SSL_MODE

[cinderblockgames]

What are the options for SSL_MODE except for "mixed?" I have a reverse proxy that handles SSL and would like to turn off the cert generation on startup.

[alexjustesen]

You can use off, mixed or full, here's the base container docs https://serversideup.net/open-source/docker-php/docs/reference/environment-variable-specification

[cinderblockgames]

Thanks!

[alexdelprete]

The cert. re-generation is only related to the SSL_MODE=mixed or SSL_MODE=on configuration.
To avoid the generation of SSL certs at startup, you should use a bind mount or named volume to the container's directory where certs are created (/etc/ssl/web). At startup, the container will find existing certs and won't recreate them.

If you use a reverse proxy with TLS, you must use SSL on ST too, otherwise the browser will receive a mixed-content error (see discussion for issue #280). The possible values for SSL_MODE are:

• SSL_MODE=mixed (default) both http/80 and https/443 available
• SSL_MODE=full only https/443 available
• SSL_MODE=off only http/80 available

Example docker compose file:

version: '3.3'
services:
  speedtest-tracker:
    image: ghcr.io/alexjustesen/speedtest-tracker:v0.11.7
    container_name: speedtest-tracker
    restart: unless-stopped
    ports:
      - 8008:443
    environment:
      TZ: Europe/Rome
      PUID: 1000
      PGID: 1000
      DB_CONNECTION: mysql
      DB_HOST: mariadb.domain.dom
      DB_PORT: 3306
      DB_DATABASE: speedtest_tracker
      DB_USERNAME: xxxxxxxxxx
      DB_PASSWORD: yyyyyyyyyy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - $PWD/config:/config
      - $PWD/certs:/etc/ssl/web

[alexdelprete]

what reverse proxy do you use? probably it's taking care of that issue, but I would advise to leave ST in mixed mode. It's up to the proxy to decide whether to use SSL or not, but the container accepts both.

[cinderblockgames]

Traefik.

[alexdelprete]

Like me. And if I use TLS with traefik for ST, and I tell Traefik to point to ST on the http port, I have mixed-mode, this happens to many other users too who opened issues in the past.

Anyway, configure it as you prefer, you have all the necessary info now.

[duracell]

This is wrong.

1. If you use a reverse-proxy (and the application handles everything correct) there should be no mixed-content warnings. If it does, the problem is the application itself or a wrong configuration in the proxy. Then using HTTPS could help, but fixing the problem should be also done.
2. If you set SSL_MODE=off, no certificate will be generated.

[alexdelprete]

2. If you set SSL_MODE=off, no certificate will be generated.

Correct. And if you use SSL_MODE=mixed or SSL_MODE=on, certificates will always be regenerated at every startup, unless you do the bind mount. That was what I was trying to explain, should have been more specific.

I'll edit the post to clear that.