localCA is so good!

[SinisterSpatula]

wow this was exactly what I was looking for and I love the simple UI. Great job on it! One improvement I'd like to suggest is to add to the readme how to go about adding the created certificate to nginx of the container. I came up with this solution for mine:

compose.yaml:

# github - https://github.com/tgangte/LocalCA
services:
  web:
    image: practicalsre/local-ca:latest
    container_name: localca
    restart: unless-stopped
    volumes:
      - db:/app/db
      - static_volume:/app/staticfiles
    networks:
      - app_network
    command: >
      sh -c "
        ls -l
        python manage.py migrate &&
        python manage.py initadmin &&
        python manage.py collectstatic --noinput &&
        exec gunicorn localca_project.wsgi --bind 0.0.0.0:8000 --worker-class=gthread --threads=4"
  nginx:
    image: practicalsre/local-ca-nginx:latest
    container_name: nginx
    restart: unless-stopped
    ports:
      - 8000:80
      - 8001:443
    volumes:
      - static_volume:/app/staticfiles:ro
      - ./default.conf:/etc/nginx/conf.d/default.conf:ro
      - ./localca.home.arpa_chain.pem:/etc/nginx/certs/localca.home.arpa_chain.pem
      - ./localca.home.arpa_private.pem:/etc/nginx/certs/localca.home.arpa_private.pem
    depends_on:
      - web
    networks:
      app_network: null
      macvlan_network:
        ipv4_address: 192.168.200.67 # Choose an unused IP within your subnet
volumes:
  static_volume: null
  db: null
networks:
  app_network:
    driver: bridge
  macvlan_network:
    external: true

default.conf

server {
    listen 443 ssl;
    server_name localca.home.arpa;

    ssl_certificate /etc/nginx/certs/localca.home.arpa_chain.pem;
    ssl_certificate_key /etc/nginx/certs/localca.home.arpa_private.pem;

    location / {
        proxy_pass http://web:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /static/ {
        alias /app/staticfiles/;
        expires 30d;
    }
}

server {
    listen 80;
    server_name localca.home.arpa;

    # Redirect HTTP to HTTPS
    return 301 https://$host$request_uri;
}

[SinisterSpatula]

Oh crud, guess I need to figure out how to make it a trusted origin. Might just roll this back and use caddy to terminate SSL and reverse proxy to the container instead.

[SinisterSpatula]

Maybe the CSRF_TRUSTED_ORIGINS could be an environment variable for the container instead of having to mount a new copy of settings.py to the container?

[tgangte]

Maybe the CSRF_TRUSTED_ORIGINS could be an environment variable for the container instead of having to mount a new copy of settings.py to the container?

That's an idea! Feel free to submit a pull request for the same and I can review it. Else I'll take a look at it over the weekend.

[SinisterSpatula]

Sorry to bother, is there a way to delete leaf certs? Or revoke them and hide them from the list? (or maybe that's coming later on)

[tgangte]

Not at all! Revocation is in the future feature roadmap. Since the file is stored on local disc, there is no delete function, although we can add this feature too later

[tgangte]

@SinisterSpatula you can delete the certificates from the /admin page!

[tgangte]

Thats a great idea @SinisterSpatula! LocalCA instance itself is without a cert, I'll make the changes so that the cert can be copied on the container for nginx to use.