# How do I set up https with self hosted docker(using self signed certs)

**URL:** <https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882>\
**Category:** Self hosted Taiga\
**Created:** [March 13, 2023, 10:35pm UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882 "2023-03-13T22:35:37Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![RT-AP](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@RT-AP](https://community.taiga.io/u/RT-AP)\
**Post date:** [March 13, 2023, 10:35pm UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/1 "2023-03-13T22:35:37Z")

</div>

Do I need to add some sort of extra container sitting in front of gateway (like nginxproxy/nginx-proxy) or do I configure the gateway for https directly.  
I tried to do it directly but am getting 502 errors which I can’t track down.

For the self signed certs, I’m mapping  
./certs/nginx.key:/etc/nginx/ssl/nginx.key  
./certs/nginx.crt:/etc/nginx/ssl/nginx.crt  
and not sure if I need to do this but adding intermediate certs to /usr/local/share/ca-certificates/ and running update-ca-certificates at startup

---

<div class="post-metadata">

**Author:** ![RT-AP](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@RT-AP](https://community.taiga.io/u/RT-AP)\
**Post date:** [March 15, 2023, 4:30am UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/2 "2023-03-15T04:30:33Z")

</div>

Oh it was a silly mistake, I forgot to add port 443 mapping for taiga gateway  
taiga-gateway:  
image: nginx:1.19-alpine  
ports:  
- “80:80”  
- “443:443”  
It loaded afterwards

---

<div class="post-metadata">

**Author:** ![RT-AP](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@RT-AP](https://community.taiga.io/u/RT-AP)\
**Post date:** [March 15, 2023, 10:09am UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/3 "2023-03-15T10:09:49Z")

</div>

but email seems to have broken  
how do you email with it  
could setting env variable  
REQUESTS\_CA\_BUNDLE: “/usr/local/share/ca-certificates/star-chain.comp.cer” in taiga-back  
for th jira cert chain for import be causing these issues?  
taiga-docker-taiga-back-1 | ERROR:2023-03-15 10:04:25,335: Internal Server Error: /api/v1/auth/register  
taiga-docker-taiga-back-1 | Traceback (most recent call last):  
taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/core/handlers/exception.py”, line 34, in inner  
taiga-docker-taiga-back-1 | response = get\_response(request)

taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/core/handlers/base.py”, line 115, in \_get\_response  
taiga-docker-taiga-back-1 | response = self.process\_exception\_by\_middleware(e, request)  
taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/core/handlers/base.py”, line 113, in \_get\_response  
taiga-docker-taiga-back-1 | response = wrapped\_callback(request, \*callback\_args, \*\*callback\_kwargs)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/base/api/viewsets.py”, line 95, in view  
taiga-docker-taiga-back-1 | return self.dispatch(request, \*args, \*\*kwargs)  
taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/views/decorators/csrf.py”, line 54, in wrapped\_view  
taiga-docker-taiga-back-1 | return view\_func(\*args, \*\*kwargs)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/base/api/views.py”, line 449, in dispatch  
taiga-docker-taiga-back-1 | response = self.handle\_exception(exc)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/base/api/views.py”, line 447, in dispatch  
taiga-docker-taiga-back-1 | response = handler(request, \*args, \*\*kwargs)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/auth/api.py”, line 137, in register  
taiga-docker-taiga-back-1 | return self.\_public\_register(request)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/auth/api.py”, line 112, in \_public\_register  
taiga-docker-taiga-back-1 | user = public\_register(\*\*data)  
taiga-docker-taiga-back-1 | File “/usr/local/lib/python3.7/contextlib.py”, line 74, in inner  
taiga-docker-taiga-back-1 | return func(\*args, \*\*kwds)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/auth/services.py”, line 174, in public\_register  
taiga-docker-taiga-back-1 | send\_register\_email(user)  
taiga-docker-taiga-back-1 | File “/taiga-back/taiga/auth/services.py”, line 124, in send\_register\_email  
taiga-docker-taiga-back-1 | return bool(email.send())  
taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/core/mail/message.py”, line 306, in send  
taiga-docker-taiga-back-1 | return self.get\_connection(fail\_silently).send\_messages([self])  
taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/core/mail/backends/smtp.py”, line 103, in send\_messages  
taiga-docker-taiga-back-1 | new\_conn\_created = self.open()  
taiga-docker-taiga-back-1 | File “/opt/venv/lib/python3.7/site-packages/django/core/mail/backends/smtp.py”, line 68, in open  
taiga-docker-taiga-back-1 | self.connection.starttls(keyfile=self.ssl\_keyfile, certfile=self.ssl\_certfile)  
taiga-docker-taiga-back-1 | File “/usr/local/lib/python3.7/smtplib.py”, line 776, in starttls  
taiga-docker-taiga-back-1 | server\_hostname=self.\_host)  
taiga-docker-taiga-back-1 | File “/usr/local/lib/python3.7/ssl.py”, line 423, in wrap\_socket  
taiga-docker-taiga-back-1 | session=session  
taiga-docker-taiga-back-1 | File “/usr/local/lib/python3.7/ssl.py”, line 870, in \_create  
taiga-docker-taiga-back-1 | self.do\_handshake()  
taiga-docker-taiga-back-1 | File “/usr/local/lib/python3.7/ssl.py”, line 1139, in do\_handshake  
taiga-docker-taiga-back-1 | self.\_sslobj.do\_handshake()  
taiga-docker-taiga-back-1 | OSError: [Errno 0] Error  
taiga-docker-taiga-gateway-1 | 172.26.0.1 - - [15/Mar/2023:10:04:25 +0000] “POST /api/v1/auth/register HTTP/1.1” 500 37 “[https://taiga.apconnet.apcon.com/register](https://taiga.apconnet.apcon.com/register)” "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.

---

<div class="post-metadata">

**Author:** ![yami](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/yami/32/289_2.png) [@yami](https://community.taiga.io/u/yami)\
**Post date:** [March 22, 2023, 10:31am UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/4 "2023-03-22T10:31:49Z")

</div>

Hi @RT-AP SSL/TLS termination should be dealt in your host system. You are expected to have an Nginx/Apache/traeffic… where you can configure your certificates.

taiga-gateway is not meant to have this configuration; you can map certificates and (maybe) edit the nginx configuration, but it’s not officially tested nor supported.

Cheers!

---

<div class="post-metadata">

**Author:** ![RT-AP](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@RT-AP](https://community.taiga.io/u/RT-AP)\
**Post date:** [March 22, 2023, 5:42pm UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/5 "2023-03-22T17:42:36Z")

</div>

I don’t know if its unsupported but I got it to work.  
And it seems to be doing ok for the most part.  
I think I had to add a few proxy\_set\_header

```yaml
  # docker-compose.yml
  # ...
  taiga-gateway:
    
    #image: nginx:1.19-alpine
    image: nginx:1.19
    ports:
      - "80:80"
      - "443:443"
    volumes:

      - ./taiga-gateway-nginx-https-certs/nginx.crt:/etc/nginx/ssl/nginx.crt
      - ./taiga-gateway-nginx-https-certs/nginx.key:/etc/nginx/ssl/nginx.key
      - ./taiga-gateway/taiga.conf:/etc/nginx/conf.d/default.conf
      - ./docker-entrypoint.d:/docker-entrypoint.d/
      - taiga-static-data:/taiga/static
      - taiga-media-data:/taiga/media
    networks:
      - taiga
    depends_on:
      - taiga-front
      - taiga-back
      - taiga-events

```

```plaintext
     # taiga-gateway/taiga.conf
server {
    server_name taiga.company.com
    listen 80 default_server;
    listen 443 ssl default_server;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;

    client_max_body_size 100M;
    charset utf-8;

    # Frontend
    location / {
        proxy_pass http://taiga-front/;
        proxy_pass_header Server;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # API
    location /api/ {
        proxy_pass http://taiga-back:8000/api/;
        proxy_pass_header Server;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
    }

    # Admin
    location /admin/ {
        proxy_pass http://taiga-back:8000/admin/;
        proxy_pass_header Server;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
    }

    # Static
    location /static/ {
        alias /taiga/static/;
    }
    # Media
    location /_protected/ {
        internal;
        alias /taiga/media/;
        add_header Content-disposition "attachment";
    }

    # Unprotected section
    location /media/exports/ {
        alias /taiga/media/exports/;
        add_header Content-disposition "attachment";
    }

    location /media/ {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://taiga-protected:8003/;
        proxy_redirect off;
    }

    # Events
    location /events {
        proxy_pass http://taiga-events:8888/events;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_connect_timeout 7d;
        proxy_send_timeout 7d;
        proxy_read_timeout 7d;
    }
}

```

---

<div class="post-metadata">

**Author:** ![yami](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/yami/32/289_2.png) [@yami](https://community.taiga.io/u/yami)\
**Post date:** [March 22, 2023, 6:01pm UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/6 "2023-03-22T18:01:10Z")

</div>

Great! thank you for sharing your solution, so it may be useful for other users.

Cheers!

---

<div class="post-metadata">

**Author:** ![collex100](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/collex100/32/1091_2.png) [@collex100](https://community.taiga.io/u/collex100)\
**Post date:** [June 5, 2023, 4:49pm UTC](https://community.taiga.io/t/how-do-i-set-up-https-with-self-hosted-docker-using-self-signed-certs/882/7 "2023-06-05T16:49:37Z")

</div>

Could you clarify this question - is it inside docker? There is an instruction on how it looks throughout the installation process. I have my own installation option, but it requires consideration of the issue.

> [@\[SOLVED\] Help with the 30min setup](https://community.taiga.io/t/solved-help-with-the-30min-setup/1294):
>
> I did everything according to this manual. No installation errors. Specified only external domains for two applications. How to remove errors? How to remove a port from a domain?

Thanks!