Configure my own Let's Encrypt certificate

[diegolovison]

The instructions below is how I am deploying my self-hosted ShellHub instance on my own server.

git clone -b v0.17.1 https://github.com/shellhub-io/shellhub.git
cd shellhub
export SHELLHUB_SSH_PORT=2222
export SHELLHUB_HTTP_PORT=8080
export SHELLHUB_HTTPS_PORT=8433
make start

Now, I wish to configure my own Let's Encrypt certificate. What should I do?

I read https://docs.shellhub.io/self-hosted/deploying#enable-https but wasn't able to understand. Once I have it working I can help and improve the documentation.

Thanks

[gustavosbarreto]

@diegolovison Hi! I noticed you are deploying ShellHub using version v0.17.1. I recommend upgrading to the latest version, as it includes important improvements and bug fixes

[gustavosbarreto]

Ok. I can do it, but I need to know first how to "Configure my own Let's Encrypt certificate".

You need to set SHELLHUB_DOMAIN to your domain and SHELLHUB_AUTO_SSL=true in the .env.override file.

[diegolovison]

Yes. But this will create a certificate automatically, right? What I need is to set my own certificate.

[gustavosbarreto]

Yes. But this will create a certificate automatically, right? What I need is to set my own certificate.

May I ask why you don’t want to use the certificate generated by ShellHub? It uses Certbot under the hood, so you don’t need to worry about renewal because Certbot handles that for you.
If you really want to use your own certificate, I suggest putting another HTTP proxy in front of ShellHub’s HTTP port. This is similar to what we do in ShellHub Cloud with a Kubernetes Ingress Controller.

[diegolovison]

My own method always generates the certificate on the same path. How about ShellHub? Will it always generate on the same path? In this case, ShellHub can be my source of truth.

[gustavosbarreto]

My own method always generates the certificate on the same path. How about ShellHub? Will it always generate on the same path? In this case, ShellHub can be my source of truth.

This can be achieved by mounting a bind volume in the gateway service. As described in the docs, you can use docker-compose.override.yml to extend or override service options. For example:

# docker-compose.override.yml
version: "3.7"

services:
  gateway:
    volumes:
      - /srv/letsencrypt:/etc/letsencrypt

With this configuration, the certificates generated by ShellHub inside the container will be stored in /srv/letsencrypt on the host.