CODEWITHSUNDEEP
dockerhttpsgrafana
Stefan
Stefan

Reputation: 63

Grafana with https - Cannot find SSL cert_file

I'm running Grafana in a Docker container on my NAS. Everything is fine when using http. However I fail to start the container when I setup Grafana for https, as the Certificate file can't be found according to the Docker log.

I create a self-certificate using OpenSSL in order to use Grafana with https. I modified the docker script to overwrite the enviroment Server section for https and defined the path for the cert and key file.

  INFO[12-08|12:28:50] Config overridden from Environment variable logger=settings var="GF_SERVER_PROTOCOL=https"
  INFO[12-08|12:28:50] Config overridden from Environment variable logger=settings var="GF_SERVER_CERT_FILE=/share/CACHEDEV2_DATA/Container/grafana/config/ssl/grafana.crt"
  INFO[12-08|12:28:50] Config overridden from Environment variable logger=settings var="GF_SERVER_CERT_KEY=/share/CACHEDEV2_DATA/Container/grafana/config/ssl/grafana.key"

As far as I can see, this seems to be fine, however for unknown reason the cert-file isn't found, even it is available in the defined path.

INFO[12-08|12:28:50] HTTP Server Listen                       logger=http.server address=0.0.0.0:3000 protocol=https subUrl= socket=
EROR[12-08|12:28:50] Stopped HTTPServer                       logger=server reason="Cannot find SSL cert_file at /share/CACHEDEV2_DATA/Container/grafana/config/ssl/grafana.crt"

When I check the path I see it is valid

[/share/CACHEDEV2_DATA/Container/grafana] # ls -l /share/CACHEDEV2_DATA/Container/grafana/config/ssl/grafana.crt
-rw-r--r-- 1 admin administrators 1228 2019-12-08 10:55 /share/CACHEDEV2_DATA/Container/grafana/config/ssl/grafana.crt

Any idea what could be the reason for this? Could the Certificate be invalid and the error message is just misleading?

Many thanks for a hint :)

Stefan

Edit:

The script I use to start the Docker Container:

GRAFANA_DIR_CONF=$(readlink -f ./config)
GRAFANA_VER='latest'

 docker run -it \
        --name=grafana \
        -v $GRAFANA_DIR_CONF:/var/lib/grafana \
        -v /etc/localtime:/etc/localtime:ro \
        -e "GF_SECURITY_ALLOW_EMBEDDING=true" \
        -e "GF_USERS_ALLOW_SIGN_UP=false" \
        -e "GF_AUTH_ANONYMOUS_ENABLED=true" \
        -e "GF_AUTH_BASIC_ENABLED=false" \
        -e "GF_SERVER_PROTOCOL=https" \
        -e "GF_SERVER_CERT_FILE=$GRAFANA_DIR_CONF/ssl/grafana.crt" \
        -e "GF_SERVER_CERT_KEY=$GRAFANA_DIR_CONF/ssl/grafana.key" \
        -d \
        --restart=always \
        -p 3000:3000 \
        grafana/grafana:$GRAFANA_VER


[/share/CACHEDEV2_DATA/Container/grafana/config/ssl] # ls -l
total 16
-rw-r--r-- 1 admin administrators 1228 2019-12-08 10:55 grafana.crt
-rw-r--r-- 1 admin administrators 1702 2019-12-08 10:44 grafana.key
[/share/CACHEDEV2_DATA/Container/grafana/config/ssl] #

Upvotes: 6

Views: 15386

Answers (1)

Jan Garaj
Jan Garaj

Reputation: 28656

You are using volume for the configuration folder, so correct path to the cert/key in the container is:

        -e "GF_SERVER_CERT_FILE=/var/lib/grafana/ssl/grafana.crt" \
        -e "GF_SERVER_CERT_KEY=/var/lib/grafana/ssl/grafana.key" \

Upvotes: 5

Related Questions