Improve security and reliability of traefik-certdumper #54

New Issue

3wordchant · 2021-03-25T09:46:21Z

3wordchant commented

2021-03-25 09:46:21 +00:00

Several services (CoTURN and Mailu so far, although I'm sure I remember others) want access to the Traefik-generated SSL certificates so that they can encrypt & decrypt traffic themselves.

The usual way to do this in Docker-land is a container which loads Traefik's certificate store, and dumps specified certificates in PEM format.

It seems like the existing forest of certdumper images all have wrinkles: for Mailu, I ended up adding a gnarly custom entrypoint to override behaviour, plus a separate post-run script in the Mailu recipe.

As well as being a lot (too much?) to add to each recipe, the security of this is pretty lol because a) certdumper dumps all certs on the swarm by default and b) it fails open -- I noticed the certdumper in workadventure is giving the workadventure-front container access to all certs 🙈

Improvements welcome!

Several services (CoTURN and Mailu so far, although I'm sure I remember others) want access to the Traefik-generated SSL certificates so that they can encrypt & decrypt traffic themselves. The usual way to do this in Docker-land is a container which loads Traefik's certificate store, and dumps specified certificates in PEM format. It seems like the existing forest of `certdumper` images all have wrinkles: for Mailu, I ended up adding [a gnarly custom `entrypoint` to override behaviour](https://git.autonomic.zone/coop-cloud/mailu/src/branch/main/compose.yml#L155-L176), plus [a separate post-run script in the Mailu recipe](https://git.autonomic.zone/coop-cloud/mailu/src/branch/main/certdumper_post.sh). As well as being a lot (too much?) to add to each recipe, the security of this is pretty lol because a) `certdumper` dumps _all_ certs on the swarm by default and b) it fails open -- I noticed the `certdumper` in `workadventure` is giving the `workadventure-front` container access to _all_ certs 🙈 Improvements welcome!

3wordchant added the

bug

enhancement

help wanted

labels 2021-03-25 09:46:21 +00:00

decentral1se added this to the (deleted) project 2021-04-30 07:32:25 +00:00

This repo is archived. You cannot comment on issues.