add TLS defaults

README.md

@@ -1,5 +1,5 @@
 # Alpine :: Traefik Labels
-![size](https://img.shields.io/docker/image-size/11notes/traefik-labels/amd64-0.1.9?color=0eb305) ![version](https://img.shields.io/docker/v/11notes/traefik-labels/amd64-0.1.9?color=eb7a09) ![pulls](https://img.shields.io/docker/pulls/11notes/traefik-labels?color=2b75d6) ![activity](https://img.shields.io/github/commit-activity/m/11notes/docker-traefik-labels?color=c91cb8) ![commit-last](https://img.shields.io/github/last-commit/11notes/docker-traefik-labels?color=c91cb8)
+![size](https://img.shields.io/docker/image-size/11notes/traefik-labels/amd64-0.1.10?color=0eb305) ![version](https://img.shields.io/docker/v/11notes/traefik-labels/amd64-0.1.10?color=eb7a09) ![pulls](https://img.shields.io/docker/pulls/11notes/traefik-labels?color=2b75d6) ![activity](https://img.shields.io/github/commit-activity/m/11notes/docker-traefik-labels?color=c91cb8) ![commit-last](https://img.shields.io/github/last-commit/11notes/docker-traefik-labels?color=c91cb8)
 
 Run Traefik Labels based on Alpine Linux. Small, lightweight, secure and fast 🏔️
 
@@ -10,6 +10,9 @@ In order to use this image, you need to setup Traefik with a Redis provider and
 
 This image provides the ability to call a webhook for each container for each event or poll after the data was updates in Redis and or nsupdate.
 
+## Volumes
+* **/labels/ssl** - Directory of ssl certificates for TLS<sup>1</sup>
+
 ## Run
 ```shell
 docker run --name traefik-labels \
@@ -27,6 +30,15 @@ docker run --name traefik-labels \
   -d 11notes/traefik-labels:[tag]
 ```
 
