# SSL and proxy container **URL:** \ **Category:** Rancher 1.x\ **Created:** [April 14, 2016, 8:09am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445 "2016-04-14T08:09:48Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 14, 2016, 8:09am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/1 "2016-04-14T08:09:48Z")
Hi, I’m currently trying to build my own rancher-server container. I want to access the rancher web interface over HTTPS. Nodes and registries are in the same private network and so will communicate over HTTP. This works when I install an Apache proxy directly on the host server, in which rancher/server is running. I just keep the rancher/server running over http on port 8080, I simply redirect the proxy to this port. In this configuration, the rancher-server web interface is reachable throw HTTPS from everywhere, and throw HTTP on port 8080 but only on the local network. What I would really prefer is installing the Apache SSL proxy directly in the rancher-server container (instead having this proxy directly installed on the host server). For that I build an new image from the official rancher/server image. Here is my Dockerfile: `FROM rancher/server MAINTAINER JayBee support@jaybee.com RUN apt-get update RUN apt-get upgrade -y RUN apt-get install -y apache2 RUN a2enmod headers && a2enmod filter && a2enmod proxy && a2enmod rewrite && a2enmod ssl && a2enmod socache_shmcb ADD 000-default.conf /etc/apache2/sites-available/ ADD default-ssl.conf /etc/apache2/sites-available/ RUN mkdir /etc/apache2/cert && a2ensite default-ssl ADD rancher.domain.crt /etc/apache2/cert/ ADD rancher.domain.key /etc/apache2/cert/ EXPOSE 443 8080 80 CMD /usr/sbin/apache2ctl -D FOREGROUND` Here is my Apache default-ssl.conf file: `; ServerName rancher.domain.com SSLEngine On SSLCertificateFile /etc/apache2/cert/rancher.domain.crt SSLCertificateKeyFile /etc/apache2/cert/rancher.domain.key SSLProxyEngine On SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off RequestHeader set X-Forwarded-Proto "https" RequestHeader set X-Forwarded-Port "443" ProxyPreserveHost On ProxyRequests Off ProxyPass / http://localhost:8080/ ProxyPassReverse / http://localhost:8080/ CustomLog /var/log/apache2/discourse_apache_proxy_https_access.log combined ErrorLog /var/log/apache2/discourse_apache_proxy_https_error.log ` The 000-default.conf file is just a redirection to the HTTPS. Otherwise, the website interface is accessible in the local network only, over HTTP on the classical port 8080. Then, when the container is successfully built, tagged, and pushed, I run it with this command: `docker run -d --restart=always -p 8080:8080 -p 443:443 -p 80:80 -e CATTLE_DB_CATTLE_MYSQL_HOST=10.129.0.155 -e CATTLE_DB_CATTLE_MYSQL_PORT=3306 -e CATTLE_DB_CATTLE_MYSQL_NAME=cattle -e CATTLE_DB_CATTLE_USERNAME=cattle -e CATTLE_DB_CATTLE_PASSWORD=cattle rancher.domain.com:5000/rancher-server:custom` Yes, I like complicated stuffs : that’s why I use an external database! So in this case, only the Apache server is working but the rancher web interface not. When I remove the last line in the Dockerfile (`CMD /usr/sbin/apache2ctl -D FOREGROUND`), I only get the rancher/server working! ---
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 14, 2016, 9:52am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/2 "2016-04-14T09:52:57Z")
I have also posted it on the docker forum, because I don’t know whether the problem comes from docker or rancher. > **[Build the docker Rancher-Server container with SSL](https://forums.docker.com/t/build-the-docker-rancher-server-container-with-ssl/9108)** > > Hi, I'm currently trying to build my own rancher-server container. I want to access the rancher web interface over HTTPS. Nodes and registries are in the same private network and so will communicate over HTTP. This works when I install an Apache... ---
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 15, 2016, 10:35am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/3 "2016-04-15T10:35:45Z")
