[SOLVED] A question about function domain certificates

[solemn sinew]

Are certificates generated for the autogenerated domains for functions? In the appwrite console, the cert status is generated. However, monitoring the appwrite-worker-certificates there were no logs of the certs being generated. The Functions docs about certificates were also largely refering to the main domain.
My setup: I have a wildcard DNS record on cloudflare for functions (without certs 2nd level subdomain) which is not proxied through cloudflare because of SSL mismatch. I thought since SSL certs are generated by appwrite for the functions it would be 'okay' to access them directly for but the generated function domains are not.

[coral idol]

No Appwrite doesn't actually generate the auto function domain. Cloudflare should be able to handle it all. You may need to enable flexible SSL certificates or something like that in cloudflare

[solemn sinew]

With flexible SSL certs the console fails to load because of 'too many redirects' which seems to be as a result of appwrite's autogenerated cert for _APP_DOMAIN.

[coral idol]

NVM it should be full, but not strict

[solemn sinew]

That's what it is currently

[coral idol]

Wait I'm confused about your setup...do you have certs on cloudflare?

[solemn sinew]

Cloudflare's free tier provides free SSL certs for the root domain and any first level subdomains. That is;
mydomain.com ----> OK
appwrite.mydomain.com ------> OK
sample.appwrite.mydomain.com -----> N/A on free tier

and my functions DNS entry is *.appwrite.mydomain.com which makes all generated function domains e.g. func1.appwrite.mydomain.com not available for SSL certs when proxied through cloudflare and also results in ERR_SSL_VERSION_OR_CIPHER_MISMATCH error when accessing functions via the url. So my thinking was if appwrite's traefik service generates SSL certs for the functions then it'll still be 'secure' even when it's not proxied through cloudflare but the function domains are not "secured".

The reason I thought it'd work is because the SSL generated by appwrite's traefik service still works for the _APP_DOMAIN i.e. appwrite.mydomain.com even when the DNS record is not proxied through cloudflare. I thought it'd be the same for functions

[coral idol]

I see so you're not using cloudflare's certificate

[coral idol]

Appwrite doesn't generate certificates for auto generated function domains

You can either manually generate it or configure traefik to generate the certificate.

Maybe this will help: https://doc.traefik.io/traefik/https/acme/

[solemn sinew]

I had hoped that wasn't the case I really don't want to modify the default compose file.

I had already planned to have another separate Traefik service proxying to appwrite and my other services maybe it's time to revisit it

Thanks Steve

[coral idol]

I don't suggest modifying the existing compose file. Instead, extend services using a docker-compose.yml file

[coral idol]

I've used nginx proxy manager (NPM) in front of Appwrite and NPM can be configured to generate those let's encrypt certificates

[solemn sinew]

I actually initially tried nginx (not NPM) but switched to traefik because it seemed easier and also to learn more about it since that's what appwrite uses in case I need to heavily customize it. Thus, I haven't really given NPM much thought even though I now realize it's also easy (maybe more so than traefik)

[solemn sinew]

Thanks, I'll try that. If there's no success I go with NPM

[solemn sinew]

[SOLVED] A question about function domain certificates

[heavy parrot]

This is what I do now, but I’m thinking about moving away from Traefik

[solemn sinew]

I'm still trying to get it to work. Do you mind sharing how you got it to work?

A question about function domain certificates

[heavy parrot]

Will do if I remember next time I’m at the computer. Will probably be tomorrow sometime

[solemn sinew]

All right, thanks

[solemn sinew]

[SOLVED] A question about function domain certificates

[heavy parrot]

@solemn sinew Sorry I never got around to it! Did you figure it out?