Create and Apply SSL Certificates for Portainer @i12bretro

Uploaded June 2023 | Updated September 2026, 2 weeks ago

#Portainer #SSL #HTTPS

Full steps can be found at i12bretro.github.io/tutorials/0597.html

Prerequisites
   - A XCA PKI database youtu.be/ezzj3x207lQ

Create Your SSL Certificate
   01. Launch XCA
   02. Open the PKI database if it is not already (File ≫ Open DataBase), enter password
   03. Click on the Certificates tab, right click on your Intermediate CA certificate
   04. Select New
   05. On the Source tab, make sure Use this Certificate for signing is selected
   06. Verify your Intermediate CA certificate is selected from the drop down
   07. Click the Subject tab
   08. Complete the Distinguished Name section
         internalName: ctr.i12bretro.local
         countryName: US
         stateOrProvinceName: Virginia
         localityName: Northern
         organizationName: i12bretro
         organizationUnitName: i12bretro Certificate Authority
         commonName: ctr.i12bretro.local
   09. Click the Generate a New Key button
   10. Enter a name and set the key size to at least 2048
   11. Click Create
   12. Click on the Extensions tab
   13. Select End Entity from the type list
   14. Click Edit next to Subject Alternative Name
   15. Add any DNS or IP addresses that the certificate will identify
   16. Update the validity dates to fit your needs
   17. Click the Key Usage tab
   18. Under Key Usage select Digital Signature, Key Encipherment
   19. Under Extended Key Usage select Web Server and Web Client Authentication
   20. Click the Netscape tab
   21. Select SSL Server
   22. Click OK to create the certificate

Exporting Required Files
   01. In XCA, click on the Certificates tab
   02. Right click the SSL certificate ≫ Export ≫ File
   03. Set the file name to ssl.crt verify the export format is PEM (*.crt)
   04. Click OK
   05. Click the Private Keys tab
   06. Right click the private key generated for the SSL certificate ≫ Export ≫ File
   07. Set the file name to ssl.key and verify the export format is PEM Private (*.pem)
   08. Click OK

Method 1: Applying SSL Certificates to Portainer Web UI
   01. If the Portainer container wasn't setup to listen on 9443, connect to the Docker host and run the following commands
         # list running containers to find the name of the portainer container
         docker ps
         # stop the running portainer container
         docker stop portainer
         # remove the running portainer container
         docker rm portainer --force
         # recreate the portainer container with port 9443
         # modify as needed
         docker run -d -p 8000:8000 -p 9000:9000 -p 9443:9443 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v ~/docker/portainer:/data portainer/portainer-ce
   02. Open a web browser and navigate to http://DNSorIP:9000
   03. Log into Portainer
   04. Click Settings in the left navigation
   05. Scroll to the SSL certificate section
   06. Click Select file under Upload X.509 certificate ≫ Browse to and select the ssl.crt file created earlier
   07. Click Select file under Upload a private key ≫ Browse to and select the ssl.key file created earlier
   08. Click the Apply Changes button
   09. Update the browser URL to https://DNSorIP:9443
   10. Welcome to Portainer running via SSL

Method 2: Applying SSL Certificates to Portainer CLI
   01. Download WinSCP winscp.net/eng/downloads.php
   02. Extract WinSCP and run the executable
   03. Connect to the Portainer host IP address via WinSCP
   04. Copy the exported .pem files to the Portainer host
   05. Connect to the Docker host and run the following commands
         # list running containers to find the name of the portainer container
         docker ps
         # stop the running portainer container
         docker stop portainer
         # remove the running portainer container
         docker rm portainer --force
         # recreate the portainer container with ssl enabled
         # modify as needed
         docker run -d -p 8000:8000 -p 9000:9000 -p 9443:9443 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v ~/docker/portainer:/data portainer/portainer-ce --ssl --sslcert /data/ssl.crt --sslkey /data/ssl.key
   06. Open a web browser and navigate to https://DNSorIP:9443
   07. Welcome to Portainer running via SSL

