add self-signed TLS for *.homelab.fhirworx.io

Browser (Firefox) auto-upgrades to HTTPS on .io domains. Without a
cert, Traefik accepted the TCP connection on :443 but couldn't do
TLS handshake, causing a blank page.

- Generate 10-year self-signed wildcard cert for *.homelab.fhirworx.io
- Mount certs into Traefik container
- Add TLS routers (websecure entrypoint) mirroring all HTTP routers
- Add traefik/dynamic/tls.yml with default certificate store

Import ~/homelab-ca.crt into Firefox: Settings → Privacy → Certificates
→ Authorities → Import → Trust for websites.

compose.yml

@@ -35,6 +35,7 @@ services:
     volumes:
       - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ./traefik/dynamic:/etc/traefik/dynamic:ro
+      - ./traefik/certs:/etc/traefik/certs:ro
       - ./traefik/plugins:/plugins-local:ro
     environment:
       - DOMAIN=${DOMAIN:-homelab.fhirworx.io}

traefik/certs/homelab.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIUKMP/c0vrAZp+UTKNAu4cUYUzl64wDQYJKoZIhvcNAQEL
+BQAwIDEeMBwGA1UEAwwVKi5ob21lbGFiLmZoaXJ3b3J4LmlvMB4XDTI2MDMyMTIw
+MjAwN1oXDTM2MDMxODIwMjAwN1owIDEeMBwGA1UEAwwVKi5ob21lbGFiLmZoaXJ3
+b3J4LmlvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA19ujW/VKqeqY
+jBbjcKa2jUSz5VY+3H3R0G1si2e9x9tICgy2bC738YYTphl1ScjPBQJtFkjJEmcg
+CeIGNBXM03mGgfagb7VhPN8KdRrOKu4x/FCmCeRjit1haMniQRIdo5VfbQRvzH30
+zik5pAmezizEOfSrQlU26u3pGga30YaZoKd32/WJ2JDo80sNWfAZd7jDx/ND97bw
+T1KM9aK/JCjEQkuvtScUX4YbQylWYye5fikRpEgyqRN98i1a3eFgTbd+yWFTTSPg
+29/FaCAe+LKHCcFo2jaNtSLk9bK9fGyCKkjaRhVWgHChHQ8uzO9yzRM4g81u7YdN
+Oa0lZs9LpQIDAQABo4GLMIGIMB0GA1UdDgQWBBSgCqYJcKDdr6kp6Ltf7GBGLNB7
+xTAfBgNVHSMEGDAWgBSgCqYJcKDdr6kp6Ltf7GBGLNB7xTAPBgNVHRMBAf8EBTAD
+AQH/MDUGA1UdEQQuMCyCFSouaG9tZWxhYi5maGlyd29yeC5pb4ITaG9tZWxhYi5m
+aGlyd29yeC5pbzANBgkqhkiG9w0BAQsFAAOCAQEAb1OzTg2sRJTOmhgL/QSDiud+
+nDVCSRy9PzZzU8uoxruA68Pgnc21HnEwfd7vHGR58uE4ZNaRWz1LqX78BN8u3Xbx
+ZiS8zZAg+z+Xwxi6iNk9CFRVq+vUah/Fdm4bolGpUtKIaO79gxeNB+px16mFokAu
+biTIxwaFXSL/PnKLNCdILcH/iSmvYxSyZVPl7sI9cepyevu8yqZfvQzhOAt1G0mB
+gbkkyNYJKZ3nnrpL4IxOdooD64kn0D3Bc3GDnWBE8gYTI7JW2Upv/LqIvP0NNUxn
+SShTkrTUVLu+/Dpzcj+gtaXV218s+/TORpndGOArtszF3ZK7cQba+M+R7bX55g==
+-----END CERTIFICATE-----

