Docker Radicale cannot load SSL certificate
reddit / selfhosted

----------------------------------------------------------------------
No-Association7026 · 2023-12-08 16:01

I'm trying to set up Radicale as a Dockerized calDav, cardDav server.
Everything works fine when I set it up for http access but when I try
to set it up for secure access I get the following in the container
log:

    [2023-12-08 01:51:25 +0000] [1] [CRITICAL] An exception occurred
during server startup: Invalid filepath value for option 'certificate'
in section 'server' in config file '/config/config': '/var/snap/nextcl
oud/37720/certs/certbot/config/live/.com/fullchain.pem' ([Errno 2] No
such file or directory: '/var/snap/nextcloud/37720/certs/certbot/confi
g/live/.com/fullchain.pem')

The file and directory ***does*** exist and I made sure that everyone
has read/execute privilege to it.

Here is the docker command used to start the image:

    sudo docker run -d --name radicale \
        -p 5232:5232 \
        -v ~/docker/radicale:/data \
        -v ~/docker/radicale:/config:ro \
        tomsquest/docker-radicale

And here is the relevant section of the config file that Radicale
uses:

    [server]
    hosts = 0.0.0.0:5232
    ssl = True
    certificate =
/var/snap/nextcloud/37720/certs/certbot/config/live/.com/fullchain.pem
    key =
/var/snap/nextcloud/37720/certs/certbot/config/live/.com/privkey.pem

Do I have to mount the cert location as a volume in the container???
If so, what is the mount point?

----------------------------------------------------------------------
purepersistence · 2023-12-08 16:26

Can you (and should you) really have public access to the cerbot live
files? I export from certbot archive myself. Cerbot code might be
getting in your way?

----------------------------------------------------------------------
arcadianarcadian · 2023-12-08 16:35

I would mount both SSL directories and config file as well.

docker run -d --name radicale \\
\-p 5232:5232 \\
\-v \~/docker/radicale/data:/data \\
\-v \~/docker/radicale/config:/config:ro \\

\-v \~/docker/radicale/ssl:/etc/ssl:ro  \\
tomsquest/docker-radicale

​

then store the SSL files on host machine in \~/docker/radicale/ssl.

then replace SSL directives on host machine in
\~/docker/radicale/config/config.ini # or your config file.

​

\# SSL certificate path
certificate = /etc/ssl/radicale.cert.pem
\# SSL private key
key = /etc/ssl/radicale.key.pem

----------------------------------------------------------------------
thekrautboy · 2023-12-08 17:43

-v ~/docker/radicale:/data \
    -v ~/docker/radicale:/config:ro \

Usually not a good idea to mount the same source for two
destinations...

    certificate =
/var/snap/nextcloud/37720/certs/certbot/config/live/.com/fullchain.pem
    key =
/var/snap/nextcloud/37720/certs/certbot/config/live/.com/privkey.pem

And these dont match at all to the mounted path(s) above... what are
you even trying to accomplish here?!

Are you seriously expecting to only mention the cert/key path in the
config and they magically can be used by the container?

You need to make cert and key available to the container, mount them,
to whatever path you like in this case and then adjust to that path in
the config file.

----------------------------------------------------------------------
ElevenNotes · 2023-12-08 18:59

You're [welcome](https://hub.docker.com/r/11notes/radicale)

----------------------------------------------------------------------
No-Association7026 · 2023-12-08 22:27

Thanks everyone for your suggestions.

I did finally get it working with SSL by copying my .pem files to a
local directory and mounting that directory as a volume in the
container.  The only problem is that when they autorenew I will
probably break my secure access to the Radicale server until I copy
them over again.

>Are you seriously expecting to only mention the cert/key path in the
config and they magically can be used by the container?

I'm not sure what I expected being a complete noob to Docker.  I was
just thrashing around trying to follow different online guides and
tutorials. The one thing that was not explained or made clear to me
was how the config file is used.  Is it processed by the Docker engine
to build the container? In which case the file references would be to
the host file system.  Or, is the config file used by the container?
In which case any host files would have to be mounted within the
container.  Obviously, I now know that it is the latter.

So, it's a good day because I learned something new!

Thanks again everyone.