Please add easy way to import custom SSL certificates

[3xtant]

I have a local installation, and although I appreciate the ease of the docker compose setup, it created problems for me because my local domain requires HTTPS and I am locked out of the UI. The server is not exposed to the internet. I can create certificates in another machine to load to my opencloud server, but it is not clear how to do it. I guess I can connect to the running containers and load the certificates that way, but I could not find documentation explaining how to do it.

I think it is fair to say that many installations will be intranet-only, at least at first, and then become internet-ready, so my case is not an isolated one. It is also important to allow some customization of the acme client. Some people or organizations may prefer to use other CAs. acme.sh, for example, has migrated away from Let's Encrypt as the default CA.

Even though it is very simple to set up a server with Let's Encrypt, the lack of options is a problem for advanced users or custom configurations. Please consider the "SLR model" for your growing application. Photographers can set their camera to full-auto and take some nice pictures, but professionals will always prefer to change some or all the settings to suit their preferences or needs. It is important to offer both options.

Thanks for your attention, and your project!

[micbar]

You can use two ENV variables of the proxy service.

PROXY_TRANSPORT_TLS_CERT
PROXY_TRANSPORT_TLS_KEY

Both are taking a path to a file as a value.

[3xtant]

Thank you! I got things working and haven't had a chance to come back to it. I will try this and report back. I think we can consider this item closed.

[chrisi0801]

Hey @micbar I was wondering if you could explain in more detail where exactly these variables have to be set and how the formatting of the values of the variables should be.

I use the docker-compose variant on an intranet-only server and want to use a different domain + my own TLS certificate. Because I dont have any ports open, I can't use the provided let's encrypt process of opencloud.

Is there a guide / tutorial somewhere for these variables? Could you provide one?

Thank you so much. Love Opencloud and especially its performance. Hope to be able to fix this last issue that I have :)

[micbar]

Hey @chrisi0801
I am glad to help.

You can set this ENV variables in the docker compose on the opencloud container. It needs to point to the two different files with the absolute path inside the container.

You can see an example how to do that in this line https://github.com/opencloud-eu/opencloud/blob/main/deployments/examples/opencloud_full/opencloud.yml#L55

Please note that the files need to be mounted into the container first like this https://github.com/opencloud-eu/opencloud/blob/main/deployments/examples/opencloud_full/opencloud.yml#L63
So you can put the cert and the key file in the config/opencloud folder in the docker compose example and mount them like the file above in /etc/opencloud/opencloud.crt and /etc/opencloud/opencloud.key. Then you can set PROXY_TRANSPORT_TLS_CERT: /etc/opencloud/opencloud.crt and PROXY_TRANSPORT_TLS_KEY: /etc/opencloud/opencloud.key.

I hope that helps.

[chrisi0801]

Hey! I wasn't able to use my own certificate but I have managed to get an ever better method to work: I adapted the docker-compose.yml of the opencloud_full deployment example and added the ability for Letsencrypt to use the DNS01 challenge instead of HTTP01. I attached a docker-compose file with all the changes that I made. I don't know if this is going to work for others but I hope it's a starting point. I hope this will work in the future with future updates as well as it's quite a nice solution that automatically renews itself :D
docker-compose-changes-dns-challenge.txt

[marcus7501]

Hi @chrisi0801 i'm on the same problem. I had try to copy my own certificates to the custom-config-path and change the opencloud.yml, but nothing works. So i'm very thankfull about your idea with the DNS01 challenge... i will try it. :D

[marcus7501]

Hi @chrisi0801

i try your idea with the ACME-DNS-Challenge but i think, the DNS-API-Credentials in a config-file could be a security risk.
So i was still searching and find now an other good way to get opencloud working with my own certificate.

My Environment:

• Opencloud is up and running with the default Traefik-Certificate
• no Port-Forwarding in my firewall
• the opencloud-docker-path is '$HOME/opencloud/deployments/examples/opencloud_full'
• the custom opencloud paths are '/srv/opencloud/config' and '/srv/opencloud/data'
• i have a certificate for my domain with DNS-Names 'cloud.mydom.tld' 'collabora.mydom.tld' 'traefik.mydom.tld' 'wopiserver.mydom.tld'

What i do:

• customize the 'docker-compose.yml' located in opencloud-docker-path (see file)
• create a file 'mycert.yml' located in the opencloud-custom-config-path (see file)
• restart the docker-container and it works :D

Hope that is helpful to other people.

docker-compose-yml-own-cert.txt
mycert-yml.txt

[chrisi0801]

Thank you @marcus7501

I will try that as well. That would be the best Solution of course!

[chrisi0801]

Update: It has worked for me as well. My wildcard certificate was imported. One thing I had to change in die .env file was insecure=True. With insecure=false or if the line is commented out, the system does not let me login. Thank you again!

[marcus7501]

hi @chrisi0801
thanks for your update. With the param 'insecure=false' i have the same issue. But i leave this param untouched in my .env-file, so you cant see it in my 'docker-compose.yml'... :D

Update:
In my case the problem comes by using the wrong certificate-file.
With param 'insecure=false' and using the single-certificate-file (cert.pem) i got the Authentication-Error.
In docker-logs i see "failed to verify certificate: x509: certificate signed by unknown authority".
Than i change to the full-certificate-file (fullchain.pem), thats include the CA, and it works. :)

[sergeln]

@marcus7501 Great. It's working. Thank you.