# How to install your own SSL/TLS certificates for the Swarmica web interface?
# Symptoms

How to install your own SSL certificates instead of Let's Encrypt?

# Solution

### Prepare certificate files

To install your own certificates, you need to obtain a certificate bundle with keys from an authorized SSL certificate provider.

Typically, the bundle contains several files:

`yourdomain.tld.crt` - certificate for your address

`yourdomain.tld.key` - key that was used to generate the certificate

Copy the files `yourdomain.tld.crt` and `yourdomain.tld.key` to the `certs` folder.

### Certificate installation

1. Edit the file /root/swarmica/traefik.yml to look like this (replacing yourdomain.tld.* with your file names):
    ```txt
    tls:
      certificates:
        - certFile: "/etc/traefik/certs/yourdomain.tld.crt"
          keyFile: "/etc/traefik/certs/yourdomain.tld.key"
          stores:
            - default
      stores:
        default:
          defaultCertificate:
            certFile: "/etc/traefik/certs/yourdomain.tld.crt"
            keyFile: "/etc/traefik/certs/yourdomain.tld.key"
      options:
        default:
          minVersion: VersionTLS12
          cipherSuites:
           # Recommended ciphers for TLSv1.2
           - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
           - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
           - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
           # Recommended ciphers for TLSv1.3
           - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
           - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
           - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        tlsv13only:
          minVersion: VersionTLS13
    ```
2. Create a backup copy of the file /root/swarmica/docker-compose.yml:
    ```bash
    cp /root/swarmica/docker-compose.yml{,.backup}
    ```
3. Edit the file /root/swarmica/docker-compose.yml for the `traefik` service:
    ```txt
      traefik:
        image: traefik:latest
        restart: always
        depends_on:
          - django
        volumes:
          - ./certs:/etc/traefik/certs:ro
          - ./traefik.yml:/etc/traefik/dynamic.yml:ro
          - traefik_data:/letsencrypt:z
          - /var/run/docker.sock:/var/run/docker.sock:ro
        command:
          - "--providers.docker=true"
          - "--providers.docker.exposedbydefault=false"
          - "--providers.file=true"
          - "--providers.file.filename=/etc/traefik/dynamic.yml"
          - "--log.level=INFO"
          - "--entrypoints.web.address=:80"
          - "--entrypoints.web.http.redirections.entrypoint.to=web-secure"
          - "--entrypoints.web-secure.address=:443"
          - "--api.dashboard=false"
        ports:
          - "0.0.0.0:80:80"
          - "0.0.0.0:443:443"
    ```
4. Replace the lines in /root/swarmica/docker-compose.yml where `tls.certresolver=letsencrypt` is present so that they end with `tls.options=default`
5. Restart Swarmica:
    ```bash
    docker compose down
    docker compose up -d
    ```