title: Add SSL-Certificates to Docker/Node
body: <p>I have to add <strong>SSL</strong> to my <strong>express backend</strong> because of mixed-content errors from my deployment, which runs obviously on https already. After creating a subdomain for my api, I have successfully created let´s encrypt certificates via certbot on my production machine via ssh.</p>
  <p>The problem I have is, I <strong>can´t access the certificates from my express server</strong>, because I am building it as a <strong>docker image</strong>. I am searching a <strong>fast way for adding ssl</strong> to my backend. I have found some articles about <em>nginx</em>, but as I am new to docker, express etc. I can´t find a good guide on which supports my configuration. Because of that I have tried to keep <em>nginx</em> out of the environment, I´m not really sure if this is the way to go..</p>
  <p>I am currently <strong>stuck at loading the certificates via volume to the docker image</strong>, which should then be <strong>available in my express config.</strong></p>
  <p><strong>Dockerfile</strong></p>
  <pre><code>FROM node:14-alpine
  
  ENV NODE_ENV=production SERVER_PORT_HTTP=8080 SERVER_PORT_HTTPS=443
  
  WORKDIR /usr/src/app
  
  # Copy working directory from repository
  COPY [&quot;package.json&quot;, &quot;package-lock.json*&quot;, &quot;./&quot;]
  
  # for reading the ssl certificate created by certbot on host machine 
  VOLUME [ &quot;/etc/letsencrypt/live/api.example.com&quot; ]
  
  # Needed for next step 
  COPY prisma ./prisma/
  
  RUN npm install
  
  # Prisma must generate Types bevor starting server
  RUN npm i -g @prisma/cli
  RUN prisma generate
  
  COPY . .
  
  EXPOSE ${SERVER_PORT_HTTP} ${SERVER_PORT_HTTPS}
  
  CMD [ &quot;npm&quot;, &quot;run&quot;, &quot;start&quot; ]
  </code></pre>
  <p><strong>Express app.js</strong></p>
  <pre><code>if (process.env.NODE_ENV?.trim() === 'production') {
    const https = require('https');
    const fs = require('fs');
  
    let privateKey = fs.readFileSync(__dirname + '/privatekey.pem');
    let certificate = fs.readFileSync(__dirname + '/certificate.pem');
  
    https.createServer({ key: privateKey, cert: certificate }, app).listen(process.env.SERVER_PORT_HTTPS, function () {
      console.log('Listening on port ' + process.env.SERVER_PORT_HTTPS);
    });
  } else {
    app.listen(process.env.SERVER_PORT_HTTP, function () {
      console.log('Listening on port ' + process.env.SERVER_PORT_HTTP);
    });
  }
  </code></pre>
  <p><strong>GitHub Workflow</strong></p>
  <pre><code>name: GHCR-DigitalOcean
  
  on:
    push:
      branches:
        - main
      paths:
        - &quot;backend/**&quot;
  
  jobs:
    push_to_github_container_registry:
      name: Push to GHCR
      runs-on: ubuntu-latest
  
      defaults:
        run:
          working-directory: ./backend
  
      steps:
        # Checkout the Repository
        - name: Checking out the repository
          uses: actions/checkout@v2
  
        - name: Set up Docker Builder
          uses: docker/setup-buildx-action@v1
  
        - name: Logging into GitHub Container Registry
          uses: docker/login-action@v1
          with:
            registry: ghcr.io
            username: ${{ github.repository_owner }}
            password: ${{ secrets.CR_PAT }}
  
        - name: Pushing Image to Github Container Registry
          uses: docker/build-push-action@v2
          with:
            context: ./backend
            version: latest
            file: backend/dockerfile
            push: true
            tags: ghcr.io/${{ github.repository }}:latest
  
    deploy_to_digital_ocean_dropplet:
      name: Deploy to Digital Ocean Droplet
      runs-on: ubuntu-latest
      needs: push_to_github_container_registry
  
      steps:
        - name: Deploy to Digital Ocean droplet via SSH action
          uses: appleboy/ssh-action@master
          with:
            host: ${{ secrets.HOST }}
            username: ${{ secrets.USERNAME }}
            key: ${{ secrets.PRIVATE_KEY }}
            port: ${{ secrets.PORT }}
            script: |
              docker kill $(docker ps -q -a)
  
              docker system prune -a
  
              docker login https://ghcr.io -u ${{ github.repository_owner }} -p ${{ secrets.CR_PAT }}
   
              docker pull ghcr.io/${{ github.repository }}:latest
  
              docker run -d -p 80:8080 -p 443:443 -t ghcr.io/${{ github.repository }}:latest
  
  </code></pre>