fixed tls support

minio/README.md

@@ -7,9 +7,10 @@ Scope of the **basic setup** is to run minio
 - with a directoy mounted for data
 - with the container port 9000 (S3) mapped to a host port
 
-Scope of the **advance setup** is to run minio
-- web ui (console, port 9001) with basic auth behind a reverse-proxy (port 443) with letsencrypt
-- s3 (port 9000) with the tls cert from above and restricted to certain source IPs
+Scope of the **advance setup** is to run minio in addition
+- with TLS support
+- with web ui (console, port 9001) exposed to a reverse proxy (port 443)
+- with TLS support for s3 (port 9000), borrowed from the reverse proxy above
 
 
 

minio/docker-compose.override.yml

@@ -1,35 +1,13 @@
 version: '3.7'
 services:
-#  minio-getkeys:
-#    container_name: minio-getkeys
-#    hostname: minio-getkeys
-#    image: alpine
-#    user: 0:0  # we need root to read the key/cert
-#    restart: on-failure:3
-#    # ToDo: Replace with variable
-#    volumes:
-#      - ${CERT_PATH}:/mnt/src:ro
-#      - ./data/home/.minio/certs:/mnt/dst:rw
-#    command: >
-#              sh -c 'apk add --no-cache inotify-tools
-#              && while true;
-#              do inotifywait /mnt/src/fullchain.pem --event modify 
-#              && date +%x_%r 
-#              && cp /mnt/src/fullchain.pem  /mnt/dst/public.crt
-#              && cp /mnt/src/key.pem        /mnt/dst/private.key
-#              && chown 1000:1000            /mnt/dst/*.*
-#              && chmod 600                  /mnt/dst/*.*; done'
   minio:
     networks:
       - docker-dmz
     volumes:
-      - ${CERT_PATH}${HOSTNAME}:/home/data/.minio/certs
+      - ${CERT_PATH}${HOSTNAME}/key.pem:/home/data/.minio/certs/private.key
+      - ${CERT_PATH}${HOSTNAME}/fullchain.pem:/home/data/.minio/certs/public.crt
     expose:
       - "9001"
-    environment:
-      VIRTUAL_HOST: ${HOSTNAME}
-      LETSENCRYPT_HOST: ${HOSTNAME}
-      LETSENCRYPT_EMAIL: webmaster@${HOSTNAME}
       
 networks:
   docker-dmz:

minio/docker-compose.yml

@@ -10,8 +10,6 @@ services:
       - ./data/home:/home/data
     ports:
       - ${PORT_MAPPING} # s3, port 9000
-    expose:
-      - 9001
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}