https access

[avorionero]

Hi all,
can you give some suggestions to configure HTTPS access?
Thank you
Stefano

[tillsteinbach]

You have to add a reverse proxy that handles the https connection.

It could look like this:

version: '3.8'
services:
  vwsfriend:
    image: tillsteinbach/vwsfriend:${VWSFRIEND_VERSION-latest}
    ports:
     - ${VWSFRIEND_PORT-4000}:${VWSFRIEND_PORT-4000}
    networks:
      backend:
        aliases:
          - vwsfriendbackend
    volumes:
      - vwsfriend_data:/config
    environment:
      - VWSFRIEND_USERNAME=${VWSFRIEND_USERNAME-admin}
      - VWSFRIEND_PASSWORD=${VWSFRIEND_PASSWORD-secret}
      - VWSFRIEND_PORT=${VWSFRIEND_PORT-4000}
      - WECONNECT_USER
      - WECONNECT_PASSWORD
      - WECONNECT_INTERVAL
      - DATABASE_URL=postgresql://${DB_USER-admin}:${DB_PASSWORD-secret}@${DB_HOSTNAME-postgresdbbackend}:${DB_PORT-5432}/${DB_NAME-vwsfriend}
      - ADDITIONAL_PARAMETERS=--with-database --with-abrp -vv
    depends_on:
      postgresdb:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: (wget -qO- http://localhost:${VWSFRIEND_PORT-4000}/healthcheck | grep "ok" -q) || exit 1
      interval: 60s
      timeout: 10s
      retries: 3
    labels:
      # Settings for reverse proxy
      - "traefik.enable=true"
      - "traefik.port=4000"
      - "traefik.http.services.vwsfriend.loadbalancer.server.port=4000"
      - "traefik.http.middlewares.redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.vwsfriend-insecure.rule=Host(`${FQDN_TM}`)"
      - "traefik.http.routers.vwsfriend-insecure.entrypoints=web"
      - "traefik.http.routers.vwsfriend-insecure.middlewares=redirect"
      - "traefik.http.routers.vwsfriend.rule=Host(`${FQDN_TM}`)"
      - "traefik.http.routers.vwsfriend.entrypoints=websecure"
      - "traefik.http.routers.vwsfriend.tls"

  postgresdb:
    image: postgres:13
    networks:
      backend:
        aliases:
          - ${DB_HOSTNAME-postgresdbbackend}
    volumes:
      - postgresdb_data:/var/lib/postgresql/data
    user: postgres
    environment:
      - POSTGRES_USER=${DB_USER-admin}
      - POSTGRES_PASSWORD=${DB_PASSWORD-secret}
      - POSTGRES_DB=${DB_NAME-vwsfriend}
      - TZ=UTC
      - PGTZ=UTC
    command: -p ${DB_PORT-5432}
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -p ${DB_PORT-5432} --username=${DB_USER-admin} --dbname=${DB_NAME-vwsfriend}"]
      interval: 10s
      timeout: 5s
      retries: 5

  grafana:
    image: tillsteinbach/vwsfriend-grafana:${VWSFRIEND_GRAFANA_VERSION-latest}
    ports:
      - ${GF_SERVER_HTTP_PORT-3000}:${GF_SERVER_HTTP_PORT-3000}
    networks:
      bridge:
      backend:
        aliases:
          - grafanabackend
    volumes:
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_USER=${VWSFRIEND_USERNAME-admin}
      - GF_SECURITY_ADMIN_PASSWORD=${VWSFRIEND_PASSWORD-secret}
      - GF_SERVER_HTTP_PORT=${GF_SERVER_HTTP_PORT-3000}
      - DB_USER=${DB_USER-admin}
      - DB_PASSWORD=${DB_PASSWORD-secret}
      - DB_HOSTNAME=${DB_HOSTNAME-postgresdbbackend}
      - DB_PORT=${DB_PORT-5432}
      - DB_NAME=${DB_NAME-vwsfriend}
      - VWSFRIEND_USERNAME=${VWSFRIEND_USERNAME-admin}
      - VWSFRIEND_PASSWORD=${VWSFRIEND_PASSWORD-secret}
      - VWSFRIEND_HOSTNAME=${VWSFRIEND_HOSTNAME-vwsfriendbackend}
      - VWSFRIEND_PORT=${VWSFRIEND_PORT-4000}
      # Settings for reverse proxy
      - GF_SERVER_DOMAIN=${FQDN_TM}
      - GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s/grafana
      - GF_SERVER_SERVE_FROM_SUB_PATH=true
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "(wget -qO- http://localhost:${GF_SERVER_HTTP_PORT-3000}/api/health | grep '\"database\": \"ok\"' -q) || exit 1"]
      interval: 60s
      timeout: 10s
      retries: 3
    labels:
      # Settings for reverse proxy
      - "com.centurylinklabs.watchtower.scope=autoupdate"
      - "traefik.enable=true"
      - "traefik.port=3000"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
      - "traefik.http.middlewares.redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.grafana-insecure.rule=Host(`${FQDN_TM}`) && (Path(`/grafana`) || PathPrefix(`/grafana/`))"
      - "traefik.http.routers.grafana-insecure.entrypoints=web"
      - "traefik.http.routers.grafana-insecure.middlewares=redirect"
      - "traefik.http.routers.grafana.rule=Host(`${FQDN_TM}`) && (Path(`/grafana`) || PathPrefix(`/grafana/`))"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls"

 proxy:
    image: traefik:latest
    restart: always
    command:
      - "--global.sendAnonymousUsage=false"
      - "--providers.docker"
      - "--providers.docker.exposedByDefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

networks:
  bridge:
  backend:

volumes:
  vwsfriend_data:
  postgresdb_data:
  grafana_data:

I have not checked in detail if this is really securing everything. So just see it as an example.

[avorionero]

Than you!
i will do some test
Regads
Stefano