+```shell
+docker run --name traefik-labels \
+  -v .../ssl:/labels/ssl \
+  -e LABELS_REDIS_URL="rediss://foo:bar@10.127.198.254:6379/0" \
+  -e LABELS_WEBHOOK="https://domain.com/traefik/labels" \
+  -e LABELS_WEBHOOK_AUTH_BASIC="foo:bar" \
+  -d 11notes/traefik-labels:[tag]
+```
+
 ## Examples
 ```shell
 docker run --name traefik-demo \
@@ -65,18 +77,23 @@ docker run --name traefik-rfc2136-demo \
 | `gid` | 1000 | group id 1000 |
 | `home` | /labels | home directory of user docker |
 | `api` | https://${IP}:5000 | HTTPS endpoint of Docker registry |
+| `ca.crt` | /labels/ssl/ca.crt | Certificate of CA for TLS<sup>1</sup> |
+| `labels.crt` | /labels/ssl/labels.crt | Certificate of client for TLS<sup>1</sup> |
+| `labels.key` | /labels/ssl/labels.key | Private key of client for TLS<sup>1</sup> |
 
 ## Environment
 | Parameter | Value | Default |
 | --- | --- | --- |
-| `TZ` | [Time Zone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) | null |
-| `DEBUG` | Show debug information | null |
+| `TZ` | [Time Zone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) | |
+| `DEBUG` | Show debug information | |
 | `LABELS_REDIS_URL` | the redis URL to connect, use rediss:// for SSL | rediss://localhost:6379/0 |
 | `LABELS_INTERVAL` | in what interval container information is pulled in seconds | 300 |
 | `LABELS_TIMEOUT` | how many seconds after an interval the keys should stay till they expire in seconds | 30 |
 | `LABELS_WEBHOOK` | URL to call on each event or poll for each container |  |
 | `LABELS_WEBHOOK_AUTH_BASIC` | Basic authentication to use in the form of "username:password" for the webhook |  |
-| `LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE` | Only update DNS entries if they are new or changed (will use dig on each call to the set server) | false |
+| `LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE` | Only update DNS entries if they are new or changed (will use dig on each call to the set server) |  |
+| `LABELS_DOCKER_IP` | Used for TLS<sup>1</sup> authentication against dockerd | localhost |
+| `LABELS_DOCKER_PORT` | Used for TLS<sup>1</sup> authentication against dockerd | 2376 |
 
 ## Parent image
 * [11notes/node:stable](https://hub.docker.com/r/11notes/node)
@@ -90,4 +107,18 @@ docker run --name traefik-rfc2136-demo \
 ## Tips
 * Only use rootless container runtime (podman, rootless docker)
 * Don't bind to ports < 1024 (requires root), use NAT/reverse proxy (haproxy, traefik, nginx)
-* Do not access docker.sock as root
+* Do not access docker.sock as root
+* Use TLS if you can't access docker.sock as non-root
+
+## Disclaimers
+* <sup>1</sup> For TLS to work you need proper certificates in place for your dockerd and your clients. The CN in the certificate needs to match the FQDN or IP you have set on the docker node, you can set multiple by using SAN. See an example of a daemon.json configuration to enable TLS.
+```json
+{
+  "tls": true,
+  "tlsverify": true,
+  "tlscacert": "/etc/docker/ca.crt",
+  "tlscert": "/etc/docker/server.crt",
+  "tlskey": "/etc/docker/server.key",
+  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"]
+}
+```

multi-arch-manifest.yaml

@@ -1,10 +1,10 @@
 image: 11notes/traefik-labels:latest
 manifests:
-  - image: 11notes/traefik-labels:amd64-0.1.9
+  - image: 11notes/traefik-labels:amd64-0.1.10
     platform:
       architecture: amd64
       os: linux
-  - image: 11notes/traefik-labels:arm64v8-0.1.9
+  - image: 11notes/traefik-labels:arm64v8-0.1.10
     platform:
       architecture: arm64
       os: linux

rootfs/labels/main.js

@@ -1,6 +1,7 @@
 process.once('SIGTERM', () => process.exit(0));
 process.once('SIGINT', () => process.exit(0));
 
+const fs = require('fs');
 const Docker = require('dockerode');
 const redis = require('redis');
 const { nsupdate } = require('./nsupdate');
@@ -13,14 +14,6 @@ const ENV_LABELS_WEBHOOK = process.env?.LABELS_WEBHOOK;
 const ENV_LABELS_WEBHOOK_AUTH_BASIC = process.env?.LABELS_WEBHOOK_AUTH_BASIC;
 const ENV_LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE = process.env?.LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE || false;
 
-elevenLogJSON('info', {config:{
-  LABELS_INTERVAL :ENV_REDIS_INTERVAL,
-  LABELS_TIMEOUT:ENV_REDIS_TIMEOUT,
-  LABELS_WEBHOOK:ENV_LABELS_WEBHOOK,
-  LABELS_WEBHOOK_AUTH_BASIC:((ENV_LABELS_WEBHOOK_AUTH_BASIC) ? true: false),
-  LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE:ENV_LABELS_RFC2136_ONLY_UPDATE_ON_CHANGE
-}});
-
 class Labels{
   #docker;
   #redis;
@@ -30,7 +23,27 @@ class Labels{
   };
 
   constructor(){
-    this.#docker = new Docker({socketPath:'/run/docker.sock'});
+    switch(true){
+      case fs.existsSync('/run/docker.sock'):
+        elevenLogJSON('info', 'connect to Docker socket');
+        this.#docker = new Docker({socketPath:'/run/docker.sock'});
+      break;
+
+      case fs.existsSync(`${process.env?.APP_ROOT}/ssl/ca.crt`):
+        elevenLogJSON('info', 'connect to Docker API via TLS verify');
+        this.#docker = new Docker({
+          protocol:'https',
+          host:process.env?.LABELS_DOCKER_IP || 'localhost',
+          port: process.env.LABELS_DOCKER_PORT || 2376,
+          ca:fs.readFileSync(`${process.env?.APP_ROOT}/ssl/ca.crt`),
+          cert:fs.readFileSync(`${process.env?.APP_ROOT}/ssl/labels.crt`),
+          key:fs.readFileSync(`${process.env?.APP_ROOT}/ssl/labels.key`)
+        });
+      break;
+
+      default:
+        elevenLogJSON('error', 'No docker API available, add /run/docker.sock (non-root) or use TLS verify authentication!');
+    }
     if(ENV_LABELS_WEBHOOK_AUTH_BASIC){
       this.#webhook.headers['Authorization'] = 'Basic ' + Buffer.from(ENV_LABELS_WEBHOOK_AUTH_BASIC).toString('base64')
     }