paullj1/socat_static repository overview

for FILENAME in client server; do
  openssl genrsa -out $FILENAME.key 1024
  openssl req -new -key $FILENAME.key -x509 -days 36500 -out $FILENAME.crt -batch -subj '/CN=*'
  cat $FILENAME.key $FILENAME.crt >$FILENAME.pem
  chmod 600 $FILENAME.key $FILENAME.pem
done

cat server.crt | docker secret create SERVER_CRT -
cat server.pem | docker secret create SERVER_PEM -
cat client.crt | docker secret create CLIENT_CRT -
cat client.key | docker secret create CLIENT_KEY -
rm server.* client.*

docker_socket:
    image: paullj1/socat_static:latest
    ports:
      - target: 2376
        published: 2376
        mode: host
    secrets:
      - CLIENT_CRT
      - SERVER_PEM
    deploy:
      mode: global
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /docker.sock
    command: ["-d", "-d",
      "openssl-listen:2376,fork,reuseaddr,cert=/run/secrets/SERVER_PEM,cafile=/run/secrets/CLIENT_CRT",
      "unix-connect:/docker.sock"]

    secrets:
      - CLIENT_CRT
      - CLIENT_KEY
      - SERVER_CRT

docker --tlsverify --tlscacert=/run/secrets/SERVER_CRT \
  --tlscert=/run/secrets/CLIENT_CRT --tlskey=/run/secrets/CLIENT_KEY \
  -H=docker_socket:2376 version