• Last Updated: 05 May 2024
• Category
• Arvind Das
ssl certbot nginx

Renew LetsEncrypt Certificate with docker compose and nginx proxy

Now a days, we have all of our services served via proxy. This allows us to run multiple apps on one single ip address. This is a great fit for deploying early small apps and saving costs.

When behind proxy, you map multiple domains/subdomains with it and also run them with SSL. You need certificate to be issued. Letsencrypt comes to the rescue. But how do we configure this all ? . Lets see .

First you need to do several configurations with nginx , setting where it is going to pickup the certificates from. You mount your app conf along with cerbot folders so that is is accessible within nginx container. The configuration in docker compose file looks like this:

#nginx configuration         
   nginx:
    image: nginx:1.25.3  
    container_name: nginx  
    ports:
    - '80:80'
    - '443:443'
    restart: always  
    volumes:
    - ./nginx/yourapp.conf:/etc/nginx/conf.d/yourapp.conf:ro
    - ./certbot/www:/var/www/certbot/:ro
    - ./certbot/conf:/var/www/certbot/:ro

Then you configure the certbot container with your app certificate folder mounted. This helps reading the files from nginx mounted locations for certificates.

#certbot configuration      
   certbot:
     image: certbot/certbot:latest
     volumes:
      - ./certbot/www/:/var/www/certbot/:rw
      - ./certbot/your_app/:/var/www/your_app:rw    
      - ./certbot/conf/:/etc/letsencrypt/:rw

We are also adding the reference of the app that was consumed, just to show several endpoints needed. If you look closely, the location to acme challenge endpoint, points to your mounted folders. This helps certbot to keep temporary file to read and verify the server.

# Virtual Host Configs
	##
	upstream your_app{
	 server your_app:3000;
	}


	server{
           listen 80;
           listen [::]:80;	   
	   server_name your_app.com www.your_app.com;
	   location /.well-known/acme-challenge/ {
 		 root /var/www/your_app;
	   }


	   location / {
              return 301 https://www.your_app.com$request_uri;
   	#	proxy_pass http://your_app;   
          }


	}
   server {
   listen 443 ssl http2;
    listen [::]:443 ssl http2;	   
   server_name your_app.com;
   location / {
              return 301 https://www.your_app.com$request_uri;
        #       proxy_pass http://your_app;   
          }
   }
   server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;


    server_name www.your_app.com;


    ssl_certificate /var/www/certbot/live/your_app.com/fullchain.pem;
    ssl_certificate_key /var/www/certbot/live/your_app.com/privkey.pem;
    
    location / {
    	proxy_pass http://your_app;
	proxy_set_header    Host               $host;
      proxy_set_header    X-Real-IP          $remote_addr;
      proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host   $host;
      proxy_set_header    X-Forwarded-Server $host;
      proxy_set_header    X-Forwarded-Port   $server_port;
      proxy_set_header    X-Forwarded-Proto  $scheme;
    }
   }

Finally you issue or renew your certificate. To issue a new certificate, use

docker compose run --rm certbot certonly --webroot --webroot-path /var/www/your_app/ -d www.your_app.com

To renew existing domain, use

docker compose run --rm certbot certonly --force-renew --webroot --webroot-path /var/www/your_app/ -d www.your_app.com