オレオレRoot認証局を作って オレオレ証明書を発行しよう！Portainer + Local CAでサクッとWebで

sudo apt update
sudo apt upgrade -y

sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin

sudo systemctl enable --now docker
sudo systemctl status docker

sudo docker run hello-world

sudo docker volume create portainer_data

sudo docker volume ls

sudo docker run -d \
  -p 9443:9443 \
  --name portainer \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce:lts

sudo docker ps

CONTAINER ID   IMAGE                        COMMAND        CREATED          STATUS          PORTS                                                             NAMES
723aeb6b12cf   portainer/portainer-ce:lts   "/portainer"   45 seconds ago   Up 45 seconds   8000/tcp, 9000/tcp, 0.0.0.0:9443->9443/tcp, [::]:9443->9443/tcp   portainer

sudo docker logs portainer 2>&1 | grep 'setup_token='

services:
  web:
    image: practicalsre/local-ca:latest
    container_name: localca-web
    restart: unless-stopped
    volumes:
      - db:/app/db
      - static_volume:/app/staticfiles
    environment:
      - TZ=Asia/Tokyo
      - CSRF_TRUSTED_ORIGINS=http://10.0.1.234:8080
    networks:
      - app_network
    command: >
      sh -c "
      ls -l &&
      python manage.py migrate &&
      python manage.py initadmin &&
      python manage.py collectstatic --noinput &&
      exec gunicorn localca_project.wsgi --bind 0.0.0.0:8000 --worker-class=gthread --threads=4"

  nginx:
    image: practicalsre/local-ca-nginx:latest
    container_name: localca-nginx
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      - static_volume:/app/staticfiles:ro
    depends_on:
      - web
    networks:
      - app_network

volumes:
  static_volume:
  db:

networks:
  app_network:
    driver: bridge

openssl x509 -in portainer_chain.pem -noout -subject -issuer -ext subjectAltName

subject=CN = portainer, O = LocalCA
issuer=CN = Oreore Intermediate CA, O = LocalCA
X509v3 Subject Alternative Name:
    DNS:portainer, IP Address:10.0.1.234

sudo mkdir -p /opt/portainer/certs
sudo cp portainer_chain.pem portainer_private.pem /opt/portainer/certs/
sudo chmod 644 /opt/portainer/certs/portainer_chain.pem
sudo chmod 600 /opt/portainer/certs/portainer_private.pem

sudo docker stop portainer
sudo docker rm portainer

sudo docker run -d \
  -p 9443:9443 \
  --name portainer \
  --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  -v /opt/portainer/certs:/certs:ro \
  portainer/portainer-ce:lts \
  --sslcert /certs/portainer_chain.pem \
  --sslkey /certs/portainer_private.pem

chrome://restart

sudo mkdir -p /opt/localca/certs
sudo mkdir -p /opt/localca/nginx
sudo cp localca_chain.pem /opt/localca/certs/
sudo cp localca_private.pem /opt/localca/certs/
sudo chmod 644 /opt/localca/certs/localca_chain.pem
sudo chmod 600 /opt/localca/certs/localca_private.pem

sudo tee /opt/localca/nginx/default.conf > /dev/null <<'EOF'
# HTTP -> HTTPS
server {
    listen 80;
    server_name _;

    return 301 https://$host:8443$request_uri;
}

# HTTPS
server {
    listen 443 ssl;
    server_name _;

    ssl_certificate     /etc/nginx/certs/localca_chain.pem;
    ssl_certificate_key /etc/nginx/certs/localca_private.pem;

    ssl_protocols TLSv1.2 TLSv1.3;

    location / {
        proxy_pass http://web:8000;

        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /static/ {
        alias /app/staticfiles/;
        expires 30d;
    }
}
EOF

services:
  web:
    image: practicalsre/local-ca:latest
    container_name: localca-web
    restart: unless-stopped
    volumes:
      - db:/app/db
      - static_volume:/app/staticfiles
    environment:
      - TZ=Asia/Tokyo
      - CSRF_TRUSTED_ORIGINS=https://10.0.1.234:8443
    networks:
      - app_network
    command: >
      sh -c "
      ls -l &&
      python manage.py migrate &&
      python manage.py initadmin &&
      python manage.py collectstatic --noinput &&
      exec gunicorn localca_project.wsgi --bind 0.0.0.0:8000 --worker-class=gthread --threads=4"

  nginx:
    image: practicalsre/local-ca-nginx:latest
    container_name: localca-nginx
    restart: unless-stopped
    ports:
      - "8080:80"
      - "8443:443"
    volumes:
      - static_volume:/app/staticfiles:ro
      - /opt/localca/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
      - /opt/localca/certs:/etc/nginx/certs:ro
    depends_on:
      - web
    networks:
      - app_network

volumes:
  static_volume:
  db:

networks:
  app_network:
    driver: bridge