Skip to main content

HTTPS and Traefik

On the full layout, Traefik receives every request and forwards it: / to Liberty Next, /pgadmin, /portainer, /traefik to the tools. It is also where HTTPS is switched on. One command does it, at any time after the installation.

At a glance​

Usershttps://liberty.example.comTraefik:443 · certificateliberty-next:8000DashboardpasswordLet's EncryptautomaticOwn certificatecert + keyTwo ways./liberty sslHTTP → HTTPSport 80 redirected

Let's Encrypt​

For a server reachable from the internet:

./liberty ssl letsencrypt --domain liberty.example.com --email ops@example.com
RequirementWhy
The name resolves to this host (DNS A or AAAA record).Let's Encrypt checks the name before issuing.
Ports 80 and 443 are reachable from the internet.The certificate is obtained through a TLS challenge on 443.

Traefik requests the certificate on the first HTTPS call and renews it on its own. Certificates are kept in the traefik-acme volume, which no reset deletes (Let's Encrypt limits how often a certificate can be issued for the same name).

Your own certificate​

For an internal server, a company certificate authority or a host without internet access:

./liberty ssl provided --domain liberty.internal.example.com \
  --cert-dir /etc/pki/liberty --cert-file liberty.crt --key-file liberty.key

The certificate folder is mounted read-only into Traefik and traefik/dynamic/tls.yml is generated with the two file names. To renew, replace the two files in the folder, then restart Traefik (docker compose restart traefik from release/). To add certificates for other names, edit tls.yml: Traefik reloads it on its own.

What HTTPS changes​

  • Liberty Next, pgAdmin and Portainer answer on https://<domain>/…; plain HTTP calls are redirected to HTTPS.
  • Liberty Next responses carry security headers (no framing by other sites, no content-type guessing, a strict referrer policy).
  • The routes answer only for the declared domain name.

Change mode or go back to HTTP​

./liberty ssl provided …        # from Let's Encrypt to your own certificate, or the reverse
./liberty ssl off               # back to plain HTTP on port 80

Only the HTTPS part of the recorded compose files changes: the licensed apps and every secret stay as they are, and the stack is restarted. HTTPS needs the full layout; the light layout has no Traefik.

The Traefik dashboard​

/traefik shows the routes and services Traefik knows about. It is protected by the user admin and a random password printed once by the installation.

./liberty dashboard-password      # new random password, printed once

.env keeps only the hash of the password. ./liberty doctor reports an install that still uses the old common default password.

Using your own reverse proxy​

When a company proxy or load balancer already terminates HTTPS, keep Liberty Next on plain HTTP (./liberty ssl off, or the light layout) and point the proxy at it. The proxy must:

  • forward WebSocket upgrades on /socket.io (live updates: the notification bell, record locks, assistant replies);
  • keep a user on the same backend if there are several (Traefik does it with the liberty_sticky cookie).

Serving under a sub-path​

To publish Liberty Next under a path of an existing site — https://intranet.example.com/liberty/ — set Sub-path behind a reverse proxy to /liberty in Liberty Next → Administer → App, then restart the server. The page, its assets, the API, the downloads, the live connection and the links all resolve under that path, whether the proxy strips the prefix before forwarding or passes it through. The addresses the server builds itself — the single sign-on callback — carry it: register the callback with the sub-path at the identity provider.

The sub-path also applies to the installed application, and a promotion target is declared with its sub-path in its URL.