I have a containerized application that normally runs behind SSL termination in the cloud. Locally, I would prefer to keep the application serving plain HTTP rather than installing certificates inside the app container. Is there a simple way to put something in front of it that handles HTTPS and forwards requests internally over HTTP? I am fine with browser certificate warnings and do not need a fully trusted certificate.
3 Answers
You can also run a small reverse proxy directly on the host, outside Docker. For example, a simple Node or Express server can accept HTTPS connections and forward them to the container over regular HTTP. You still need some certificate on the proxy, but a self-signed or expired certificate is enough if you are comfortable dismissing the browser warning.
Put a reverse proxy in front of the container and terminate TLS there. Caddy is a straightforward option because it can create a local certificate automatically. The app can stay on an internal Docker network and continue listening on plain HTTP, while Caddy publishes port 443 and proxies requests to something like `app:8080`. Using Caddy's `tls internal` option will usually produce a browser warning unless you install its local CA, which fits your use case. You can also use nginx, Traefik, or HAProxy.
A reverse proxy is still the component that needs the certificate, so SSL cannot be completely certificate-free. However, that lets you keep certificates and TLS configuration out of the application container. For a more production-like local setup, a proxy in a VM or on the network gateway can obtain and renew certificates automatically, though that is more setup than necessary for a simple local test.
For a disposable local environment, a self-signed certificate or an automatically generated local certificate is probably much simpler than setting up public DNS and automated renewal.
That sounds like the cleanest approach. I mainly want the application container to remain unchanged, so having the proxy handle all certificate-related work is ideal.