Further Reading: documentation.portainer.io/v2.0/deploy/ssl

### Connect with me and others ###
★ Discord: discord.com/invite/EzenvmSHW8
★ Reddit: reddit.com/r/i12bretro
★ Twitter: twitter.com/i12bretro

Create and Apply SSL Certificates for Portainer

$Create a Secure Web Based Password Vault with Keepass Web #KeepassWeb #PasswardVault #Linux Full steps can be found at https://i12bretro.github.io/tutorials/0233.html 01. Log into the Debian device 02. Run the following commands in a terminal: # update repositories and install any available software updates sudo apt update sudo apt upgrade # install apache2 sudo apt install apache2 # download and extract keepass web wget https://github.com/keeweb/keeweb/archive/gh-pages.zip sudo unzip gh-pages.zip -d /var/www/html/ sudo mv /var/www/html/keeweb-gh-pages /var/www/html/keepass # create webdav directory and set permissions sudo mkdir /var/www/html/webdav sudo chown -R www-data:www-data /var/www/html/webdav # change permissions on the newly setup application folder sudo chown -R www-data:www-data /var/www/html/keepass # create a new keepass.conf file to configure the site sudo nano /etc/apache2/sites-available/keepass.conf 03. Paste the following directives into keepass.conf DavLockDB /var/www/html/webdav/DavLock ≪Location /keepass ≫ RewriteEngine on RewriteCond %{REQUEST_METHOD} OPTIONS RewriteRule ^(.*)$ blank.html [R=200,L,E=HTTP_ORIGIN:%{HTTP:ORIGIN}] # Dont require LDAP authentication for a healthcheck SetEnvIf Request_URI ^/healhcheck accessgranted=1 Order deny,allow Satisfy any Deny from all Allow from env=accessgranted AuthType Basic AuthBasicProvider ldap AuthLDAPURL ldap://i12bretro.local:389/DC=i12bretro,DC=local?sAMAccountName?sub?(objectClass=user) NONE AuthLDAPBindDN readonly_svc@i12bretro.local AuthLDAPBindPassword Read0nly!! AuthName Restricted Area [i12bretro.local] # to authenticate a domain group, specify the full DN AuthLDAPGroupAttributeIsDN on require ldap-group CN=WebAuthAccess,CN=Users,DC=i12bretro,DC=local ≪/Location≫ ≪Location /webdav≫ DAV On AuthType Basic AuthName webdav Options Indexes Header always set Access-Control-Allow-Origin * Header always set Access-Control-Allow-Headers origin, content-type, cache-control, accept, authorization, if-match, destination, overwrite Header always set Access-Control-Expose-Headers ETag Header always set Access-Control-Allow-Methods GET, HEAD, POST, PUT, OPTIONS, MOVE, DELETE, COPY, LOCK, UNLOCK Header always set Access-Control-Allow-Credentials true ≪/Location≫ 04. Edit the index.html file and modify the kw-config meta tag, setting the value to config.json # sudo nano /var/www/html/keepass/index.html 05. Press CTRL+O, Enter, CTRL+X to write the changes to index.html 06. Create and edit config.json to by running the following command: sudo nano /var/www/html/keepass/config.json 07. Paste the following in to config.json { settings: { theme: fb, autoSave: true, autoSaveInterval: 1, canOpenDemo: false, dropbox: false, gdrive: false, onedrive: false, canExportXml: true }, files: [{ storage: webdav, name: Database, path: /webdav/database.kdbx }] } 08. Press CTRL+O, Enter, CTRL+X to write the changes to config.json 09. Continue by executing the following commands in terminal: # enable the keepass site and required Apache modules sudo a2ensite keepass sudo a2enmod dav dav_fs ldap authnz_ldap rewrite headers # restart apache2 service for the changes to take effect sudo systemctl restart apache2 10. Open a web browser and navigate to http://DNSorIP/keepass 11. Authenticate with a valid LDAP user account 12. Click the New icon 13. Click the New link in the lower left hand corner 14. Enter a Master password and re-type it to confirm 15. Enter a Name for the keepass database 16. Click the Save to... button ≫ File 17. Save the database to ~/database.kdbx 18. Close the browser 19. Continue by executing the following commands in terminal: # copy the keepass database to webdav directory sudo mv ~/database.kdbx /var/www/html/webdav/ 20. Open a web browser and navigate to http://DNSorIP/keepass ....Full steps can be found on GitHub [link at the top] ### Connect