Accessing ssl .pem files inside docker container

Viewed 2232

I need to access a folder on my host machine which contains lets-encrypt files at

/docker-volumes/etc/letsencrypt/live/mydomain.com

on my one of the containers. I have mapped volume in compose file.

compose.yml

version: "3"
services:
  mongo:
    container_name: mongo
    image: mongo
    ports:
      - "27017:27017"
    volumes:
      - "./data:/data/db"
  api:
    container_name: my-api
    restart: always
    build:
      context: ./my_backend
       dockerfile: dockerfile
    ports:
      - "4002:443"
    volumes:
      - /docker-volumes/etc/letsencrypt/live/mydomain.com:/app/certs
    links:
      - mongo

dockerfile at my_backend

FROM node:10.16.3

WORKDIR /app

RUN mkdir certs

RUN mkdir public

RUN mkdir public/uploads

RUN mkdir public/videos

RUN mkdir public/reports

COPY ./package*.json ./

RUN npm install

COPY . .

CMD ["npm", "start"]

There are three files which i need to access from /app/certs in my server.js file.

server.js

const fs = require("fs");
const https = require("https");
const credentials = {};
const path = require("path");

if (process.env.NODE_ENV === "production") {
  const privateKey = fs.readFileSync(
    path.join(__dirname, "certs/privkey.pem"),
    "utf8"
  );
  const certificate = fs.readFileSync(
    path.join(__dirname, "certs/cert.pem"),
    "utf8"
  );
  const ca = fs.readFileSync(path.join(__dirname, "certs/fullchain.pem"), "utf8");

  credentials["key"] = privateKey;
  credentials["cert"] = certificate;
  credentials["ca"] = ca;
}
...other logic and server.listen on port 443

When I fire docker-compose up, it always gives me this

{"error":{"errno":-2,"syscall":"open","code":"ENOENT","path":"/app/certs/privkey.pem"}ENOENT: no such file or directory other two as well.

I am stuck, can any one help. I am new to docker.

1 Answers

After an entire night battling with the same issue myself, I've found the cause and I hope this helps anyone coming across this in the future:

The certificates in /etc/letsencrypt/live/your-domain are not actually certificates, rather, they are shortcuts pointing to the real certs in the archive folder. The real certs:

/etc/letsencrypt/archive/your-domain/cert1.pem
/etc/letsencrypt/archive/your-domain/fullchain1.pem
...etc

So since you only mounted the live folder, it's pointing to nothing when it's actually being accessed. To fix this, either mounted the archive folder or the entire letsencrypt folder, then point to the certificates.

Related