🚀 Deployment

🐳 Docker

Docker image

To deploy the CA, use the following Docker image:

harbor.confirm.ch/ca/ca

Docker command

To deploy the CA service via simple docker command, use the following CLI arguments:

docker run -d \
    --name ca \
    -e CA_DNS=ca.example.net \
    -e CA_NAME="Example CA" \
    -e CA_PROVISIONER=admin \
    -p 8443:8443 \
    -v ca:/ca \
    harbor.confirm.ch/ca/ca

Hint

It’s recommended to deploy the CA service via Docker Compose.

Docker Compose

Use the following docker-compose.yml file to start the CA:

---
services:

  ca:

    image: harbor.confirm.ch/ca/ca

    environment:
      CA_DNS: ca.example.net
      CA_NAME: Example CA
      CA_PROVISIONER: admin

    ports:
      - '8443:8443'

    volumes:
      - ca:/ca

    restart: unless-stopped

volumes:
  ca:

Then bring the stack up with:

docker compose up -d

🛡️ Reverse proxy

When running the CA service behind a reverse proxy, you should follow these rules:

  1. Remove all direct port mapppings (i.e. 8443)

  2. Point your reverse proxy to the port 8443 instead (only exposed port)

  3. Passthrough TLS connections to the CA, don’t intercept them on the reverse proxy

  4. Disable strict SNI checking

  5. Put the CA into the same network as the proxy

Traefik

To run the CA service behind a Traefik, the following labels must be added to the container:

services:
  ca:

    # … existing config (see chapter above)

    # Passthrough connections from Traefik directly to CA.
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.ca.rule=HostSNI(`ca.example.net`)
      - traefik.tcp.routers.ca.tls.passthrough=true

    # Add CA to proxy network.
    networks:
      - proxy

# Make proxy network available for Compose service.
networks:
  proxy:
    external: true

Hint

If you’ve strict SNI checking enabled, create a new dynamic config such as this:

tls:
  options:
    sni-strict-disable:
      sniStrict: false

Then use the option as another label:

labels:
    # … existing labels
    - traefik.tcp.routers.ca.tls.options=sniStrictDisable@file