TCCE

Traefik Consul Certificate Exporter

This piece of code exports Let's Encrypt certificates generated by traefik and gives access to them in an easy way.

Installation

Add this line to your application's Gemfile:

gem 'tcce'

And then execute:

$ bundle

Or install it yourself as:

$ gem install tcce

Usage

You will need a Consul ACL Token with read permission on the object set by traefik:

key "traefik/acme/account/object" { policy = "read" }

The key can be found in your traefik.toml under [acme] => storage.

For a complete list of methods see the files under test/.

Connect and export Consul object

To retrieve the contents of the consul kv-object, execute the following code:

consul = TCCE::Consul.new url, acl_token, kv_path
acme_json = consul.get
# => "{"Email":"ralf@rherzog.de","Registration":{"body":{"status":"valid","contact":["mailto:ralf@rherzog.de"]},"uri":"https://acme-v02.api.letsencrypt.org/acme/acct/15648645"},"PrivateKey":"MII..."}"

This will decompress the stored object. For example:

consul = TCCE::Consul.new 'http://localhost:8300', 'xxxxxxxx-yyyy-zzzz-1111-222222222222', 'traefik/acme/account'
acme_json = consul.get

Parse the json

To parse the decompressed json to nice objects, run this:

file = TCCE::File.parse acme_json

Extract the certificates

You can access your certificates either by

certificates = file.certificates
# => [TCCE::Certificate, ...]

or pass it with a block

file.certificates do |cert|
  cert
  # => TCCE::Certificate

  cert.domain
  # => 'rherzog.de'
  
  cert.sans
  # => ['www.rherzog.de', 'test.rherzog.de', ...]
  
  cert.certificate
  # => OpenSSL::X509::Certificate
  
  cert.private_key
  # => OpenSSL::PKey::RSA
end

Development

After checking out the repo, run bin/setup to install dependencies. Set the environment variables with working values:

CONSUL_URL=http://localhost:8300
CONSUL_TOKEN=xxxxxxxx-yyyy-zzzz-1111-222222222222
CONSUL_KV_PATH=traefik/acme/account
CONSUL_CA_PATH=ca.crt # optional

Then, run rake test to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install.

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/RalfHerzog/tcce. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

License

The gem is available as open source under the terms of the MIT License.

Code of Conduct

Everyone interacting in the TCCE project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.