Generate certificates via a container

README.md

@@ -17,24 +17,23 @@ Clone the liip/pontsun repository anywhere. Then `cd` to the working copy.
 
 Create an envfile
 
-```bash
+```sh
 cp ./containers/.env.example ./containers/.env
 ```
 
 Adapt the `./containers/.env` file as needed.
 
 Create certificates for HTTPS
 
-```bash
-chmod u+x ./scripts/generate-certificates.sh
-./scripts/generate-certificates.sh
+```sh
+USER_ID=$(id -u) docker-compose -f docker-compose.certificates.yml up
 ```
 
-You can add the fake root CA authority certificate `certificates/docker.rootCA.crt` to your browser authorities in order to let it trust the concerned local developement instances.
+You can add the fake root CA authority certificate `certificates/docker.test.rootCA.crt` to your browser authorities in order to let it trust the concerned local developement instances.
 
 ## Start Traefik and Portainer
 
-```bash
+```sh
 cd containers
 docker-compose up -d
 ```

containers/.env.example

@@ -18,3 +18,5 @@ PONTSUN_NETWORK=pontsun
 PORTAINER_TAG=1.22.1
 # https://hub.docker.com/_/traefik
 TRAEFIK_TAG=1.7.18-alpine
+# https://hub.docker.com/r/liip/ssl-keygen
+SSL_KEYGEN_TAG=1.0.0

containers/docker-compose.certificates.yml

@@ -0,0 +1,17 @@
+version: '3.5'
+services:
+
+  ssl-keygen:
+      image: liip/ssl-keygen:$SSL_KEYGEN_TAG
+      container_name: 'pontsun_ssl-keygen'
+      command: ls
+      environment:
+          OPENSSL_CERTIFICATE_SUBJECT_COUNTRY: CH
+          OPENSSL_CERTIFICATE_SUBJECT_STATE: FR
+          OPENSSL_CERTIFICATE_SUBJECT_LOCATION: Fribourg
+          OPENSSL_CERTIFICATE_SUBJECT_ORGANIZATION: Liip
+          OPENSSL_CERTIFICATE_SUBJECT_ORGANIZATION_UNIT: Pontsun
+          SITE_DOMAIN: $PROJECT_DOMAIN
+      volumes:
+          - ../certificates/:/certificates:rw
+      user: $USER_ID

containers/docker-compose.yml

@@ -13,9 +13,9 @@ services:
       --docker.exposedByDefault=false \
       --defaultEntryPoints='https' \
       --defaultEntryPoints='http' \
-      --rootCAs='/certs/${PROJECT_NAME}.rootCA.crt' \
+      --rootCAs='/certs/${PROJECT_DOMAIN}.rootCA.crt' \
       --entryPoints='Name:http Address::80' \
-      --entryPoints='Name:https Address::443 TLS:/certs/${PROJECT_NAME}.crt,/certs/${PROJECT_NAME}.key' \
+      --entryPoints='Name:https Address::443 TLS:/certs/${PROJECT_DOMAIN}.crt,/certs/${PROJECT_DOMAIN}.key' \
       --logLevel=ERROR
     restart: always
     ports: