Added support for custom SSL certificate

lib/kamal/configuration/docs/proxy.yml

@@ -49,6 +49,17 @@ proxy:
  # Defaults to `false`:
  ssl: true
 
+ # Custom SSL certificate
+ #
+ # In scenarios where Let's Encrypt is not an option, or you already have your own
+ # certificates from a different Certificate Authority, you can configure kamal-proxy
+ # to load the certificate and the corresponding private key from disk.
+ #
+ # The certificate must be in PEM format and contain the full chain. The private key
+ # must also be in PEM format.
+ ssl_certificate_path: /data/cert/foo.example.com/fullchain.pem
+ ssl_private_key_path: /data/cert/foo.example.com/privkey.pem
+
  # Response timeout
  #
  # How long to wait for requests to complete before timing out, defaults to 30 seconds:

lib/kamal/configuration/proxy.rb

@@ -30,6 +30,8 @@ def deploy_options
  {
  host: hosts,
  tls: proxy_config["ssl"].presence,
+ "tls-certificate-path": proxy_config["ssl_certificate_path"],
+ "tls-private-key-path": proxy_config["ssl_private_key_path"],
  "deploy-timeout": seconds_duration(config.deploy_timeout),
  "drain-timeout": seconds_duration(config.drain_timeout),
  "health-check-interval": seconds_duration(proxy_config.dig("healthcheck", "interval")),

lib/kamal/configuration/validator/proxy.rb

@@ -10,6 +10,14 @@ def validate!
  if (config.keys & [ "host", "hosts" ]).size > 1
  error "Specify one of 'host' or 'hosts', not both"
  end
+
+ if config["ssl_certificate_path"].present? && config["ssl_private_key_path"].blank?
+ error "Must set a private key path to use a custom SSL certificate"
+ end
+
+ if config["ssl_private_key_path"].present? && config["ssl_certificate_path"].blank?
+ error "Must set a certificate path to use a custom SSL private key"
+ end
  end
  end
 end

test/commands/app_test.rb

@@ -143,6 +143,14 @@ class CommandsAppTest < ActiveSupport::TestCase
  new_command.deploy(target: "172.1.0.2").join(" ")
  end
 
+ test "deploy with custom SSL certificate" do
+ @config[:proxy] = { "ssl" => true, "host" => "example.com", "ssl_certificate_path" => "/path/to/cert.pem", "ssl_private_key_path" => "/path/to/key.pem" }
+
+ assert_equal \
+ "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"172.1.0.2:80\" --host=\"example.com\" --tls --tls-certificate-path=\"/path/to/cert.pem\" --tls-private-key-path=\"/path/to/key.pem\" --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"",
+ new_command.deploy(target: "172.1.0.2").join(" ")
+ end
+
  test "remove" do
  assert_equal \
  "docker exec kamal-proxy kamal-proxy remove app-web",

test/configuration/proxy_test.rb

@@ -38,6 +38,16 @@ class ConfigurationProxyTest < ActiveSupport::TestCase
  assert_not config.proxy.ssl?
  end
 
+ test "ssl with certificate path and no private key path" do
+ @deploy[:proxy] = { "ssl" => true, "ssl_certificate_path" => "/path/to/cert.pem" }
+ assert_raises(Kamal::ConfigurationError) { config.proxy.ssl? }
+ end
+
+ test "ssl with private key path and no certificate path" do
+ @deploy[:proxy] = { "ssl" => true, "ssl_private_key_path" => "/path/to/key.pem" }
+ assert_raises(Kamal::ConfigurationError) { config.proxy.ssl? }
+ end
+
  private
  def config
  Kamal::Configuration.new(@deploy)