CODEWITHSUNDEEP
dockerssltraefik
rroblik
rroblik

Reputation: 41

Traefik and https private repository - tls error

I'm trying to deploy a private repository on my docker swarm. I'm following the official docker repository guide to deploy it as a service. I want to be able to use it with https, from outside with a simple url as https://myregistry.mysite.com.

To do so I use following traefik labels in my stack yml file :

traefik.backend: "privateregistry"
traefik.docker.network: "webgateway" # docker overlay external
traefik.enable: "true"
traefik.frontend.entryPoint: "https"
traefik.frontend.redirect.entryPoint: "https"
traefik.frontend.rule: "Host:myregistry.mysite.com"
traefik.port: "5000"

I'm seeing my two frontend/backend in traefik UI but when I access to https://myregistry.mysite.com/v2/ (for example) I've a 500 fatal error. The service log output is http: TLS handshake error from 10.0.0.68:47796: tls: first record does not look like a TLS handshake

I think I misunderstood something, certs side probably.

Any idea to do that without error ?

Thanks

Upvotes: 3

Views: 1285

Answers (1)

maiermic
maiermic

Reputation: 4984

I suppose you are missing the certificate of the (registry-) server on your client machine. I assume you have two certificate files (used on the server):

  • myregistry.mysite.com.crt
  • myregistry.mysite.com.key

Copy myregistry.mysite.com.crt on your client machine to /etc/docker/certs.d/myregistry.mysite.com/ca.crt on Linux or ~/.docker/certs.d/myregistry.mysite.com/ca.crt on Mac. Now you should be able to login from the client:

docker login myregistry.mysite.com

Appendix - Server Setup

Your server setup might look like this:

~/certs/myregistry.mysite.com.crt
~/certs/myregistry.mysite.com.key
~/docker-compose.yml
~/traefik.toml

docker-compose.yml

version: '3'

services:
  frontproxy:
    image: traefik
    command: --api --docker --docker.swarmmode
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./certs:/etc/ssl:ro
      - ./traefik.toml:/etc/traefik/traefik.toml:ro
      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
  docker-registry:
    image: registry:2
    deploy:
      labels:
        - traefik.port=5000 # default port exposed by the registry
        - traefik.frontend.rule=Host:myregistry.mysite.com

traefik.toml

defaultEntryPoints = ["http", "https"]

# Redirect HTTP to HTTPS and use certificate, see https://docs.traefik.io/configuration/entrypoints/
[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/etc/ssl/myregistry.mysite.com.crt"
      keyFile = "/etc/ssl/myregistry.mysite.com.key"

# Docker Swarm Mode Provider, see https://docs.traefik.io/configuration/backends/docker/#docker-swarm-mode
[docker]
endpoint = "tcp://127.0.0.1:2375"
domain = "docker.localhost"
watch = true
swarmMode = true

To deploy your registry run:

docker stack deploy myregistry -c ~/docker-compose.yml

Upvotes: 2

Related Questions