traefik/certs/homelab.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDX26Nb9Uqp6piM
+FuNwpraNRLPlVj7cfdHQbWyLZ73H20gKDLZsLvfxhhOmGXVJyM8FAm0WSMkSZyAJ
+4gY0FczTeYaB9qBvtWE83wp1Gs4q7jH8UKYJ5GOK3WFoyeJBEh2jlV9tBG/MffTO
+KTmkCZ7OLMQ59KtCVTbq7ekaBrfRhpmgp3fb9YnYkOjzSw1Z8Bl3uMPH80P3tvBP
+Uoz1or8kKMRCS6+1JxRfhhtDKVZjJ7l+KRGkSDKpE33yLVrd4WBNt37JYVNNI+Db
+38VoIB74socJwWjaNo21IuT1sr18bIIqSNpGFVaAcKEdDy7M73LNEziDzW7th005
+rSVmz0ulAgMBAAECggEAE1KylEW1IHI2cK5cP6MOfj8gGYLeD4MZEd7rYHlYPriH
+Aa5/2aReU4BTAin1dJyL+uDr0gEqNFvUVuSLjwSqkf3ArqHcwwZwhQn0V8vr/vs7
+fa12ITZd1AcB55o27YGvjIuPf/6HLlee+NUtt0NmZ2kQS2qqUAuGMunUPAO0JDna
+joLEm0fgWkiJXq7V8pEg3bn8GSWiMxnZeA6EYJT1CG90tDpLUc4f4qPvjWVetW4m
+vlq0cB6JoE3cB5woQSaR/aCHX0D3Pbhz7UiIcmstQ6mwe5hnogO6VmsRAVjOIrph
+Qn7qpI4yKxKezOMIM1Dh2EGYVgVhlP8wN1pzX/1A+wKBgQD0qgMn/PxAAHE00B16
+dGj25BYc/ih5r19TXAp6hgJfFWaWL60ESrFNGXKAxa67/PJoWGth8ev842zqkfj9
+Yg5S09yceyXnBFjJnjSkuY8QK0ZLEZKHcK8UosWR1Y/bBOS+JL5raQLdC4vDlWiz
+DQTiUeroAK1v3jjxS0K8C8elWwKBgQDh2/PyeFniXyXFaGFa/6Unv+JwDdh8Sk3A
+rMicBDJ8WgSpiHoGupQTTFDMkMl0EJ4mR3Bjvzvh5tGyBvKLxuLdU/lBOUAOr3uC
+cK5LWNeqibpNODBqT5tP33RBJHtiQPrq5wkozXmUyG1XxHXP7iz4tobsG/JW+FZb
+ZshxGEqi/wKBgQDSds1wQLfddoProns5M5p3h41eM2QuCSY/VxXMgCraEFbHKwvy
+fS433IQbMfI11EnSaP02rB0M1baDsj41+XvI1GcaVPUt3RdjmKxAZz8h8ZfuS5d4
+2v5BCiRaZxPwnC0JRCJp01ObQqtf+86s964T4dPo72xCpy7kopEtohSDsQKBgQCo
+r3EkD/T52BxKsum7YCHGbU6+Z+je81Pc6m8t7wiRzV2cDP0uV11OiHn0PtLm555m
+coajSOl9j7nf38Z41MMNkLEhoJOSJEf3pRbX2XPBv/mvwJ6QWAJkhjy6hnfMa0G7
+/W/e1I/QqlzX5zgiYv2diB1+7GRzxighPcPIi976mwKBgAmFsr+8G9Rtz891Em+w
+D8dPFAdZYBg9aSSYjJd7+22l5CWf40DYcdlU34JfK3mT8s17UMGfBYJnA8IHLfJ9
+cHn9y6HInuxs1bydNplRCGJjLNBWTyXNZeCUNAosn9vSM7r6/TAidtQHEupWmniE
+K3vJ+OiqlumDDbQ1A12tf4EW
+-----END PRIVATE KEY-----

traefik/dynamic/services.yml

@@ -65,6 +65,18 @@ http:
         - {{ . }}
         {{- end }}
       {{- end }}
+    {{ $name }}-tls:
+      rule: "Host(`{{ get $svc "subdomain" | default $name }}.{{ $domain }}`){{ range get $svc "extra_hosts" | default list }} || Host(`{{ . }}`){{ end }}"
+      service: {{ $name }}
+      entryPoints:
+        - websecure
+      tls: {}
+      {{- if $mwList }}
+      middlewares:
+        {{- range $mwList }}
+        - {{ . }}
+        {{- end }}
+      {{- end }}
     {{- end }}
     {{- range $name, $svc := $multi }}
     {{ $name }}:
@@ -82,6 +94,18 @@ http:
         - {{ . }}
         {{- end }}
       {{- end }}
+    {{ $name }}-tls:
+      rule: "Host(`{{ get $svc "subdomain" }}.{{ $domain }}`)"
+      service: {{ $name }}
+      entryPoints:
+        - websecure
+      tls: {}
+      {{- if $mwList }}
+      middlewares:
+        {{- range $mwList }}
+        - {{ . }}
+        {{- end }}
+      {{- end }}
     {{- end }}
     traefik-dashboard:
       rule: "Host(`traefik.{{ $domain }}`)"
@@ -92,6 +116,16 @@ http:
         - inject-loch
         - local-only
         - infra-headers
+    traefik-dashboard-tls:
+      rule: "Host(`traefik.{{ $domain }}`)"
+      service: api@internal
+      entryPoints:
+        - websecure
+      tls: {}
+      middlewares:
+        - inject-loch
+        - local-only
+        - infra-headers
   services:
     {{- range $name, $svc := $reef }}
     {{ $name }}:

traefik/dynamic/tls.yml

@@ -0,0 +1,9 @@
+tls:
+  certificates:
+    - certFile: /etc/traefik/certs/homelab.crt
+      keyFile: /etc/traefik/certs/homelab.key
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /etc/traefik/certs/homelab.crt
+        keyFile: /etc/traefik/certs/homelab.key