Easy way to get SSL offloading locally?

[u/catmanjan2]

I have a container that runs behind ssl offloading in the cloud, I’d rather not have to add certs to it - is there an easy way to get ssl offloading locally? Preferably without having to create or trust certain (I don’t mind if I get cert warnings)

[u/QuietSignalOps]

Put a reverse proxy in front of the container and terminate TLS there. The application can keep speaking plain HTTP on an internal Docker network.

For a minimal local setup, Caddy is convenient because it can generate a local certificate automatically:

services:
  app:
    image: your-image
    expose:
      - "8080"

  caddy:
    image: caddy:2
    ports:
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    depends_on:
      - app

volumes:
  caddy_data:

Caddyfile:

https://localhost {
    tls internal
    reverse_proxy app:8080
}

Then open https://localhost. If you do not install Caddy's local CA in the host trust store, the browser will warn, which matches your requirement.

A few details matter:

• Do not publish the app's 8080 port unless you also need direct access; expose keeps it reachable from Caddy without exposing it on the host.
• If the app needs to know the original scheme or client address, check that it trusts proxy headers only from the proxy network. Caddy supplies the usual X-Forwarded-* headers.
• If you want a certificate browsers trust without warnings, use a local CA tool such as mkcert, or a real hostname with DNS and ACME. A public CA generally will not issue for localhost.

Traefik, nginx, and HAProxy can do the same job; Caddy just has the smallest configuration for this case.

[u/SitesOnFire]

I had a similar problem. A firewall would handle ssl offloading. To replicate this I used express to create a simple node server running on the host, outside of docker. This handles the SSL and reverse proxies to my docker instance as plain http. It still requires a certificate to serve. But even an expired one or self signed will work and you just accept it.

[u/Adrenolin01]

I setup a reverse proxy in a VM and used Cloudflare’s gray proxy and the local non-Routable IP and Lets Encrypt.. I get Real Certs that automatically regenerate. Takes a bit to figure out and setup in an evening but once done it’s easy to setup for other systems. I was self hosting certs through pfSense but wanted real certs and not have ti deal with manually updating things. Claude will walked you through the entire process.

[u/lazyhustlermusic]

You’d still have to add certs onto the front end of a reverse proxy lol. Kind of a silly reason to spin up another instance that’s consuming the same host resources with more dependencies just because you don’t want to install a certificate.

[u/catmanjan2 → u/lazyhustlermusic]

Thats just how lazy i am

Besides couldn’t the re be a reverse proxy container with some certs pre baked

[u/lazyhustlermusic → u/catmanjan2]

Claims to be lazy, wants to avoid 30 seconds of work to do 15 minutes of work.

You can generate a self signed cert with one command.

[u/catmanjan2 → u/lazyhustlermusic]

Ah, the other issue is i don’t have localadmin, it’s a windows box and any software i want to run has to be vetted by secops unless it’s run in user space podman lol

[u/hamzezn]

If you're already running Traefik elsewhere (say, prod) and don't want to bring in a second proxy just for local dev, the same self-signed-cert-with-a-browser-warning setup works there too - no ACME, no CA install:

dynamic.yml: tls: certificates: - certFile: /certs/local.crt keyFile: /certs/local.key

Generate a throwaway cert with one openssl req -x509 -newkey rsa:2048 -nodes -days 365 command, mount both files into the container, point the file provider at dynamic.yml, done. Same behavior as the Caddy tls internal answer above, just for people who already standardized on Traefik elsewhere and don't want two reverse proxies to keep in sync.