Traefik support for custom certs and Traefik dashboard availability

[ijonjic11]

As some of supercheck installation will probably be done and used specifically in private netoworks, which means that LetsEncrypt DNS challenge is not possible, custom certs usage options will be needed in order to make production-ready installation.

Can you take a look at this a see if something like this is possible to implement?

It would be cool that user can choose which type of certs they want to use: Lets'encrypt (ACME) or Custom certs(probabaly TLS).

Not sure how status page need to be handled if custom certs are used,but it would be cool to use the same method for status pages too.

Also,I saw that Traefik dashboard are pretty cool to have from time to time to check if everything works as expected so maybe it would be also cool to be able to enable it from .env file when you need it and then disable it later(or have enabled all the time but protected with htpasswd or something similar).

Sorry if it feels like I have too much ideas and propositions, I'm using supercheck in highly restricted environment so some of this feature request are needed.

Thank you and no rush with this,take as much time as you need.

[krish-kant]

@ijonjic11, Thanks for the detailed feature request! happy to confirm that both custom TLS certificates and optional Traefik dashboard support are fully implementable for self-hosted Docker Compose deployments. This is purely an infrastructure change — no application code modifications needed.

Please update docker compose file to achieve this, let me know if you need any help.

[ijonjic11]

You're welcome :).

Can you explain me where to put my custom certs in order to Traefik use them instead trying ACME method? And do I need to make any changes in docker-compose file in order to make this work?

Regarding Traefik dashboard, I set TRAEFIK_API_DASHBOARD to "true" but i cannot access dashboard. On what address traefik expose it's dahsboard?

Thank you.

[ijonjic11]

Hello, so I managed to setup dashboard:

docker-compose-secure.yml --> traefik service:

services:
  # Traefik Reverse Proxy with HTTPS
  traefik:
    image: traefik:v3.6.6
    environment:
      # Traefik Configuration using environment variables
      - TRAEFIK_API_DASHBOARD=true                     # Changed from "false" to "true"
      - TRAEFIK_PROVIDERS_DOCKER=true
      - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
      - TRAEFIK_ENTRYPOINTS_WEB_ADDRESS=:80
      - TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS=:443
      # Let's Encrypt ACME configuration for automatic SSL certificates
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE=true
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT=web
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL:-admin@example.com}
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE=/letsencrypt/acme.json
      - TRAEFIK_LOG_LEVEL=INFO
      - TRAEFIK_ACCESSLOG=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"                 # Changed from "false" to "true"

       #ADDED routers to expose dashboard on https://traefik.supercheck.mydomain.com/dashboard/

      - "traefik.http.routers.dashboard.rule=Host(`traefik.${APP_DOMAIN:-demo.supercheck.dev}`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.priority=200"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=${TRAEFIK_DASHBOARD_AUTH}"
      # Redirect /dashboard to /dashboard/  middleware
      - "traefik.http.middlewares.dashboard-slash.redirectregex.regex=^https://([^/]+)/dashboard$$"
      - "traefik.http.middlewares.dashboard-slash.redirectregex.replacement=https://$${1}/dashboard/"
      - "traefik.http.middlewares.dashboard-slash.redirectregex.permanent=true"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth,dashboard-slash"

How to generate user and password to access dashboard:

   docker run --rm httpd:alpine htpasswd -nb admin test | sed 's/\$/\$\$/g'
   output: admin:$$apr1$$WMZkiMIV$$hIL2soWTH8b0/cTq/jPC9/

Edit .env file:

TRAEFIK_DASHBOARD_AUTH=admin:$$apr1$$WMZkiMIV$$hIL2soWTH8b0/cTq/jPC9/

Finally:

docker compose -f docker-compose-secure.yml up -d

[krish-kant]

@ijonjic11 Please try these steps for custom certificates setup.

The current docker-compose-secure.yml uses Let's Encrypt ACME (HTTP-01 challenge), which requires public internet access. For private networks, you can switch to custom certificates with these steps:

Step 1: Create a certs directory

mkdir -p deploy/docker/certs

Step 2: Place your certificate files

# Full chain certificate (server cert + intermediates) in PEM format
cp /path/to/your/cert.pem deploy/docker/certs/cert.pem

# Private key (unencrypted, no passphrase) in PEM format
cp /path/to/your/key.pem deploy/docker/certs/key.pem

# Lock down the private key
chmod 600 deploy/docker/certs/key.pem

Step 3: Create a Traefik dynamic config file

Create deploy/docker/traefik/dynamic.yml:

tls:
  certificates:
    - certFile: /certs/cert.pem
      keyFile: /certs/key.pem

