How to deal with certificates? reddit / selfhosted ---------------------------------------------------------------------- trexxeon · 2023-10-28 18:45 Some applications have connections that needs certificates to work, I usually get my certificates a from the reverse proxy and let’s encrypt. But if I want to run a service that supports connections with TLS and want to map the certificates to that container, I need to run that container as root, but what to do if I don’t want to run it as root? Is copy them a “real” solution? ---------------------------------------------------------------------- Aronacus · 2023-10-28 19:01 Look up certbot. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 20:07 > But if I want to run a service that supports connections with TLS and want to map the certificates to that container, I need to run that container as root Why? Who says you need to run it as root just because youre mapping files into it? Can you share a compose file of that? You can use simple tools like [lego](https://github.com/go-acme/lego) to generate your LE certs and combine that with a cronjob, generate and copy the files to wherever you want them, done. Certbot has also been around for a long time, also look at [legocerthub](https://github.com/gregtwallace/legocerthub). ---------------------------------------------------------------------- trexxeon · 2023-10-28 20:07 I thought that was just a tool to get certificates? ---------------------------------------------------------------------- -quakeguy- · 2023-10-28 20:08 What? What does root have to do with anything? ---------------------------------------------------------------------- 2lach · 2023-10-28 20:23 There are some specific tags for working TLS and you can also solve it by using docker context which could be good if you're working with multiple hosts and connection types. This [guide](https://www.howtogeek.com/devops/how-to-secure-dockers- tcp-socket-with-tls/#creating-your-certificate-authority) it's kinda long, but it will walk you through the entire process. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 20:31 Honestly, wtf does the Docker TCP socket have to do with any of this? ---------------------------------------------------------------------- thekrautboy · 2023-10-28 20:43 It mostly is but thats what youre asking for?! ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-28 20:47 I usually issue a dedicated certificate for such cases, and make those available via bind mount. The container gets its dedicated unix user. The cert and privkey are owned by that user with 444/400 rights. That's how you solve permissions issue. ---------------------------------------------------------------------- trexxeon · 2023-10-28 21:23 The created certs by caddy is owned by the user root on the server, so if a non root container tries to use the certs it doesn’t have right permissions .. mainly asked what best practise is, but copy certs seems to be considered okay so I’ll set up some scripts that automatically copy certs for each service ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:30 Then simply copy them where you need them and change the owner/permissions on the files. ---------------------------------------------------------------------- trexxeon · 2023-10-28 21:52 If you have many certificates it’s hard to keep track of when it’s expiring.. so was wondering if it was an easy way of handling this that I haven’t thought about.. But guess a simple cron that runs once a week just copying whatever certs that are in the cert folder will work ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:54 All the mentioned tools can take care of expiring certs and renew them. ---------------------------------------------------------------------- zarlo5899 · 2023-10-29 01:02 i would use selfsinged certificates for the containers that MUST have one and then just terminate it at the reverse proxy ---------------------------------------------------------------------- 2lach · 2023-10-29 09:28 Oh honey, you need to get laid ---------------------------------------------------------------------- thekrautboy · 2023-10-29 09:32 Are you offering, honey? ---------------------------------------------------------------------- 2lach · 2023-10-29 09:35 Hehe, well buy me a drink first and we can take from there ---------------------------------------------------------------------- thekrautboy · 2023-10-29 11:43 Blocked, bye. ---------------------------------------------------------------------- jjcf89 · 2023-10-29 14:25 Certbot atleast has a renew hooks directory that calls your scripts when the cert is updated. ---------------------------------------------------------------------- agent_kater · 2023-10-29 14:38 I also have some containers that do their own TLS (because they're not HTTP servers) and I have Caddy get the certificates for them. I have them mounted into the container and I use the on_certificate_acquired hook to chown them. ---------------------------------------------------------------------- trexxeon · 2023-10-29 17:10 That’s good to know, thanks ---------------------------------------------------------------------- trexxeon · 2023-10-29 17:17 This sounds like a good solution, I am also using caddy.. Do you run it in a container? Haven’t really tried to add a third party module to the docker container ---------------------------------------------------------------------- agent_kater · 2023-10-29 17:46 I'm running Caddy outside the container using the APT package and I have a script to update Caddy by downloading a new executable with the necessary plugins and then (deleting and) overwriting the existing one. The services I have in containers and they have their certificate directory mounted. But you could just as well run Caddy in a container as well, just mount an empty directory from the host for the certificates and then share subdirectories of that with the other services. ---------------------------------------------------------------------- kmisterk · 2023-11-06 18:51 ## Message Removed Harassment, abuse, insults, expletives, or other negative comments or posts *targeting a person* is absolutely not tolerated. Bigotry, excessive elitism, and intentionally-demeaning dialogue will also be removed as deemed necessary. We aim to promote an inclusive, yet constructive community that helps people group. [Message the mods](https://www.reddit.com/message/compose/?to=/r/selfh osted&subject=Removed for Rule 3&message=[Removed Post](https://www.re ddit.com/r/selfhosted/comments/17ik7v7/-/k6xkzbk/\))