Traefik support for custom certs and Traefik dashboard availability #244

You're welcome :).

Can you explain me where to put my custom certs in order to Traefik use them instead trying ACME method? And do I need to make any changes in docker-compose file in order to make this work?

Regarding Traefik dashboard, I set TRAEFIK_API_DASHBOARD to "true" but i cannot access dashboard. On what address traefik expose it's dahsboard?

Thank you.

Hello, so I managed to setup dashboard:

docker-compose-secure.yml --> traefik service:

services:
 # Traefik Reverse Proxy with HTTPS
 traefik:
 image: traefik:v3.6.6
 environment:
 # Traefik Configuration using environment variables
 - TRAEFIK_API_DASHBOARD=true # Changed from "false" to "true"
 - TRAEFIK_PROVIDERS_DOCKER=true
 - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
 - TRAEFIK_ENTRYPOINTS_WEB_ADDRESS=:80
 - TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS=:443
 # Let's Encrypt ACME configuration for automatic SSL certificates
 - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE=true
 - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT=web
 - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL:-admin@example.com}
 - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE=/letsencrypt/acme.json
 - TRAEFIK_LOG_LEVEL=INFO
 - TRAEFIK_ACCESSLOG=true
 ports:
 - "80:80"
 - "443:443"
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock:ro
 - traefik-letsencrypt:/letsencrypt
 labels:
 - "traefik.enable=true" # Changed from "false" to "true"
 #ADDED routers to expose dashboard on https://traefik.supercheck.mydomain.com/dashboard/
 - "traefik.http.routers.dashboard.rule=Host(`traefik.${APP_DOMAIN:-demo.supercheck.dev}`)"
 - "traefik.http.routers.dashboard.entrypoints=websecure"
 - "traefik.http.routers.dashboard.service=api@internal"
 - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
 - "traefik.http.routers.dashboard.priority=200"
 - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
 - "traefik.http.middlewares.dashboard-auth.basicauth.users=${TRAEFIK_DASHBOARD_AUTH}"
 # Redirect /dashboard to /dashboard/ middleware
 - "traefik.http.middlewares.dashboard-slash.redirectregex.regex=^https://([^/]+)/dashboard$$"
 - "traefik.http.middlewares.dashboard-slash.redirectregex.replacement=https://$${1}/dashboard/"
 - "traefik.http.middlewares.dashboard-slash.redirectregex.permanent=true"
 - "traefik.http.routers.dashboard.middlewares=dashboard-auth,dashboard-slash"

How to generate user and password to access dashboard:

 docker run --rm httpd:alpine htpasswd -nb admin test | sed 's/\$/\$\$/g'
 output: admin:$$apr1$$WMZkiMIV$$hIL2soWTH8b0/cTq/jPC9/

Edit .env file:

TRAEFIK_DASHBOARD_AUTH=admin:$$apr1$$WMZkiMIV$$hIL2soWTH8b0/cTq/jPC9/

Finally:

docker compose -f docker-compose-secure.yml up -d

Thank you for the detailed explanation, everything works fine.

Before securing the app, I was not able to create user through Super Admin interface (Super Admin --> Create user (on the right side) because HTTPS was insecure, but now when HTTPS is secured via TLS, I tried to create user again and I get message in the bottom right corner: User created succesfully (green message). But there is no user on the list,I checked database table and there is no user in the "user" table too. postgres container logs are clean. I cannot trace the error in any way,I've mange to find only "error-like" logs on inspect element, tracing the events in network tab:

Not sure if this feature is still in development phase,but I'm pretty sure that there need to be "Organisation member" field when creating new user. Maybe that is the root of the problem,because when you try to create user,app expect Organization for that user(mandatory) but there is no Organization selected.

It's a minor bug I think,just an observation from my side :).

@ijonjic11 Please check this bug, this feature will be removed as its duplicate.

#245

Yeah, I saw it just now. Thank you for the info. I also think this feature can be useful in some situations, at this time,maybe not, but it would be good (in the future) that super admin is actually "super" user that can do stuff that other users cannot.

Example

Super admin should:
-by default- be able to manage every part of orgs and projects
-be able to manage users over entire app (all orgs and projects) - create user,delete user,change permission over orgs and projects,ban user(already there),assign specific user as org owner
-manage organizations (create them,delete them etc.) - this actually need to be only place in the app where can you create organizations. Organization creation (and later managing) should be decision of superadmin. At this moment, when you click on sign-up (at login page) you actually create your own organisation(new tenant) without anyone asking.

So, for example,if 20 users sign-up manually,we have 20 new organizations,but maybe all of them just wanted to be a member of existing organization.

So, maybe think of the stuff above for the future - building access controll and managing features around super admin user.

Just thinking out loud :), this need to be planned in detail.

P.S. One of good example of access to orgs and dashboards is Grafana. It has everything you need to sucessfully manage platform from one place.

@ijonjic11 Thanks for these suggestions, Super User can currently impersonate the Org Admin and can do all above things :)

The Org creation on signup is the design decision but what I can do is mention this on UI during Sign up process to make it clear to End user. Also, I'll add ability to change Organisation name as currently its based on user's name.

I'll have a look at Grafana dashboard soon.