From 7e4e4b0514088b851319552256047c0edb1b84e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20Mu=CC=88ller?= <jan.mueller@catdev.io>
Date: Tue, 3 Nov 2020 15:57:15 +0200
Subject: [PATCH] Add http to https redirect to external idp setup

---
 .../idpnode/docker-compose.yml                   | 16 ++++++++++++----
 .../ocisnode/docker-compose.yml                  | 15 +++++++++++----
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/deployments/examples/ocis_external_konnectd/idpnode/docker-compose.yml b/deployments/examples/ocis_external_konnectd/idpnode/docker-compose.yml
index 5e4f8c043..56b776257 100644
--- a/deployments/examples/ocis_external_konnectd/idpnode/docker-compose.yml
+++ b/deployments/examples/ocis_external_konnectd/idpnode/docker-compose.yml
@@ -8,15 +8,16 @@ services:
     networks:
       - idpnet
     command:
-      - "--api.insecure=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--certificatesresolvers.idp.acme.tlschallenge=true"
       - "--certificatesresolvers.idp.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
       - "--certificatesresolvers.idp.acme.email=postmaster@${IDP_DOMAIN}"
       - "--certificatesresolvers.idp.acme.storage=/letsencrypt/acme.json"
     ports:
+      - "80:80"
       - "443:443"
       - "8080:8080"
     volumes:
@@ -51,9 +52,16 @@ services:
       LDAP_FILTER: (objectClass=posixaccount)
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.idp.rule=Host(`${IDP_DOMAIN}`)"
-      - "traefik.http.routers.idp.entrypoints=websecure"
-      - "traefik.http.routers.idp.tls.certresolver=idp"
+      - "traefik.http.services.idp.loadbalancer.server.port=9200"
       - "traefik.docker.network=idpnet"
       - "traefik.port=9130"
       - "traefik.protocol=https"
+      # ssl config
+      - "traefik.http.routers.idp.rule=Host(`${IDP_DOMAIN}`)"
+      - "traefik.http.routers.idp.entrypoints=websecure"
+      - "traefik.http.routers.idp.tls.certresolver=idp"
+      # http -> https forwarding
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      - "traefik.http.routers.idp-redirs.rule=Host(`${IDP_DOMAIN}`)"
+      - "traefik.http.routers.idp-redirs.entrypoints=web"
+      - "traefik.http.routers.idp-redirs.middlewares=redirect-to-https"
diff --git a/deployments/examples/ocis_external_konnectd/ocisnode/docker-compose.yml b/deployments/examples/ocis_external_konnectd/ocisnode/docker-compose.yml
index 7655dfc54..89582e2b7 100644
--- a/deployments/examples/ocis_external_konnectd/ocisnode/docker-compose.yml
+++ b/deployments/examples/ocis_external_konnectd/ocisnode/docker-compose.yml
@@ -11,12 +11,14 @@ services:
       - "--api.insecure=true"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
+      - "--entrypoints.web.address=:443"
       - "--entrypoints.websecure.address=:443"
       - "--certificatesresolvers.ocis.acme.tlschallenge=true"
       - "--certificatesresolvers.ocis.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
       - "--certificatesresolvers.ocis.acme.email=postmaster@${OCIS_DOMAIN}"
       - "--certificatesresolvers.ocis.acme.storage=/letsencrypt/acme.json"
     ports:
+      - "80:80"
       - "443:443"
       - "8080:8080"
     volumes:
@@ -52,10 +54,15 @@ services:
       REVA_DATAGATEWAY_URL: https://${OCIS_DOMAIN}/data
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
-      - "traefik.http.routers.ocis.entrypoints=websecure"
-      - "traefik.http.routers.ocis.tls.certresolver=ocis"
       - "traefik.http.services.ocis.loadbalancer.server.port=9200"
       - "traefik.docker.network=ocisnet"
-      - "traefik.port=9200"
       - "traefik.protocol=https"
+      # ssl config
+      - "traefik.http.routers.idp.rule=Host(`${OCIS_DOMAIN}`)"
+      - "traefik.http.routers.ocis.entrypoints=websecure"
+      - "traefik.http.routers.ocis.tls.certresolver=idp"
+      # http -> https forwarding
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+      - "traefik.http.routers.ocis-redirs.rule=Host(`${OCIS_DOMAIN}`)"
+      - "traefik.http.routers.ocis-redirs.entrypoints=web"
+      - "traefik.http.routers.ocis-redirs.middlewares=redirect-to-https"