Sourcegraph HTTP and HTTPS/SSL configuration

Overview:

Sourcegraph Cluster (Kubernetes): NGINX
Docker Compose: Caddy 2

Sourcegraph Cluster (Kubernetes): NGINX

We use the ingress-nginx for Sourcegraph Cluster running on Kubernetes. Refer to the deploy-sourcegraph Configuration documentation for more information.

Sourcegraph via Docker Compose: Caddy 2

Sourcegraph's Docker Compose deployment uses Caddy 2 as its reverse proxy. The Docker Compose deployment ships with a few builtin templates that cover common scenarios for exposing Sourcegraph:

plain HTTP
HTTPS with automatically provisioned Let's Encrypt certificates
HTTPS with custom certificates that you provide

Usage instructions are provided via the caddy service's inline comments inside the docker-compose.yaml definition. Detailed steps are found below.

Important: When setting up caddy's automatic Lets Encrypt TLS certification for HTTPS we strongly recommended to test with the staging configuration first. However, the TLS certs provided by Lets Encrypt staging will not be verifiable, and will display an unknown certificate error. Once you are done testing, you will need to comment out the staging env variable and uncomment the production env variable for fully functional HTTPS.

HTTPS with Custom Certificates in Docker Compose

Important: https.custom-cert.Caddyfile should not require any updates and should remain untouched. Updates should be made in the docker-compose.yaml file only and as described below.

In your docker-compose.yaml within the caddy section:

In the Environment section of the compose file uncomment & update this line with your Sourcegraph Site Address:
```
SHELL
- 'SRC_SITE_ADDRESS=sourcegraph.example.com'
```
In Volumes section of the compose file comment out the following line
```
SHELL
- '//builtins/http.Caddyfile:/etc/caddy/Caddyfile'
```

In Volumes section of the compose file uncomment the following line:

SHELL
- '//builtins/https.custom-cert.Caddyfile:/etc/caddy/Caddyfile'

In Volumes section of the compose file uncomment and update the following line with your custom cert path:
```
SHELL
- '/LOCAL/CERT/PATH.pem:/sourcegraph.pem'
```
In Volumes section of the compose file uncomment and update the following line with your custom cert path:
```
SHELL
- '/LOCAL/KEY/PATH.key:/sourcegraph.key'
```
NOTE: When adding your certs to your instance, make sure they are in the deploy-sourcegraph-docker folder, not outside of it. They will not be recognized otherwise.

Next steps

You should configure Sourcegraph's externalURL in the advanced configuration (and restart the frontend instances) so that Sourcegraph knows its URL.

Sourcegraph via Docker Compose: Caddy 2

Sourcegraph's Docker Compose deployment uses Caddy 2 as its reverse proxy. The Docker Compose deployment ships with a few builtin templates that cover common scenarios for exposing Sourcegraph:

plain HTTP

HTTPS with automatically provisioned Let's Encrypt certificates

HTTPS with custom certificates that you provide

Important: https.custom-cert.Caddyfile should not require any updates and should remain untouched. Updates should be made in the docker-compose.yaml file only and as described below.

In your docker-compose.yaml within the caddy section:

In the Environment section of the compose file uncomment & update this line with your Sourcegraph Site Address:

SHELL
- 'SRC_SITE_ADDRESS=sourcegraph.example.com'

In Volumes section of the compose file comment out the following line

SHELL
- '//builtins/http.Caddyfile:/etc/caddy/Caddyfile'

In Volumes section of the compose file uncomment the following line:

SHELL
- '//builtins/https.custom-cert.Caddyfile:/etc/caddy/Caddyfile'

In Volumes section of the compose file uncomment and update the following line with your custom cert path:

SHELL
- '/LOCAL/CERT/PATH.pem:/sourcegraph.pem'

In Volumes section of the compose file uncomment and update the following line with your custom cert path:

SHELL
- '/LOCAL/KEY/PATH.key:/sourcegraph.key'

NOTE: When adding your certs to your instance, make sure they are in the deploy-sourcegraph-docker folder, not outside of it. They will not be recognized otherwise.