Deploy multiple certificates by single Docker Client

Krizz

Hi Greg,

First of all thank you for this project. I have just deployed it yesterday and love the idea of simple central management of certificates.

A bit of (long) background on my home lab. I have a Proxmox host running virtualized OPNSense, TrueNAS, Home Assistant and a VM for various Docker containers, like Jellyfin, Immich, Portainer, CertWarden, Caddy reverse proxy etc. I have already set up Let's Encrypt certificates via ACME DNS Cloudflare provider for Proxmox, Proxmox Backup Server, OPNSense and Truenas either via built in functionality or plugins. For the services running in Docker I am currently using Caddy reverse proxy to enable HTTPS. This however requires these services to enable HTTP. I understand this is only between Caddy and the service and it is all internal network, but I would like to provide these services with their own Let's Encrypt certificates via CertWarden ACME DNS challenge.

To the topic: I would like to be able to deploy multiple certificates to a single VM with_multiple_ Dockerized services. By the documentation the Docker Client only works for single certificate. I found certwarden-deploy project which does exactly what I need, but is provided just as a binary. Is there a way to achieve the same with Docker Client and if not, extend it's capabilities?

Cheers
Krizz

gregtwallace

Thanks for introducting me to the deploy tool someone made. That's really cool, I didn't know other people were building things like that, it made me smile.

To the issue at hand, what I personally do for services on the same docker host is to just not expose the http port outside of the docker network, and then encryption is pointless as nothing is able to leave unencrypted. That said, I understand the desire to play with things and do them "just because". Might you just add additional dns names to the same certificate and use the one certificate across the host? You could also run multiple instances of the certwarden client, one for each cert.

Obviously none of these are ideal. There is an issue open to add this functionality, it just isn't high up my list of things to fiddle with: https://github.com/gregtwallace/certwarden/issues/59

Krizz

gregtwallace

Thanks for the reply. I see your point and it's fair enough. I may just end up with wildcard certificate for docker host or use certwarden-deploy.

Again thank you for a great piece of software!

Cheers
Krizz