TLS Wiki documentation doesn't work

[seannie-sharko]

I've spent hours following along on the Wiki page and I can safely say, the explained tutorial does not work using Caddy.

Public-->Local ports have been forwarded on my router.

I have a valid .crt I've created using a trusted CA, however HTTPS will not resolve after 'docker-compose up'.

The URLs in my ./Caddyfile match those of ALLOWED_HOSTS and I've added my .crt and .key to ./cert.crt and ./key.key, respectively.

Has anyone else been successful with this?

[donzenondesomodevilla]

Same for me unfortunately

[tobiasge]

What are the errors you are seeing? Could you post your configuration?
I just tried the setup with an automatic Let's Encrypt and it worked fine.

[donzenondesomodevilla]

This is the error I'm getting after running docker-compose up after I've created the Caddyfile.

ERROR: Version mismatch: file ./docker-compose.yml specifies version 3.4 but extension file ./docker-compose.override.yml uses version 1

I then added a string just specifying the version "3.4" in the docker-compose.override.yml which lets me do a docker-compose up.
However - I then get this error log in the netbox_docker_tls container:

{"level":"info","ts":1665986005.04615,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":"caddyfile"}
{"level":"warn","ts":1665986005.0476494,"msg":"Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1665986005.0623777,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1665986005.063585,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000202930"}
{"level":"info","ts":1665986005.0636022,"logger":"tls.cache.maintenance","msg":"stopped background certificate maintenance","cache":"0xc000202930"}
Error: loading initial config: loading new config: loading http app module: provision http: getting tls app: loading tls app module: provision tls: loading certificates: read /etc/ssl/private/cert.crt: is a directory

[tobiasge]

The last line in your log is telling you exactly what the problem is:

Error: loading initial config: loading new config: loading http app module: provision http: getting tls app: loading tls app module: provision tls: loading certificates: read /etc/ssl/private/cert.crt: is a directory

The certificate is not mounted correctly into the container.

[tobiasge]

So I just tested this again and couldn't reproduce this error. Here is the configuration I used:
docker-compose.override.yml:

version: '3.4'
services:
  tls:
    image: caddy:2-alpine
    depends_on:
      - netbox
    volumes:
      - ./Caddy/netbox.example.org.pem:/etc/ssl/private/cert.crt:ro,z
      - ./Caddy/netbox.example.org-key.pem:/etc/ssl/private/key.key:ro,z
      - ./Caddy/Caddyfile:/etc/caddy/Caddyfile:ro
    ports:
      - 8080:80   # Allows for http redirection
      - 8443:443

Caddyfile:

netbox.example.org {
    reverse_proxy netbox:8080
    encode gzip zstd
    
    tls /etc/ssl/private/cert.crt /etc/ssl/private/key.key
    # or:
    # tls /etc/ssl/private/cert.pem

    log {
      level error
    }
}

The certificate was created with:

mkcert netbox.example.org

[tobiasge]

I created the directory Caddy in my netbox-docker directory. The Caddyfile is then placed in the Caddy directory. In this directory are also the two files for your certificate.

[cimnine]

That's a Docker quirk. You defined a mount for the certificate. But the file was not there, yet. So, when you start the container, what Docker does is that it creates a directory for you where the mount is.

So check the path to cert.crt on your host system. There will be a directory where the file should be. Remove the directory. touch cert.crt. And off you go.