypt email: + Traefik letsencrypt server: Traefik log level: ERROR =====> ruby-app traefik information Traefik api enabled: false @@ -202,6 +218,7 @@ dokku traefik:report Traefik dashboard enabled: false Traefik image: traefik:v2.8 Traefik letsencrypt email: + Traefik letsencrypt server: Traefik log level: ERROR ``` @@ -220,6 +237,7 @@ dokku traefik:report node-js-app Traefik dashboard enabled: false Traefik image: traefik:v2.8 Traefik letsencrypt email: + Traefik letsencrypt server: Traefik log level: ERROR ``` diff --git a/plugins/traefik-vhosts/command-functions b/plugins/traefik-vhosts/command-functions index facd08d79..423256a5c 100755 --- a/plugins/traefik-vhosts/command-functions +++ b/plugins/traefik-vhosts/command-functions @@ -42,6 +42,7 @@ cmd-traefik-report-single() { "--traefik-dashboard-enabled: $(fn-traefik-dashboard-enabled)" "--traefik-image: $(fn-traefik-image)" "--traefik-letsencrypt-email: $(fn-traefik-letsencrypt-email)" + "--traefik-letsencrypt-server: $(fn-traefik-letsencrypt-server)" "--traefik-log-level: $(fn-traefik-log-level)" ) diff --git a/plugins/traefik-vhosts/internal-functions b/plugins/traefik-vhosts/internal-functions index 4103d764f..9429504b1 100755 --- a/plugins/traefik-vhosts/internal-functions +++ b/plugins/traefik-vhosts/internal-functions @@ -49,6 +49,7 @@ fn-traefik-template-compose-file() { TRAEFIK_DATA_DIR="${DOKKU_LIB_ROOT}/data/traefik" TRAEFIK_IMAGE="$(fn-traefik-image)" TRAEFIK_LETSENCRYPT_EMAIL="$(fn-traefik-letsencrypt-email)" + TRAEFIK_LETSENCRYPT_SERVER="$(fn-traefik-letsencrypt-server)" TRAEFIK_LOG_LEVEL="$(fn-traefik-log-level)") sigil -f "$COMPOSE_TEMPLATE" "${SIGIL_PARAMS[@]}" | cat -s >"$OUTPUT_PATH" @@ -82,6 +83,10 @@ fn-traefik-letsencrypt-email() { fn-plugin-property-get-default "traefik" "--global" "letsencrypt-email" "" } +fn-traefik-letsencrypt-server() { + fn-plugin-property-get-default "traefik" "--global" "letsencrypt-server" "https://acme-v02.api.letsencrypt.org/directory" +} + fn-traefik-log-level() { local log_level log_level="$(fn-plugin-property-get-default "traefik" "--global" "log-level" "ERROR")" diff --git a/plugins/traefik-vhosts/templates/compose.yml.sigil b/plugins/traefik-vhosts/templates/compose.yml.sigil index 4924b89a5..dfae6c6d6 100644 --- a/plugins/traefik-vhosts/templates/compose.yml.sigil +++ b/plugins/traefik-vhosts/templates/compose.yml.sigil @@ -17,7 +17,7 @@ services: - --log.format=json {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }} - - --certificatesresolvers.leresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory + - --certificatesresolvers.leresolver.acme.caserver={{ $.TRAEFIK_LETSENCRYPT_SERVER }}" - --certificatesresolvers.leresolver.acme.email={{ $.TRAEFIK_LETSENCRYPT_EMAIL }} - --certificatesresolvers.leresolver.acme.storage=/acme.json - --certificatesresolvers.leresolver.acme.tlschallenge=true