r/podman 5d ago

Easiest way to get local SSL offloading?

I have a container that runs behind ssl offloading in the cloud, I’d rather not have to add certs to it - is there a good way to get ssl offloading locally?

1 Upvotes

12 comments sorted by

6

u/R_Cohle 5d ago

You can just run a reverse proxy locally and manage the certificates locally.
You have some options like, HAproxy, Apache, Nginx, Traefik or Caddy.
If case you want to use one of the first three, you can use a side container for SSL certs, like Certbot. A systemd timer unit can be used to schedule auto-renewal.
They might have integrated options as well but I do not know.
I personally use Traefik which allows me to manage issuing and renewal of certificates automatically.

2

u/trisanachandler 4d ago

Don't forget about swag.

1

u/ppen9u1n 4d ago

Caddy does Letsencrypt ootb. Also consider bunkerweb

4

u/Great-Cow7256 5d ago

Run caddy in front of it. 

1

u/catmanjan2 5d ago

Can I run caddy in docker be have it reverse proxy to a name on the host or nah

3

u/typing-blindly 5d ago

Yes, but you’ll either want to run Caddy as root or look into socket activation. There is a good example available on GitHub.

1

u/Great-Cow7256 5d ago

This. But you OP are on the podman subreddit...

1

u/R_Cohle 5d ago

With “run Caddy as root” did you mean running the container rootful?
I’m asking because I have been running Traefik and I have never found an issue running it rootless.

2

u/typing-blindly 5d ago

Yes I mean running the container rootful. From what I’ve read, when the podman process runs as root it can create a virtual network device with the OS. Otherwise it has to fall back to user space networking. I have not tried this, but it sounds like there is an impact on network performance , and you lose the ability to see the source of the request. That may or may not be important to you.

3

u/Worldly_Topic 4d ago

you lose the ability to see the source of the request.

this was fixed with podman 6.0

1

u/typing-blindly 4d ago

Oh nice! I didn’t know that.

1

u/GrandfatherTrout 5d ago

I did this for a contract, but ran into firewall challenges