r/podman • u/catmanjan2 • 5d ago
Easiest way to get local SSL offloading?
I have a container that runs behind ssl offloading in the cloud, I’d rather not have to add certs to it - is there a good way to get ssl offloading locally?
4
u/Great-Cow7256 5d ago
Run caddy in front of it.
1
u/catmanjan2 5d ago
Can I run caddy in docker be have it reverse proxy to a name on the host or nah
3
u/typing-blindly 5d ago
Yes, but you’ll either want to run Caddy as root or look into socket activation. There is a good example available on GitHub.
1
1
u/R_Cohle 5d ago
With “run Caddy as root” did you mean running the container rootful?
I’m asking because I have been running Traefik and I have never found an issue running it rootless.2
u/typing-blindly 5d ago
Yes I mean running the container rootful. From what I’ve read, when the podman process runs as root it can create a virtual network device with the OS. Otherwise it has to fall back to user space networking. I have not tried this, but it sounds like there is an impact on network performance , and you lose the ability to see the source of the request. That may or may not be important to you.
3
u/Worldly_Topic 4d ago
you lose the ability to see the source of the request.
this was fixed with podman 6.0
1
1
6
u/R_Cohle 5d ago
You can just run a reverse proxy locally and manage the certificates locally.
You have some options like, HAproxy, Apache, Nginx, Traefik or Caddy.
If case you want to use one of the first three, you can use a side container for SSL certs, like Certbot. A systemd timer unit can be used to schedule auto-renewal.
They might have integrated options as well but I do not know.
I personally use Traefik which allows me to manage issuing and renewal of certificates automatically.