with me and others ### ★ Discord: https://discord.com/invite/EzenvmSHW8 ★ Reddit: https://reddit.com/r/i12bretro ★ Twitter: https://twitter.com/i12bretro$ $Monitor Docker Container Resource Usage with cAdvisor #cAdvisor #Docker #Monitoring Full steps can be found at https://i12bretro.github.io/tutorials/0828.html What is cAdvisor? cAdvisor (Container Advisor) provides container users an understanding of the resource usage and performance characteristics of their running containers. It is a running daemon that collects, aggregates, processes, and exports information about running containers. - https://github.com/google/cadvisor Installing Docker 01. Log into the Linux based device 02. Run the following commands in the terminal # install prerequisites sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y # add docker gpg key curl -fsSL https://download.docker.com/linux/$(awk -F= /^ID=/{ print $NF } /etc/os-release)/gpg | sudo apt-key add - # add docker software repository sudo add-apt-repository deb [arch=$(dpkg print-architecture)] https://download.docker.com/linux/$(awk -F= /^ID=/{ print $NF } /etc/os-release) $(lsb_release -cs) stable # install docker sudo apt install docker-ce docker-compose containerd.io -y # enable and start docker service sudo systemctl enable docker && sudo systemctl start docker # add the current user to the docker group sudo usermod -aG docker $USER # reauthenticate for the new group membership to take effect su - $USER Running the cAdvisor Container 01. Now that Docker is installed, run the following commands to setup the cAdvisor Docker container and run it # run the cadvisor container sudo docker run -d name=cadvisor -p 8080:8080 -v /:/rootfs:ro -v /var/run:/var/run:ro -v /sys:/sys:ro -v /var/lib/docker/:/var/lib/docker:ro -v /dev/disk/:/dev/disk:ro privileged device=/dev/kmsg restart=unless-stopped gcr.io/cadvisor/cadvisor 02. Open a web browser and navigate to http://DNSorIP:8080 03. Welcome to cAdvisor Documentation: https://hub.docker.com/r/google/cadvisor ### Connect with me and others ### ★ Discord: https://discord.com/invite/EzenvmSHW8 ★ Reddit: https://reddit.com/r/i12bretro ★ Twitter: https://twitter.com/i12bretro$ $Run HomeDash - Server MonitorDashboard - on Linux #Homedash #Dashboard #Linux Full steps can be found at https://i12bretro.github.io/tutorials/0904.html What is Homedash? HomeDash is a simple dashboard that allows to monitor and interact with many different services in order to have a single entry point for ones dedicated server via a set of Plugins. Its easy to install, setup and use. - https://lamarios.github.io/Homedash2/ Installing Java and Maven 01. Log into the Linux based device 02. Run the following commands in the terminal # update software respositories sudo apt update # install available software updates sudo apt upgrade -y # install java and maven sudo apt install default-jdk maven -y # check java version java version # check maven version mvn -version Running HomeDash 01. Now that Java and Maven are installed, run the following commands to run HomeDash # create working directories sudo mkdir /opt/homedash2 -p # set owner of working directories sudo chown $USER:$USER /opt/homedash2 -R # change directory to the new folder cd /opt/homedash2 # lookup latest homedash jar URL regex=browser_download_url: (https://github.com/lamarios/Homedash2/releases/download/[^/]*/Homedash-[^/]*.jar) && response=$(curl -H Accept: application/vnd.github.v3+json https://api.github.com/repos/lamarios/Homedash2/releases/latest) && [[ $response =~ $regex ]] && downloadURL=${BASH_REMATCH[1]} # download the latest release wget -O ./homedash.jar $downloadURL # generate a config file java -jar ./homedash.jar -create-config # run homedash java -Dconfig.file=/opt/homedash2/homedash.properties -jar homedash.jar 02. Open a web browser and navigate to http://DNSorIP:4567 03. Welcome to HomeDash Documentation: https://github.com/lamarios/HomeDash2 ### Connect with me and others ### ★ Discord: https://discord.com/invite/EzenvmSHW8 ★ Reddit: https://reddit.com/r/i12bretro ★ Twitter: https://twitter.com/i12bretro$

