starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 21:18:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat(proxy): make the Traefik certificate resolver configurable per server

Browse Source 
Coolify always added tls.certresolver=letsencrypt to generated HTTPS
routers, so Traefik logged errors when the proxy used its own
certificates (for example Cloudflare Origin CA) without that resolver.
Add a server setting (default letsencrypt) in the proxy page and API.
An empty value omits the resolver from resource labels, the Coolify
dashboard routes, and the catch-all router.

Closes #12138
This commit is contained in:
Andras Bacsai
2026-10-11 10:19:40 +02:00
parent d4502bc514
commit af589f6da4
13 changed files with 339 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Models/Server.php
+17 -15
View File
@@ -667,9 +667,7 @@ class Server extends BaseModel
],
'service' => 'noop',
'rule' => 'PathPrefix(`/`)',
'tls' => [
'certResolver' => 'letsencrypt',
],
'tls' => $this->traefikCertificateResolver() ? ['certResolver' => $this->traefikCertificateResolver()] : [],
'priority' => -1000,
],
],
@@ -806,6 +804,8 @@ class Server extends BaseModel
];
if ($schema === 'https') {
$certificateResolver = $this->traefikCertificateResolver();
$tls = $certificateResolver ? ['certresolver' => $certificateResolver] : [];
$traefik_dynamic_conf['http']['routers']['coolify-http']['middlewares'] = $this->dashboardHttpMiddlewares($settings);
$traefik_dynamic_conf['http']['routers']['coolify-https'] = [
@@ -817,9 +817,7 @@ class Server extends BaseModel
],
'service' => 'coolify',
'rule' => "Host(`{$host}`)",
'tls' => [
'certresolver' => 'letsencrypt',
],
'tls' => $tls,
];
$traefik_dynamic_conf['http']['routers']['coolify-reverb-wss'] = [
'entryPoints' => [
@@ -827,9 +825,7 @@ class Server extends BaseModel
],
'service' => 'coolify-reverb',
'rule' => "Host(`{$host}`) && PathPrefix(`/app`)",
'tls' => [
'certresolver' => 'letsencrypt',
],
'tls' => $tls,
];
$traefik_dynamic_conf['http']['routers']['coolify-reverb-api-https'] = [
'entryPoints' => [
@@ -837,9 +833,7 @@ class Server extends BaseModel
],
'service' => 'coolify-reverb',
'rule' => "Host(`{$host}`) && PathPrefix(`/apps`)",
'tls' => [
'certresolver' => 'letsencrypt',
],
'tls' => $tls,
];
$traefik_dynamic_conf['http']['routers']['coolify-terminal-wss'] = [
'entryPoints' => [
@@ -847,9 +841,7 @@ class Server extends BaseModel
],
'service' => 'coolify-terminal',
'rule' => "Host(`{$host}`) && PathPrefix(`/terminal/ws`)",
'tls' => [
'certresolver' => 'letsencrypt',
],
'tls' => $tls,
];
}
$yaml = Yaml::dump($traefik_dynamic_conf, 12, 2);
@@ -1169,6 +1161,16 @@ $siteAddress {
return $this->settings->is_metrics_enabled;
}
/**
* Traefik certificate resolver for generated HTTPS routers, or null when the proxy uses its own certificates.
*/
public function traefikCertificateResolver(): ?string
{
$resolver = data_get($this, 'settings.traefik_certificate_resolver');
return filled($resolver) ? $resolver : null;
}
public function isTrafficAnalyticsEnabled(): bool
{
return (bool) data_get($this, 'settings.is_traffic_analytics_enabled', false);