Gateway Server Setup with Docker-Compose

[dunglas]

Gateway Server Setup with Docker-Compose

[teohhanhui]

The Vulcain gateway server is connecting using Host: api, which does not match the Subject Alternate Name (SAN) of the certificate. Is it not possible to just connect using the public domain name?

[jessequinn]

that is correct. I also tried that. using http: site_url and https: site_url and vulcain complained about certificates being unauthorized or something. i can try to get the exact error message after lunch.

[teohhanhui]

Seems like golang/go#28168

We need to override req.Host explicitly?

[jessequinn]

no idea. ill wait for a response. thanks.

the error when using https: site_url

vulcain_1      | time="2019-12-04T20:25:33Z" level=error msg="http: proxy error: x509: certificate signed by unknown authority"
vulcain_1      | 177.74.217.145 - - [04/Dec/2019:20:25:32 +0000] "POST /authenticate HTTP/1.1" 502 23 "" "PostmanRuntime/7.20.1"
vulcain_1      | 2019/12/04 20:25:33 http: TLS handshake error from 3.232.5.187:37056: remote error: tls: bad certificate

[Neirda24]

If using mkcert you need to mount the $(mkcert -CAROOT)/rootCA.pem into the vulcain container (path = /etc/ssl/certs/ca-certificates.crt) so vulcain will see the certificate as correctly signed.

Regarding the use of the real host instead of the service name a good trick is to use the network config.

networks:
    vulcain:
        name: 'vulcain'

services:
    vulcain:
        networks:
            default: {}
            vulcain: {}
    app:
        networks:
            default: {}
            vulcain:
                aliases:
                    - 'site_url'