Install MeshCentral - Remote Management Site - on Linux

Install SolidInvoice - Open Source Invoicing Software - on Windows

Running a Windows Server 2025 VM in Proxmox VE

$Run Lychee - Photo Management System - in Docker #Lychee #PhotoManagemer #Docker Full steps can be found at https://i12bretro.github.io/tutorials/0938.html What is Lychee? Lychee is a free photo-management tool, which runs on your server or web-space. Installing is a matter of seconds. Upload, manage and share photos like from a native application. Lychee comes with everything you need and all your photos are stored securely. - https://lycheeorg.github.io/ Installing Docker 01. Log into the Linux based device 02. Run the following commands in the terminal # install prerequisites sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y # add docker gpg key curl -fsSL https://download.docker.com/linux/$(awk -F= /^ID=/{ print $NF } /etc/os-release)/gpg | sudo apt-key add - # add docker software repository sudo add-apt-repository deb [arch=$(dpkg print-architecture)] https://download.docker.com/linux/$(awk -F= /^ID=/{ print $NF } /etc/os-release) $(lsb_release -cs) stable # install docker sudo apt install docker-ce docker-compose containerd.io -y # enable and start docker service sudo systemctl enable docker && sudo systemctl start docker # add the current user to the docker group sudo usermod -aG docker $USER # reauthenticate for the new group membership to take effect su - $USER Running Lychee 01. Continue with the following commands in a terminal window # list current uid and gid, note these for later id $user # create working directories mkdir ~/docker/lychee/{conf,uploads,sim} -p && mkdir ~/docker/mariadb -p # set ownership on the working directories sudo chown $USER:$USER ~/docker -R # create containers network docker network create containers # run the mariadb docker container docker run -d name mariadb network containers -e MYSQL_ROOT_PASSWORD=r00tp@$$ -e MYSQL_USER=lychee_rw -e MYSQL_PASSWORD=Lych33! -e MYSQL_DATABASE=lychee -v ~/docker/mariadb:/var/lib/mysql -p 3306:3306 restart=unless-stopped mariadb:latest # run the lychee docker image # replace PUID, GUID with the output of the id $user command above docker run -d name lychee network containers -e PUID=1000 -e PGID=1000 -e TZ=America/New_York -e PHP_TZ=America/New_York -e DB_CONNECTION=mysql -e DB_HOST=mariadb -e DB_PORT=3306 -e DB_USERNAME=lychee_rw -e DB_PASSWORD=Lych33! -e DB_DATABASE=lychee -p 8090:80 -v ~/docker/lychee/conf:/config -v ~/docker/lychee/uploads:/uploads -v ~/docker/lychee/sym:/sym restart=unless-stopped lycheeorg/lychee 02. Open a web browser and navigate to http://DNSorIP:8090 03. Click Next at the Lychee welcome screen 04. Click Next at the Requirements Check 05. Click Next at the Permissions Check 06. Update at least the following values in the APP_URL=http://DNSorIP:8090 DB_CONNECTION=mysql DB_HOST=mariadb DB_PORT=3306 DB_DATABASE=lychee DB_USERNAME=lychee_rw DB_PASSWORD=Lych33! 