mirror of
https://github.com/amidaware/tacticalrmm.git
synced 2026-04-26 06:55:52 +03:00
[GH-ISSUE #753] Docker solution to mount certs folder or files, rather than import via env file #2424
Labels
No labels
In Process
bug
bug
dev-triage
documentation
duplicate
enhancement
fixed
good first issue
help wanted
integration
invalid
pull-request
question
requires agent update
security
ui tweak
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/tacticalrmm#2424
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ninjamonkey198206 on GitHub (Oct 9, 2021).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/753
I think it would be extremely useful to be able to simply mount a folder containing cert/key to use that's located on the host.
Example configs:
Let'sEncrypt ACME on PFSense that automatically renews, with rsync cron job that copies the certs to the host server.
Let'sEncrypt on host server.
The one thing I haven't figured out is how to automatically reload the necessary services when the cert/key changes, but since that has to be done manually anyway with the current docker setup, I don't see that as much of an issue at the moment.
@dinger1986 commented on GitHub (Oct 9, 2021):
Would need to be able to create a share and map it, thats a lot more work than just copying the cert across.
Are you all working now?
@ninjamonkey198206 commented on GitHub (Oct 9, 2021):
Haven't gotten to the other issue yet.
I thought I input this one specifically as a feature request.
I should've stayed in bed today.
@dinger1986 commented on GitHub (Oct 9, 2021):
Didn't even realise it was a separate issue. I'll leave it up to the devs but I think it's more work than doing it the existing way
@ninjamonkey198206 commented on GitHub (Oct 10, 2021):
It could be up front, but it would be really great for setting up an automated system. Configure it once and done. The only thing that might mess that up is whether or not the mesh agent that you upload initially during configuration actually contains any part of the cert or not.
In my specific setup, for instance, I've got PFSense with ACME configured for automatic renewal of the Let'sEncrypt cert. I could edit the cron job for the cert renewal to trigger copying the required files to the host system, triggering another script to restart the necessary containers or services within them.
It would eliminate that particular maintenance headache.
Just an idea. I'm always trying to figure out how eliminate potential hassles.
@dinger1986 commented on GitHub (Oct 10, 2021):
Could you not have your cron job connect to the rmm server and copy the files over ssh to the relevant folder?
@ninjamonkey198206 commented on GitHub (Oct 10, 2021):
...
I had not thought of that.
It's certainly possible.
I'll have to find which containers need them, and where the certs are stored inside them, but it should be possible.
@silversword411 commented on GitHub (Oct 11, 2021):
Seems like an unnecessary security issue when you have SSH, closing. Post if further info
@sadnub commented on GitHub (Oct 11, 2021):
You can
docker cpthe files to/opt/tactical/certsto bypass needing to put them in the .env file.You can use the trmm-backend container to do it
@ninjamonkey198206 commented on GitHub (Oct 11, 2021):
@sadnub Thank you! I was just about to ask about that!
@ninjamonkey198206 commented on GitHub (Oct 11, 2021):
@sadnub I figured out how to proxy all ports on HAProxy as well, and I was thinking about creating a walkthrough to configure a fully automated renewal setup.
Do the client agents need to be updated if the certs are renewed/changed?
@silversword411 commented on GitHub (Oct 11, 2021):
Shouldn't need to do cert stuff on the agents...that would be a nightmare ;)
@ninjamonkey198206 commented on GitHub (Oct 11, 2021):
Awesome.
And thank you all for being patient with me.
I'm new to using Docker (I've resisted taking the plunge until now) and just found Tactical a week or so ago, so it's been like Xmas. New shinies to tinker with and test out.