Step 4: Modify the traefik service in docker-compose-secure.yml

Replace the current traefik service environment and volumes with:

  traefik:
    image: traefik:v3.6.6
    environment:
      - TRAEFIK_API_DASHBOARD=false
      - TRAEFIK_PROVIDERS_DOCKER=true
      - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
      - TRAEFIK_PROVIDERS_FILE_FILENAME=/etc/traefik/dynamic.yml
      - TRAEFIK_ENTRYPOINTS_WEB_ADDRESS=:80
      - TRAEFIK_ENTRYPOINTS_WEBSECURE_ADDRESS=:443
      - TRAEFIK_LOG_LEVEL=INFO
      - TRAEFIK_ACCESSLOG=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
      - ./certs/cert.pem:/certs/cert.pem:ro
      - ./certs/key.pem:/certs/key.pem:ro
    labels:
      - "traefik.enable=false"
    networks:
      - supercheck-network
    restart: unless-stopped

Key differences from the ACME version:

• Removed all TRAEFIK_CERTIFICATESRESOLVERS_* env vars (no ACME)
• Added TRAEFIK_PROVIDERS_FILE_FILENAME to load the dynamic config
• Added volume mounts for the dynamic config and cert files (read-only)
• Removed the traefik-letsencrypt volume (not needed)

Step 5: Update the app service labels

Remove tls.certresolver=letsencrypt from the router labels and replace with plain tls=true. In the app service labels, change:

      # Main app
      - "traefik.http.routers.app.rule=Host(`${APP_DOMAIN:-demo.supercheck.dev}`)"
      - "traefik.http.routers.app.priority=100"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls=true"
      - "traefik.http.routers.app.service=app"

      # Status pages
      - "traefik.http.routers.status-pages.rule=HostRegexp(`[a-zA-Z0-9-]+\\.${STATUS_PAGE_DOMAIN:-supercheck.dev}`)"
      - "traefik.http.routers.status-pages.priority=50"
      - "traefik.http.routers.status-pages.entrypoints=websecure"
      - "traefik.http.routers.status-pages.tls=true"
      - "traefik.http.routers.status-pages.service=app"

The only change is replacing tls.certresolver=letsencrypt → tls=true on both routers. Everything else (HTTP→HTTPS redirect, loadbalancer config) stays the same.

Step 6: Remove the traefik-letsencrypt volume

In the volumes: section at the bottom of the file, remove:

  traefik-letsencrypt:
    driver: local

Status Pages

For status pages to work without browser certificate warnings, use a wildcard certificate that covers *.yourdomain.com. This covers both app.yourdomain.com and all status page subdomains like uuid.yourdomain.com.

[ijonjic11]

Thank you for the detailed explanation, everything works fine.

Before securing the app, I was not able to create user through Super Admin interface (Super Admin --> Create user (on the right side) because HTTPS was insecure, but now when HTTPS is secured via TLS, I tried to create user again and I get message in the bottom right corner: User created succesfully (green message). But there is no user on the list,I checked database table and there is no user in the "user" table too. postgres container logs are clean. I cannot trace the error in any way,I've mange to find only "error-like" logs on inspect element, tracing the events in network tab:

Not sure if this feature is still in development phase,but I'm pretty sure that there need to be "Organisation member" field when creating new user. Maybe that is the root of the problem,because when you try to create user,app expect Organization for that user(mandatory) but there is no Organization selected.

It's a minor bug I think,just an observation from my side :).

[krish-kant]

@ijonjic11 Please check this bug, this feature will be removed as its duplicate.

#245

[ijonjic11]

Yeah, I saw it just now. Thank you for the info. I also think this feature can be useful in some situations, at this time,maybe not, but it would be good (in the future) that super admin is actually "super" user that can do stuff that other users cannot.

Example

Super admin should:
-by default- be able to manage every part of orgs and projects
-be able to manage users over entire app (all orgs and projects) - create user,delete user,change permission over orgs and projects,ban user(already there),assign specific user as org owner
-manage organizations (create them,delete them etc.) - this actually need to be only place in the app where can you create organizations. Organization creation (and later managing) should be decision of superadmin. At this moment, when you click on sign-up (at login page) you actually create your own organisation(new tenant) without anyone asking.

So, for example,if 20 users sign-up manually,we have 20 new organizations,but maybe all of them just wanted to be a member of existing organization.

So, maybe think of the stuff above for the future - building access controll and managing features around super admin user.

Just thinking out loud :), this need to be planned in detail.

P.S. One of good example of access to orgs and dashboards is Grafana. It has everything you need to sucessfully manage platform from one place.

[krish-kant]

@ijonjic11 Thanks for these suggestions, Super User can currently impersonate the Org Admin and can do all above things :)

The Org creation on signup is the design decision but what I can do is mention this on UI during Sign up process to make it clear to End user. Also, I'll add ability to change Organisation name as currently its based on user's name.

I'll have a look at Grafana dashboard soon.