Multiple domains and certificates

[frenkel]

I have a number of domains that can get certificates through Let's Encrypt, a wildcard certificate from another Certificate Authority. My understanding is I won't be able to deploy this as one Kamal application. Is that correct? Or is there some trick to deploy the same appplication once, but with different certificates?

I think the following commands would need to be run by kamal:

kamal-proxy deploy service1 --target web-1:3000 --host something.com --tls
kamal-proxy deploy service2 --target web-1:3000 --host somethingelse.com --tls --tls-certificate-path cert.pem --tls-private-key-path key.pem

[rogerheykoop]

You can.
Just try something like this in your proxy settings, but it will request a new certificate for you through letsencrypt.

proxy:
ssl: true
hosts:
- something.com
- somethingelse.com

[frenkel]

Thanks, but for wildcard certificates that’s not possible. I nees the combination of with and without automatic certificates.

[yaKashif]

Having a wildcard host option by default is a good feature for tonnes of mult-tenant apps

proxy:
  ssl: true
  hosts:
    - something.com
    - somethingelse.com
    - *.somethingelse.com

[yaKashif]

Seems like basecamp/kamal-proxy#45 works towards that but without auto ssl

[viktorianer]

And here in Kamal #969

[frenkel]

I think this can be achieved by running kamal-proxy deploy <new deployed container> with the correct arguments for the other domains. Would it be possible to run this with a hook? post-deploy seems too late (small window where old container is missing), and pre-deploy will probably not have the new container available yet.

[frenkel]

I think this is a viable solution: #1091 (comment)
It will generate a name that is kept between deploys so you can manually start kamal-proxy with different certificates/settings and point it to that name.

[viktorianer]

If it works great, but why I should start kamal-proxy manually?! Kamal is responsible to do this for me.

[frenkel]

Yes, you'll have to add some features to Kamal if you don't want to manually do this. I don't have the time and knowledge to add it, so this workaround is fine for me. It's a one time command I need to run on every server.

[frenkel]

By the way, if you want to make it part of you configuration/repo you can probably run it as a kamal hook.

[viktorianer]

Yes, you'll have to add some features to Kamal if you don't want to manually do this. I don't have the time and knowledge to add it, so this workaround is fine for me. It's a one time command I need to run on every server.

Yes, me too. But, likely, people are working in this feature already 👍🏼. I linked it 3 weeks ago, just above your comment :).

[frenkel]

Yes, I saw. Hasn't been touched in 2 months so I started looking for workarounds. Thanks!