How to set key and certificate with docker?

[alx696]

I have try args and env, both not work. How to set key and certificate?

args:

docker run -d --restart=always \
  -p 10000:9090 \
  -v /etc/letsencrypt/live/dev.lilu.red/fullchain.pem:/tls/server.cer \
  -v /etc/letsencrypt/live/dev.lilu.red/privkey.pem:/tls/server.key \
  --name "ipfs-ws" libp2p/websocket-star-rendezvous:release \
  -cert="/tls/server.cer" \
  -key="/tls/server.key"

env:

docker run -d --restart=always \
  -p 10000:9090 \
  -v /etc/letsencrypt/live/dev.lilu.red/fullchain.pem:/tls/server.cer \
  -v /etc/letsencrypt/live/dev.lilu.red/privkey.pem:/tls/server.key \
  -e cert="/tls/server.cer" \
  -e key="/tls/server.key" \
  --name "ipfs-ws" libp2p/websocket-star-rendezvous:release

Currently, i used an nginx https proxy:

server
{
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  server_name ipfs.dev.lilu.red;
  ssl_session_cache shared:SSL:15m;
  ssl_session_timeout 15m;
  ssl_certificate /tls/server.cer;
  ssl_certificate_key /tls/server.key;
  ssl_protocols TLSv1.2; # Android not support 1.3!
  ssl_ciphers HIGH:!aNULL:!MD5;

  location / {
    proxy_pass http://172.17.0.1:10000/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
  }
}

[mkg20001]

docker run -d --restart=always \
  -p 10000:9090 \
  -v /etc/letsencrypt/live/dev.lilu.red/fullchain.pem:/tls/server.cer \
  -v /etc/letsencrypt/live/dev.lilu.red/privkey.pem:/tls/server.key \
  --name "ipfs-ws" libp2p/websocket-star-rendezvous:release \
  --cert "/tls/server.cer" \
  --key "/tls/server.key"

Try this command. I've changed the options slightly.

[mkg20001]

The problems with your commands:

• You need to use two dashes (--key) for the arguments
• You need to use uppercase names for env variables (KEY=)

[alx696]

docker run -d --restart=always \
  -p 10000:9090 \
  -v /etc/letsencrypt/live/dev.lilu.red/fullchain.pem:/tls/server.cer \
  -v /etc/letsencrypt/live/dev.lilu.red/privkey.pem:/tls/server.key \
  --name "ipfs-ws" libp2p/websocket-star-rendezvous:release \
  --cert "/tls/server.cer" \
  --key "/tls/server.key"

Try this command. I've changed the options slightly.

Not work:

WebSocket connection to 'wss://dev.lilu.red:10000/socket.io/?EIO=3&transport=websocket' failed: Error in connection establishment: net::ERR_CONNECTION_CLOSED

Have you change the docker image? I do not see any update of image.

[tudor-pop]

Hey I have gone the Dockerfile + docker-compose for readability but I could still not make it work

FROM libp2p/websocket-star-rendezvous:release

COPY cert1.pem ./cert.pem
COPY privkey1.pem ./key.pem

ENV CERT ./cert.pem
ENV KEY ./key.pem

rendezvous:
    image: [own_registry]/[project]/rendezvous
    build: rendezvous
    container_name: rendezvous
    ports:
      - 9090:9090
    networks:
      - some_network

error on nginx

connect() failed (111: Connection refused) while connecting to upstream, client: 188.24.19.167, server: localhost, request: "GET /socket.io/?EIO=3&transport=websocket HTTP/1.1", upstream: "http://containerIP:**80**/socket.io/?EIO=3&transp ort=websocket", host: "somehost.com"

[tudor-pop]

So just after writing the comment I managed to do it and the problem was with the wrong port inside nginx config. Here is the nginx config, almost the default one.

upstream rendezvous {
# domain must match the service name from docker-compose.yml
 server rendezvous:9090;
}
server {
 server_name localhost your_domain.com www.your_domain.com;
 location /socket.io {
    proxy_pass http://rendezvous;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
  }
 listen [::]:443 ssl http2 ipv6only=on; # managed by Certbot
  listen 443 ssl http2; # managed by Certbot
  ssl_certificate /etc/letsencrypt/live/your_domain.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/your_domain.com/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
  if ($host = www.your_domain.com) {
    return 301 https://$host$request_uri;
  } # managed by Certbot

  if ($host = your_domain.com) {
    return 301 https://$host$request_uri;
  } # managed by Certbot

  listen 80;
  listen [::]:80;

  server_name your_domain.com www.your_domain.com;
  return 404; # managed by Certbot
}

then from JS:

ipfs = await IPFS.create({
    config: {
              Addresses: {
         Swarm: ['/dns4/your_domain.com/tcp/443/wss/p2p-websocket-star']
        }
    }
});

Also my nginx and the rendezvous container are on the same docker network. You can't use 0.0.0.0:9090 in nginx config because that is the nginx container and nobody is listening there, so you must use rendezvous:9090 or alike. I start to regret nginx in docker, it makes everything complicated :)) but this is just nginx.

I will create a PR to update the docs a bit since the env variables I had to look them up in the code to know exactly how to use them and overall the setup took about 2 hours. Also I would love to reduce the image size, but I'm not sure what dumb-init is and if we can use node-10-alpine instead