LetsEncrypt SSL certificate
How to use a LetsEncrypt SSL certificate with local coder deployment?
15 Replies
not possible except if you have a domain that's accessible from the outside
and that would be in caddy (for the record: atif uses Caddy)
Just checking, are you using Coder OSS or v1?
Coder OSS
I configured a LetsEncrypt certificate with Cockpit that is also a local deployment.
https://github.com/cockpit-project/cockpit/wiki/Cockpit-with-LetsEncrypt
GitHub
Cockpit with LetsEncrypt · cockpit-project/cockpit Wiki
Cockpit is a web-based graphical interface for servers. - Cockpit with LetsEncrypt · cockpit-project/cockpit Wiki
Why something similar not possible with Coder?
I can access cockpit dashboard now from all of devices without requiring to install any certificate in system or browser.
If you're using
certbot to get the certificates, I don't see why the coder server TLS flags (--tls-*) wouldn't work? I haven't tried setting up TLS myself though, so there could be a LetsEncrypt incompatibility I don't know about.
Something like: coder server --tls-enable --tls-cert-file /etc/letsencrypt/live/$DOMAIN/fullchain.pem --tls-key-file /etc/letsencrypt/live/$DOMAIN/privkey.pem ?To get an SSL cert and use https I am using an nginx reverse proxy
I am running coder as a service and not using
coder server commandYou can use the environment variables instead, see
coder server --help
If i do this the coder service fails to start with following error.
I think it is because of permission. What permission should I set ? Current permission are,
What user are you running Coder as? You would ideally try to figure out how to give the Coder user permission to those files, without exposing them to risk of being inspected by other users on the system (for security).
For instance you could create a
cert group on your system (if there isn't one), grant the coder user that group, and then make sure all files have the group (chgrp -R cert /path/to/certs) and make them group readable (chmod -R g+r /path/to/certs).
If you don't care about security and just want to yolo get it to work. chmod -R 0777 /etc/letsencrypt.Thanks. It worked. 🙂
I disabled caddy and gave path of certificate and key in
/etc/coder.d/coder.env
but changing the permissions is a work around. A CLI flag or ENV variable in config that allows using the certificates from certbot automatically,I wouldn't say it's a work-around. It's just a simple fact that coder needs permissions to read the certificates, it's the users responsibility to make sure that is the case (either by running coder as root, as a user with cert permissions, or changing cert permissions). There's nothing we can improve in that with a CLI/env flag.
But supporting LetsEncrypt one way or another inside coder server is something we may or may not consider in the future. It should be relatively easy e.g. via the
autocert package: https://pkg.go.dev/golang.org/x/crypto/acme/autocert. Perhaps documentation improvements on how to use certbot together with coder server could be considered as well.
If there's no open issue about this on the GitHub tracker, feel free to file one.@Atif if you make an issue could you send it in this channel for reference ?
yes I will link that issue here. I have not created 1 yet