How can I enable https for container instance on Azure

[rodneytamblyn]

Further to https://docs.datalust.co/docs/using-azure-container-instances-aci

Can someone clarify how to enable https?

Rod

[liammclennan]

Hi @rodneytamblyn

See https://docs.datalust.co/docs/https-tlsssl

[rodneytamblyn]

Thanks Liam,

I'll give this a go and report back.

Is it a required step to enable SSH for SEQ to work? If so, should the page above (container instance setup) be updated to include this URL as last step - either via az commands or .... now you've got your container instance going you must enable SSH by following these instructions.

Rod

[liammclennan]

Hi Rodney,

SSL is not required. It is entirely up to your own security requirements.

[tomasautonet]

You can use caddy as a sidecar container to enable https. Like they do here: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-group-automatic-ssl

I did this with pulumi and it was super easy to get it up and running.
/Tomas

[rodneytamblyn]

Hi Tomas, this looks like exactly what is needed. I am going to have a go at getting this working with SEQ in azure container instance and will report back.

[rodneytamblyn]

I have successfully deployed Seq as a container group in Azure container instances with Caddy as an automated https sidecar (using Letsencrypt to issue cert). If there is interest I can post my instructions and sample YAML for how to do this.

[KodrAus]

Glad you got everything working @rodneytamblyn! I'll add a note to our docs page there on terminating SSL on a reverse proxy as one deployment option for serving Seq over HTTPS.

[rodneytamblyn]

Would a sample YAML file for the container group be useful? If so I will add here. Rod

…

-- Rodney Tamblyn Co- Founder & CEO | OceanBrowser Ltd +64 34742102 | @ocnb3 https://nz.linkedin.com/in/rodneytamblyn Beautiful study for lifelong learning http://www.ob3.io

On Mon, Apr 15, 2024, at 10:15 AM, Ashley Mannix wrote: Glad you got everything working @rodneytamblyn <https://github.com/rodneytamblyn>! I'll add a note to our docs page there on terminating SSL on a reverse proxy as one deployment option for serving Seq over HTTPS. — Reply to this email directly, view it on GitHub <#2148 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAL5STDT4CFHH552SIIL4GDY5L5XVAVCNFSM6AAAAABFQCMF22VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TCMJRGYZTK>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[nblumhardt]

Definitely could help someone else on the same path 👍 - thanks Rodney!

[rodneytamblyn]

Here is a YAML template for anyone wanting to serve Seq with Caddy as HTTPS sidecar (auto cert issue with Letsencypt)

For Caddy setup, see: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-group-automatic-ssl

Note the examples are a little old. For share create I used something like:

az storage share-rm create \
  --name proxy-caddyfile \
  --resource-group MYRESOURCEGROUP \
  --storage-account MYSTORAGEACCOUNT \
  --output none

• the page omits ( I think) an important step which is to copy your Caddyfile to the Azure share container. You can do this using the Storage Browser in Azure portal Storage account (or via az command line if you know how):
  

Notes:

• Once you've got all your storage containers and Caddy config setup, you can start your containers using the following YAML, just update the bits in bold. Note that Seq is serving on http localhost so port 5000 should not be listed in the public ports.
• On first startup you may need to wait at least 5 minutes for Caddy to setup your SSL certs. I recommend wait 5 minutes then restart your container instance. May not be necessary but worked for me.
• I am assigning 2Gb of RAM for Seq, but I don't know if this is necessary or desirable - if someone can comment here on recommended RAM that would be good.
• To obtain the seq server key: in your mounted /data volume, you'll find the Seq.json file - you can grab the secret key from there, it's in storage.secretKey.

name: XXX-NAMEHERE
apiVersion: '2021-10-01'
location: australiaeast #YOUR REGION
properties:
  containers:
    - name: reverse-proxy
      properties:
        image: 'caddy:2.6'
        ports:
          - protocol: TCP
            port: 80
          - protocol: TCP
            port: 443
        resources:
          requests:
            memoryInGB: 1
            cpu: 1
          limits:
            memoryInGB: 1
            cpu: 1
        volumeMounts:
          - name: proxy-caddyfile
            mountPath: /etc/caddy
          - name: proxy-data
            mountPath: /data
          - name: proxy-config
            mountPath: /config
    - name: seq #your seq container name
      properties:
        image: 'datalust/seq:latest'
        ports:
          - port: 5000 #caddy http on localhost for inter-container serve
            protocol: TCP
        environmentVariables:
          - name: PORT #not sure if this is needed for Caddy
            value: 5000
          - name: SEQ_API_LISTENURIS
            value: 'http://localhost:5000'
          - name: ACCEPT_EULA
            value: 'Y'
          - name: SEQ_API_CANONICALURI
            value: 'YOURFQDNHERE' #somethink like 'https://YOURDNSNAMELABEL.YOURREGION.azurecontainer.io'
        resources:
          requests:
            memoryInGB: 2
            cpu: 1
          limits:
            memoryInGB: 2
            cpu: 1
        volumeMounts:
          - name: MYSeqData
            mountPath: /data
  restartPolicy: 1
  ipAddress:
    ports: #note port 5000 ommitted as this is only localhost
      - protocol: TCP
        port: 80
      - protocol: TCP
        port: 443
    type: Public
    dnsNameLabel: YOURDNSNAMELABEL
  osType: Linux
  volumes:
    - name: MYSeqData
      azureFile:
        shareName: MYSeqData
        storageAccountName: MYSTORAGEACCOUNT
        storageAccountKey: MYSTORAGEACCOUNTKEY
    - name: proxy-caddyfile
      azureFile:
        shareName: proxy-caddyfile
        storageAccountName: MYSTORAGEACCOUNT
        storageAccountKey: MYSTORAGEACCOUNTKEY
    - name: proxy-data
      azureFile:
        shareName: proxy-data
        storageAccountName: MYSTORAGEACCOUNT
        storageAccountKey: MYSTORAGEACCOUNTKEY
    - name: proxy-config
      azureFile:
        shareName: proxy-config
        storageAccountName: MYSTORAGEACCOUNT
        storageAccountKey: MYSTORAGEACCOUNTKEY

To setup the containers

 az container create --resource-group YOURRESOURCEGROUP --file config.yaml

[Mike-E-angelo]

Thank you for posting this. I am looking into this now, and am a little unclear what a "caddyfile" is ... can you please provide a little more context on where this is at? Thank you for any assistance you can provide.

[Mike-E-angelo]

FWIW I did not need a file but used this configuration and it worked! MAGIC: https://stackoverflow.com/a/78311204