Symptoms

How to install your own SSL certificates instead of Let's Encrypt?

Solution

Prepare certificate files

To install your own certificates, you need to obtain a certificate bundle with keys from an authorized SSL certificate provider.

Typically, the bundle contains several files:

yourdomain.tld.crt - certificate for your address

yourdomain.tld.key - key that was used to generate the certificate

Copy the files yourdomain.tld.crt and yourdomain.tld.key to the certs folder.

Certificate installation

1. Edit the file /root/swarmica/traefik.yml to look like this (replacing yourdomain.tld.* with your file names):

   tls:
     certificates:
       - certFile: "/etc/traefik/certs/yourdomain.tld.crt"
         keyFile: "/etc/traefik/certs/yourdomain.tld.key"
         stores:
           - default
     stores:
       default:
         defaultCertificate:
           certFile: "/etc/traefik/certs/yourdomain.tld.crt"
           keyFile: "/etc/traefik/certs/yourdomain.tld.key"
     options:
       default:
         minVersion: VersionTLS12
         cipherSuites:
          # Recommended ciphers for TLSv1.2
          - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
          - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
          - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
          # Recommended ciphers for TLSv1.3
          - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
          - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
          - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
       tlsv13only:
         minVersion: VersionTLS13
   

2. Create a backup copy of the file /root/swarmica/docker-compose.yml:

   cp /root/swarmica/docker-compose.yml{,.backup}
   

3. Edit the file /root/swarmica/docker-compose.yml for the traefik service:

     traefik:
       image: traefik:latest
       restart: always
       depends_on:
         - django
       volumes:
         - ./certs:/etc/traefik/certs:ro
         - ./traefik.yml:/etc/traefik/dynamic.yml:ro
         - traefik_data:/letsencrypt:z
         - /var/run/docker.sock:/var/run/docker.sock:ro
       command:
         - "--providers.docker=true"
         - "--providers.docker.exposedbydefault=false"
         - "--providers.file=true"
         - "--providers.file.filename=/etc/traefik/dynamic.yml"
         - "--log.level=INFO"
         - "--entrypoints.web.address=:80"
         - "--entrypoints.web.http.redirections.entrypoint.to=web-secure"
         - "--entrypoints.web-secure.address=:443"
         - "--api.dashboard=false"
       ports:
         - "0.0.0.0:80:80"
         - "0.0.0.0:443:443"
   

4. Replace the lines in /root/swarmica/docker-compose.yml where tls.certresolver=letsencrypt is present so that they end with tls.options=default
5. Restart Swarmica:

   docker compose down
   docker compose up -d