07. Click Save ≫ Click Install 08. Once the installation completes click Set up admin account 09. Enter a Username ≫ Enter and confirm a Password ≫ Click Create admin account 10. Click Open Lychee 11. Login using the username and password setup earlier 12. Welcome to Lychee Documentation: https://lycheeorg.github.io/docs/#installation ### Connect with me and others ### ★ Discord: https://discord.com/invite/EzenvmSHW8 ★ Reddit: https://reddit.com/r/i12bretro ★ Twitter: https://twitter.com/i12bretro$ $Run miniPaint - Browser Based Image Editor - in Docker #miniPaint #ImageEditor #Docker Full steps can be found at https://i12bretro.github.io/tutorials/0896.html What is miniPaint? [miniPaint is an] online image editor lets you create, edit images using HTML5 technologies. No need to buy, download, install or have obsolete flash. No ads. Key features: layers, filters, HTML5, open source, Photoshop alternative. miniPaint operates directly in the browser. You can create images, paste from the clipboard (ctrl+v) or upload from the computer (using menu or drag & drop). Nothing will be sent to any server. Everything stays in your browser. - https://github.com/viliusle/miniPaint Installing Docker 01. Log into the Linux based device 02. Run the following commands in the terminal # install prerequisites sudo apt install apt-transport-https ca-certificates git curl software-properties-common gnupg-agent -y # add docker gpg key curl -fsSL https://download.docker.com/linux/$(awk -F= /^ID=/{ print $NF } /etc/os-release)/gpg | sudo apt-key add - # add docker software repository sudo add-apt-repository deb [arch=$(dpkg print-architecture)] https://download.docker.com/linux/$(awk -F= /^ID=/{ print $NF } /etc/os-release) $(lsb_release -cs) stable # install docker sudo apt install docker-ce docker-compose containerd.io -y # enable and start docker service sudo systemctl enable docker && sudo systemctl start docker # add the current user to the docker group sudo usermod -aG docker $USER # reauthenticate for the new group membership to take effect su - $USER Running miniPaint 01. Now that Docker is installed, run the following commands to setup the miniPaint Docker container and run it # increase fs.inotify.max_user_watches echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf # reload and verify the change sudo sysctl -p # create working directory mkdir ~/docker/miniPaint -p # clone source code from github git clone https://github.com/viliusle/miniPaint.git ~/docker/miniPaint # change directory cd ~/docker/miniPaint # checkout the latest tagged release git checkout $(git tag sort=v:refname | tail -n1) # edit webpack.config.js sudo nano webpack.config.js 02. Scroll to the bottom of the file and locate devServer, then add the following line inside the devServer block allowedHosts: all, 03. Press CTRL+O, Enter, CTRL+X to write the changes and exit 04. Continue with the following commands in the terminal # create a dockerfile sudo nano ./Dockerfile 05. Paste the following into Dockerfile FROM node:16-alpine WORKDIR /usr/src/app COPY package*.json ./ RUN npm i COPY . . EXPOSE 8080 CMD [npm, run, server] 06. Press CTRL+O, Enter, CTRL+X to write the changes and exit 07. Continue with the following commands in the terminal # build the minipaint image docker build -t local/minipaint . # run minipaint container docker run -d name=minipaint -p 8080:8080 restart=unless-stopped local/minipaint 08. Open a web browser and navigate to http://DNSorIP:8080 09. Welcome to miniPaint running in Docker Source: https://github.com/viliusle/miniPaint/wiki/Docker ### Connect with me and others ### ★ Discord: https://discord.com/invite/EzenvmSHW8 ★ Reddit: https://reddit.com/r/i12bretro ★ Twitter: https://twitter.com/i12bretro$

Install AdGuard Home - Cross Platform Pi Hole Alternative - on Raspberry Pi 4