Certificates

A node serves a self-signed certificate on first start, and a cluster-CA-issued one once it joins a cluster. Neither is publicly trusted, so for a browser that does not complain you need real certificates.

Status: shipped. ACME DNS-01 and pasted certificates both work; this page covers both.

ACME over DNS-01#

Configure it under Settings → Certificates: the ACME provider, and credentials for your DNS provider. Each node then issues and renews <node>.<domain> for itself.

You need an A record per node. LAN-only records are fine, since the challenge is a public TXT record rather than a reachable web server. But you must then browse to the node by name, because a certificate cannot cover a raw address.

Certificates you manage yourself#

Paste them per node under Nodes → Network → HTTPS certificate. That node then skips ACME entirely.

Certificate files named in /etc/proxdock/config.yml are still honoured and take priority over both, which is the way to provision a node before it has a UI to configure.

Every source hot-reloads on change, so an external renewal process needs no restart and no hook.

Certificates for applications#

An application can be issued a certificate of its own and have it mounted read-only into the container.

To be written: the mount path, the file names, and what the application has to do to pick up a renewal.