fix(traefik): request public TLS per host

Author: terion-labs

ansible/roles/traefik/templates/terrarium-dynamic.yml.j2

@@ -1,13 +1,8 @@
-{% set terrarium_management_tls_hosts = ([terrarium_manage_domain, terrarium_proxy_domain, terrarium_lxd_domain] + ([terrarium_auth_domain] if terrarium_idp_mode == 'local' else [])) | unique | list %}
-{% macro terrarium_management_tls() %}
+{% macro terrarium_host_tls(domain) %}
       tls:
         certResolver: letsencrypt
         domains:
-          - main: "{{ terrarium_manage_domain }}"
-            sans:
-{% for domain in terrarium_management_tls_hosts if domain != terrarium_manage_domain %}
-              - "{{ domain }}"
-{% endfor %}
+          - main: "{{ domain }}"
 {% endmacro %}
 http:
   middlewares:
@@ -40,22 +35,22 @@ http:
       rule: Host(`{{ terrarium_manage_domain }}`) && PathPrefix(`/oauth2/`)
       service: oauth2-proxy
       priority: 500
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_manage_domain) }}
     proxy-oauth2:
       entryPoints:
         - websecure
       rule: Host(`{{ terrarium_proxy_domain }}`) && PathPrefix(`/oauth2/`)
       service: oauth2-proxy
       priority: 500
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_proxy_domain) }}
     cockpit:
       entryPoints:
         - websecure
       rule: Host(`{{ terrarium_manage_domain }}`)
       middlewares:
         - admin-forward-auth
       service: cockpit
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_manage_domain) }}
     traefik-dashboard-root:
       entryPoints:
         - websecure
@@ -64,21 +59,21 @@ http:
         - admin-forward-auth
         - traefik-dashboard-root-redirect
       service: api@internal
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_proxy_domain) }}
     traefik-dashboard:
       entryPoints:
         - websecure
       rule: Host(`{{ terrarium_proxy_domain }}`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
       middlewares:
         - admin-forward-auth
       service: api@internal
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_proxy_domain) }}
     lxd:
       entryPoints:
         - websecure
       rule: Host(`{{ terrarium_lxd_domain }}`)
       service: lxd
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_lxd_domain) }}
 {% if terrarium_idp_mode == 'local' %}
     zitadel-root:
       entryPoints:
@@ -88,14 +83,14 @@ http:
         - zitadel-root-rewrite
       service: zitadel-login
       priority: 400
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_auth_domain) }}
     zitadel-login:
       entryPoints:
         - websecure
       rule: Host(`{{ terrarium_auth_domain }}`) && PathPrefix(`/ui/v2/login`)
       service: zitadel-login
       priority: 250
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_auth_domain) }}
     zitadel-api-alias:
       entryPoints:
         - websecure
@@ -104,14 +99,14 @@ http:
         - zitadel-strip-api
       service: zitadel-api
       priority: 200
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_auth_domain) }}
     zitadel-canonical:
       entryPoints:
         - websecure
       rule: Host(`{{ terrarium_auth_domain }}`) && !PathPrefix(`/ui/v2/login`) && !PathPrefix(`/api`) && !Path(`/`)
       service: zitadel-api
       priority: 100
-{{ terrarium_management_tls() }}
+{{ terrarium_host_tls(terrarium_auth_domain) }}
 {% endif %}
   services:
     oauth2-proxy:

tests/ansible-bootstrap-cert.test.ts

@@ -34,11 +34,14 @@ describe("Traefik bootstrap certificate template", () => {
     expect(certConfig).toContain("certificates:");
     expect(certConfig).not.toContain("defaultCertificate");
     expect(dynamicConfig).not.toContain("zitadel-root-bootstrap");
-    expect(dynamicConfig).toContain("terrarium_management_tls_hosts");
-    expect(dynamicConfig).toContain("[terrarium_manage_domain, terrarium_proxy_domain, terrarium_lxd_domain]");
-    expect(dynamicConfig).toContain("[terrarium_auth_domain] if terrarium_idp_mode == 'local' else []");
-    expect(dynamicConfig).toContain('main: "{{ terrarium_manage_domain }}"');
-    expect(dynamicConfig).toContain('- "{{ domain }}"');
+    expect(dynamicConfig).not.toContain("terrarium_management_tls_hosts");
+    expect(dynamicConfig).toContain("macro terrarium_host_tls(domain)");
+    expect(dynamicConfig).toContain("terrarium_host_tls(terrarium_manage_domain)");
+    expect(dynamicConfig).toContain("terrarium_host_tls(terrarium_proxy_domain)");
+    expect(dynamicConfig).toContain("terrarium_host_tls(terrarium_lxd_domain)");
+    expect(dynamicConfig).toContain("terrarium_host_tls(terrarium_auth_domain)");
+    expect(dynamicConfig).toContain('main: "{{ domain }}"');
+    expect(dynamicConfig).not.toContain("sans:");
     expect(bootstrapRoutes).toContain("zitadel-root-bootstrap");
     expect(tasks).toContain("Remove Traefik bootstrap certificate config when bootstrap TLS is not required");
     expect(tasks).toContain("Remove temporary Traefik bootstrap routes when bootstrap TLS is not required");