So it seems that the problem comes from docker. In a Dockerfile, it is not possible to use the CMD several times. In that case the last CMD will override all the previous ones! And this is exactly what happened when I have written `CMD /usr/sbin/apache2ctl -D FOREGROUND`: this command has overwritten the one from the based rancher/server container image! So in my case, I can choose between having the Apache server **on the host server OR on another** server container. Instead of creating too many topics, I have another question related to SSL. ## **For all the other containers (managed by rancher), how can I administrate and easily deploy containers accessible throw https?** **Can I use the rancher interface for that (I’ve seen that it is possible to manage certificate but only when a DNS service is used)?** **Or should I use a dedicated Apache container per node with all the SSL configuration for each container?** ---
**Author:** ![denise](https://avatars.discourse-cdn.com/v4/letter/d/82dd89/32.png) [@denise](https://forums.suse.com/u/denise)\ **Post date:** [April 17, 2016, 2:00pm UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/4 "2016-04-17T14:00:44Z")
Have you seen the documentation on how to run Rancher server with SSL? It basically recommends what was in your Docker topic where you can run a separate container container running Apache. [http://docs.rancher.com/rancher/installing-rancher/installing-server/basic-ssl-config/](http://docs.rancher.com/rancher/installing-rancher/installing-server/basic-ssl-config/) ---
**Author:** ![snobear](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/snobear/32/1242_2.png) [@snobear](https://forums.suse.com/u/snobear)\ **Post date:** [April 22, 2016, 5:57pm UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/5 "2016-04-22T17:57:37Z")
@denise @jaybee Are there any existing Rancher SSL proxy images out there with apache/nginx already? ---
**Author:** ![Edouard\_Kleinhans](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/edouard_kleinhans/32/1184_2.png) [@Edouard\_Kleinhans](https://forums.suse.com/u/Edouard_Kleinhans)\ **Post date:** [April 25, 2016, 4:23am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/6 "2016-04-25T04:23:33Z")
Hello, you can use this website [https://www.nicolashug.com/developpement/docker/deployer-rancher-ui-https-docker](https://www.nicolashug.com/developpement/docker/deployer-rancher-ui-https-docker) ---
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 25, 2016, 7:37am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/7 "2016-04-25T07:37:48Z")
Yes, so it confirms what I said: **you can run the SSL proxy for the Rancher web interface directly on the host server (what I have tested) or on another container (your link)** ---
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 25, 2016, 7:44am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/8 "2016-04-25T07:44:56Z")
If you search the keywords “ssl” and “rancher” on the docker hub, results seem to be images with only SSL on it. But if someone have found some images with rancher and SSL proxy on it, I will be really interested to have some details about the Dockerfile! ---
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 25, 2016, 7:49am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/9 "2016-04-25T07:49:20Z")
Merci Edouard, but your tutorial (which is great) also confirms dedicating a proxy container for that. My question was to know if it is possible to have one container running **Rancher and SSL proxy**. ---
**Author:** ![jaybee](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jaybee](https://forums.suse.com/u/jaybee)\ **Post date:** [April 25, 2016, 7:56am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/10 "2016-04-25T07:56:11Z")
So thanks you for all your answers and sorry if I was a little bit absent for a while 🙂 Having two containers instead one for the Rancher over SSL is not so crucial, because I will only have one Rancher web interface. Let’s focus on the second question, which can be interesting if we have lot of containers to manage… > [@jaybee](#): > > For all the other containers (managed by rancher), how can I administrate and easily deploy containers accessible throw https? > > Can I use the rancher interface for that (I’ve seen that it is possible to manage certificate but only when a DNS service is used)?Or should I use a dedicated Apache container per node with all the SSL configuration for each container? ---
**Author:** ![Jason](https://avatars.discourse-cdn.com/v4/letter/j/dc4da7/32.png) [@Jason](https://forums.suse.com/u/Jason)\ **Post date:** [August 20, 2016, 11:07am UTC](https://forums.suse.com/t/ssl-and-proxy-container/2445/11 "2016-08-20T11:07:38Z")
Hello, you can use this website [http://advanced.name](http://advanced.name). Maybe, it can help you.