Trusted certificate instead of letsencrypt?

[uncltom]

We purchased a cert for our domain pointing to DocuSeal and we would like the domain to use that cert instead of letsencrypt.
Is this possible?

[omohokcoj]

@uncltom

version: '3'

services:
  app:
    depends_on:
      postgres:
        condition: service_healthy
    image: docuseal/docuseal:latest
    ports:
      - 3000:3000
    volumes:
      - .:/data
    environment:
      - FORCE_SSL=true
      - DATABASE_URL=postgresql://postgres:postgres@postgres:5432/docuseal

  postgres:
    image: postgres:15
    volumes:
      - './pg_data:/var/lib/postgresql/data'
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: docuseal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  caddy:
    image: caddy:latest
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    volumes:
      - .:/data
      - ./Caddyfile:/etc/caddy/Caddyfile
      - /path/to/your/certs:/certs # replace it with path to your certs on disk

^ Replace your existing docker-compose file with the file above.

In:

    volumes:
      - .:/data
      - ./Caddyfile:/etc/caddy/Caddyfile
      - /path/to/your/certs:/certs # replace it with path to your certs on disk

Replace /path/to/your/certs

---

Create Caddyfile in the same folder with docker-compose.yml:

yourdomain.com {
  reverse_proxy * {
    to app:3000
  }
  tls /certs/yourdomain.crt /certs/yourdomain.key
}

Replace yourdomain.com with your custom domain name (or subdomain).
Replace tls /certs/yourdomain.crt /certs/yourdomain.key with the name of your cert files: /certs is a shared folder in docker which links to the folder with your certs on disk.

---

Run docker-compose up --force-recreate

[uncltom]

I am getting the following log but it doesnt seem to like the cert???

caddy_1 | {"level":"warn","ts":1704846498.698344,"logger":"admin","msg":"admin endpoint disabled"}
caddy_1 | {"level":"info","ts":1704846498.6987474,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"proxy","https_port":443}
caddy_1 | {"level":"info","ts":1704846498.6993117,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"proxy"}
caddy_1 | {"level":"info","ts":1704846498.6992898,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0004e0180"}
caddy_1 | {"level":"info","ts":1704846498.700237,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
caddy_1 | {"level":"info","ts":1704846498.7004993,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
caddy_1 | {"level":"info","ts":1704846498.700744,"logger":"http.log","msg":"server running","name":"proxy","protocols":["h1","h2","h3"]}
caddy_1 | {"level":"info","ts":1704846498.7009437,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
caddy_1 | {"level":"info","ts":1704846498.7010534,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["docuseal.nwautism.org"]}
caddy_1 | Caddy proxying https://docuseal.nwautism.org -> app:3000
caddy_1 | {"level":"warn","ts":1704846498.7036917,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/data/caddy","instance":"41ff3e2f-0231-437b-913b-7cebcf22765d","try_again":1704932898.703688,"try_again_in":86399.999998952}
caddy_1 | {"level":"info","ts":1704846498.703806,"logger":"tls","msg":"finished cleaning storage units"}

[uncltom]

I forgot to remove
command: caddy reverse-proxy --from $HOST --to app:3000 from the docker-compose.yml file.

[uncltom]

Thought... do I have to include the ca-bundle?