Dokploy / Dokploy/dokploy

Support for Cloudflare Origin CA certificates in Dokploy

Open
#1,839 22 comments 22 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
37.4k
Forks
3k
Avg merge
1d 3h
Merged PRs (30d)
73

Description

What problem will this feature address?

Currently, Dokploy only supports Let's Encrypt for SSL certificates. When using Cloudflare in Full (Strict) mode, we need to install Cloudflare Origin CA certificates on the server. This process is manual and prone to breaking during Dokploy updates.

Describe the solution you'd like

I would like Dokploy to natively support Cloudflare Origin CA certificates alongside Let's Encrypt. This would allow users to:

  1. Upload/paste their Cloudflare Origin CA certificate and private key in the Dokploy UI
  2. Select "Cloudflare Origin CA" as a certificate option when configuring domains
  3. Automatically configure Traefik to use these certificates
  4. Maintain the configuration across Dokploy updates
Describe alternatives you've considered

I've researched the following potential alternatives, although I haven't implemented them personally:

  1. Manual configuration: Configuring Traefik directly by modifying Docker service definitions and mounting certificate files. This approach seems functional but likely breaks during Dokploy updates and requires advanced technical knowledge.

  2. Cloudflare Tunnels: This eliminates the need for origin certificates by establishing a secure tunnel between Cloudflare and the origin server. However, this adds complexity and potential dependencies on Cloudflare's infrastructure.

  3. Using Full mode instead of Full (Strict): This is a simpler but less secure alternative that doesn't validate origin certificates. It doesn't provide the same security guarantees as Full (Strict) mode.

  4. Custom deployment scripts: Creating scripts to reinstall certificate configurations after Dokploy updates. This would be a brittle solution requiring maintenance with each Dokploy release.

Additional context

Many users deploy their applications behind Cloudflare for enhanced security and performance. The Full (Strict) SSL mode in Cloudflare requires a trusted certificate on the origin server, and Cloudflare provides free Origin CA certificates for this purpose.

Currently, the workaround involves manually configuring Traefik and mounting certificate files, which is complex and breaks during updates.

Will you send a PR to implement it?

Maybe, need help

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the certificate and domain configuration flow in the Dokploy UI, then trace how Traefik configuration and Docker service definitions are generated and persisted. Define how certificate and private-key data is stored, selected, applied, and preserved across updates. Done means users can configure Cloudflare Origin CA certificates without manual Traefik changes and retain them after an update.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, typescript
Domain
cloud, devops, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.