Add SSL support

https://github.com/wodby/docker4drupal/issues/50#issuecomment-291749340,

https://github.com/wodby/docker4drupal/issues/50#issuecomment-307755705:

traefik:
    image: traefik
    restart: unless-stopped
    command: -c /dev/null --web --docker --logLevel=INFO --defaultEntryPoints='https' --entryPoints="Name:https Address::443 TLS:/certs/cert.pem,/certs/key.pem" --entryPoints="Name:http Address::80 Redirect.EntryPoint:https"
    ports:
      - '80:80'
      - '443:443'
      - '8080:8080'
    volumes:
      - ./certs:/certs/
      - /var/run/docker.sock:/var/run/docker.sock

The decisive parts are the command line and the reference to the certificate files, included via volume share.

However I removed the redirect from http to https, as this allows to access projects with both. As some projects may require https and others may not:

command: -c /dev/null --web --docker --logLevel=DEBUG --defaultEntryPoints="https" --defaultEntryPoints="http" --entryPoints="Name:https Address::443 TLS:/certs/cert.pem,/certs/key.pem" --entryPoints="Name:http Address::80"

changed the description

I left a couple of comments in 2cb7fa71 and I have an additional thought which I'd like to discuss here:

While creating the cert, the user will be asked some questions. We could write some reasonable value into a config file and then add that config file as an additional option to the command line with -config cert.conf. This file gets some content like this:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = EN
ST = Some State
L = Town Name
O = Organisation Name
CN = *.docker.localhost
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth

This will prevent the interactive mode during composer execution for this part.

Finally I just wonder why Chrome still complaints about the cert. It is still in red and called invalid. Any ideas?

assigned to @richardpapp

added To Do label

@richardpapp while cleaning up the backlog I came across this old issue. As I'm planning some enhancements over the holiday season on our local development environment tool chain, I'm wondering if we should get back to this one too. Maybe we could even go a step further as the Traefik combined with Letsencrypt seems to support something like a local CA for any kind of domain. Are you interested or do you have time to help working on this?

added Doing label and removed To Do label

assigned to @jurgenhaas and unassigned @richardpapp

Specify and configure your dev-domain

For this documentation we work with the domain dev.myname.info and this will be used as wildcard, so that for each project you're working on a sub-domain suffix will be added, e.g. shop.dev.myname.info or customer14.dev.myname.info. You need to configure your local DNS such that *.dev.myname.info resolves to 127.0.0.1 - you can do that with dnsmasq or a pihole. There is plenty of documentation around on how to do that depending on your operating system.

Issue a wildcard SSL certificate

For this you have to install a LetsEncrypt client. We recommend Certbot. Then you can issue a wildcard certificate with the following command:

certbot -d "*.dev.myname.info" --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns certonly
cp /etc/letsencrypt/live/dev.jurgenhaas.de/*.pem ~/.traefik/certs
sudo chmod +r ~/.traefik/certs/*.pem

You will be presented with a request to configure a TXT record on your DNS provider. Once you're done that, certbot will issue the SSL certificate for you and you're good to go. Note: you have to renew the certificate every 3 months by using the same commands again.

Configure Traefik to use your SSL certificate

In the docker-compose.yml file for Traefik, the command line should be enhanced to contain some extra instructions:

version: '3'
services:
  traefik:
    image: traefik
    restart: unless-stopped
    command: '-c /dev/null --web --docker --defaultEntryPoints="https" --defaultEntryPoints="http" --entryPoints="Name:https Address::443 TLS:/certs/fullchain.pem,/certs/privkey.pem" --entryPoints="Name:http Address::80"'
    ports:
      - '80:80'
      - '443:443'
      - '8080:8080'
    volumes:
      - './certs:/certs/'
      - '/var/run/docker.sock:/var/run/docker.sock'

Once you've restarted Traefik with docker-compose up -d you're able to access https://customer32.dev.myname.info and all other subdomains.

We're planning to support as much of this in our composer library for Traefik such that you can easily utilize that in your development projects too.

Helpful links:

• https://www.codementor.io/@slavko/unobtrusive-local-development-with-traefik2-docker-and-letsencrypt-15qw1ypoi8
• https://blog.v-gar.de/2018/03/how-to-create-wildcard-certificates-with-lets-encrypt/

We recommend creating a file ~/.env file with all your default values, that will be used for all your projects on that host, unless you overwrite a variable per project. Here are the recommended default values to get started:

COMPOSER_DOWNGRADE=0
DOCKER4DRUPAL_LIVE_HOST_USERNAME=[you user name]
DOCKER4DRUPAL_TRAEFIK_DOMAIN=docker.localhost
DOCKER4DRUPAL_TRAEFIK_USESSL=0
DOCKER4DRUPAL_TRAEFIK_PORT=8000
DOCKER4DRUPAL_TRAEFIK_PORTS=8443
DOCKER4DRUPAL_TRAEFIK_CERT=fullchain.pem
DOCKER4DRUPAL_TRAEFIK_KEY=privkey.pem
DORGFLOW=0
PHP_DEBUG=0
PHP_VERSION=7.4
WEBSERVER_CONFIG_OVERWRITE=0

If you later want to change to your own development domain and maybe also use SSL, this can be adjusted according to documentation.

added Documentation label and removed Doing label

unassigned @jurgenhaas

mentioned in commit devops-tools/documentation@9c3609b3

Documentation added to https://devops-tools.docs.lakedrops.com/docker/l3d/drupal/#working-with-ssl

closed

removed Documentation label