Skip to content

Commit 6cc2c27

Browse files
MohsinHashmi-DataInnmohsin-wiserclaude
authored
feat: add wildcard ssl certificate with cloudflare dns challenge (#392)
* feat: add wildcard ssl certificate with cloudflare dns challenge - switch from nip.io to dev.simpleaccounts.io domain - configure cloudflare dns challenge for let's encrypt wildcard cert - simplify traefik labels (remove redundant http routers) - add dev.simpleaccounts.io to vite allowedHosts 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: remove global http redirect to preserve local domain access 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Mohsin Hashmi <mhashmi@wiser.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 7d785de commit 6cc2c27

3 files changed

Lines changed: 13 additions & 27 deletions

File tree

‎.devcontainer/docker-compose.yml‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -70,40 +70,24 @@ services:
7070
labels:
7171
- 'traefik.enable=true'
7272
- 'traefik.docker.network=dev-proxy-network'
73-
# ============= HTTPS redirect middleware (for nip.io domains only) =============
74-
- 'traefik.http.middlewares.${USER:-devuser}-https-redirect.redirectscheme.scheme=https'
75-
- 'traefik.http.middlewares.${USER:-devuser}-https-redirect.redirectscheme.permanent=true'
7673
# ============= Frontend routing (port 3000) =============
77-
# HTTP router (redirects to HTTPS)
78-
- 'traefik.http.routers.${USER:-devuser}-frontend-http.rule=HostRegexp(`${USER:-devuser}.{ip:[0-9-]+}.nip.io`)'
79-
- 'traefik.http.routers.${USER:-devuser}-frontend-http.entrypoints=web'
80-
- 'traefik.http.routers.${USER:-devuser}-frontend-http.middlewares=${USER:-devuser}-https-redirect'
81-
# HTTPS router with Let's Encrypt
82-
- 'traefik.http.routers.${USER:-devuser}-frontend.rule=HostRegexp(`${USER:-devuser}.{ip:[0-9-]+}.nip.io`)'
74+
- 'traefik.http.routers.${USER:-devuser}-frontend.rule=Host(`${USER:-devuser}.dev.simpleaccounts.io`)'
8375
- 'traefik.http.routers.${USER:-devuser}-frontend.entrypoints=websecure'
8476
- 'traefik.http.routers.${USER:-devuser}-frontend.tls=true'
8577
- 'traefik.http.routers.${USER:-devuser}-frontend.tls.certresolver=letsencrypt'
78+
- 'traefik.http.routers.${USER:-devuser}-frontend.tls.domains[0].main=dev.simpleaccounts.io'
79+
- 'traefik.http.routers.${USER:-devuser}-frontend.tls.domains[0].sans=*.dev.simpleaccounts.io'
8680
- 'traefik.http.routers.${USER:-devuser}-frontend.service=${USER:-devuser}-frontend'
8781
- 'traefik.http.services.${USER:-devuser}-frontend.loadbalancer.server.port=3000'
8882
# ============= Backend API routing (port 8080) =============
89-
# HTTP router (redirects to HTTPS)
90-
- 'traefik.http.routers.${USER:-devuser}-api-http.rule=HostRegexp(`${USER:-devuser}-api.{ip:[0-9-]+}.nip.io`)'
91-
- 'traefik.http.routers.${USER:-devuser}-api-http.entrypoints=web'
92-
- 'traefik.http.routers.${USER:-devuser}-api-http.middlewares=${USER:-devuser}-https-redirect'
93-
# HTTPS router with Let's Encrypt
94-
- 'traefik.http.routers.${USER:-devuser}-api.rule=HostRegexp(`${USER:-devuser}-api.{ip:[0-9-]+}.nip.io`)'
83+
- 'traefik.http.routers.${USER:-devuser}-api.rule=Host(`${USER:-devuser}-api.dev.simpleaccounts.io`)'
9584
- 'traefik.http.routers.${USER:-devuser}-api.entrypoints=websecure'
9685
- 'traefik.http.routers.${USER:-devuser}-api.tls=true'
9786
- 'traefik.http.routers.${USER:-devuser}-api.tls.certresolver=letsencrypt'
9887
- 'traefik.http.routers.${USER:-devuser}-api.service=${USER:-devuser}-api'
9988
- 'traefik.http.services.${USER:-devuser}-api.loadbalancer.server.port=8080'
10089
# ============= Code-server / Web IDE routing (port 8443) =============
101-
# HTTP router (redirects to HTTPS)
102-
- 'traefik.http.routers.${USER:-devuser}-ide-http.rule=HostRegexp(`${USER:-devuser}-ide.{ip:[0-9-]+}.nip.io`)'
103-
- 'traefik.http.routers.${USER:-devuser}-ide-http.entrypoints=web'
104-
- 'traefik.http.routers.${USER:-devuser}-ide-http.middlewares=${USER:-devuser}-https-redirect'
105-
# HTTPS router with Let's Encrypt
106-
- 'traefik.http.routers.${USER:-devuser}-ide.rule=HostRegexp(`${USER:-devuser}-ide.{ip:[0-9-]+}.nip.io`)'
90+
- 'traefik.http.routers.${USER:-devuser}-ide.rule=Host(`${USER:-devuser}-ide.dev.simpleaccounts.io`)'
10791
- 'traefik.http.routers.${USER:-devuser}-ide.entrypoints=websecure'
10892
- 'traefik.http.routers.${USER:-devuser}-ide.tls=true'
10993
- 'traefik.http.routers.${USER:-devuser}-ide.tls.certresolver=letsencrypt'

‎.devcontainer/proxy/docker-compose.proxy.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ services:
2929
restart: unless-stopped
3030
environment:
3131
- DOCKER_API_VERSION=1.44
32+
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
3233
command:
3334
# API and Dashboard
3435
- '--api.dashboard=true'
@@ -40,11 +41,12 @@ services:
4041
# Entrypoints
4142
- '--entrypoints.web.address=:80'
4243
- '--entrypoints.websecure.address=:443'
43-
# NOTE: No blanket HTTP→HTTPS redirect here to preserve local domain HTTP access
44-
# HTTPS redirect is handled per-router via middleware for nip.io domains only
45-
# Let's Encrypt Certificate Resolver
46-
- '--certificatesresolvers.letsencrypt.acme.httpchallenge=true'
47-
- '--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web'
44+
# NOTE: No global HTTP→HTTPS redirect - local domains use HTTP only
45+
# HTTPS is enforced by routers using websecure entrypoint
46+
# Let's Encrypt Certificate Resolver with Cloudflare DNS challenge
47+
- '--certificatesresolvers.letsencrypt.acme.dnschallenge=true'
48+
- '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare'
49+
- '--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53'
4850
- '--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@simpleaccounts.io}'
4951
- '--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json'
5052
# Logs

‎apps/frontend/vite.config.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ export default defineConfig({
113113
host: true, // Listen on all interfaces (0.0.0.0 and ::)
114114
open: false, // Don't auto-open browser
115115
strictPort: false, // Allow fallback to next available port if 3000 is taken
116-
allowedHosts: ['localhost', '.nip.io', '.dev.simpleaccounts.local'], // Restrict to known hosts for security
116+
allowedHosts: ['localhost', '.nip.io', '.dev.simpleaccounts.local', '.dev.simpleaccounts.io'], // Restrict to known hosts for security
117117
// Reduce memory usage in dev
118118
fs: {
119119
// Limit file system access

0 commit comments

Comments
 (0)