staticfloat / docker-nginx-certbot-old

Create and renew website certificates using the Letsencrypt free certificate authority.

NOTE: This repository is now in maintenance-only mode

There is a spiritual successor maintained by Jonas Alfredsson that has some nice new features and is much more actively maintained. I highly suggest all users migrate their docker configs to use that docker image, as it is strictly superior to this one while still maintaning the same ease of use.

docker-nginx-certbot

Create and automatically renew website SSL certificates using the free letsencrypt certificate authority, and its client certbot, built on top of the nginx webserver.

This repository was originally forked from @henridwyer, many thanks to him for the good idea. It has since been completely rewritten, and bears almost no resemblance to the original. This repository is much more opinionated about the structure of your webservers/containers, however it is easier to use as long as all of your webservers follow the given pattern.

Usage

Create a config directory for your custom configs:

$ mkdir conf.d

And a *.conf file in that directory (i.e. nginx.conf, but NOT just .conf):

server {
    listen              443 ssl;
    server_name         server.company.com;
    ssl_certificate     /etc/letsencrypt/live/server.company.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/server.company.com/privkey.pem;

    location / {
        ...
    }
}

Wrap this all up with a docker-compose.yml file:

version: '3'
services:
    frontend:
        restart: unless-stopped
        image: staticfloat/nginx-certbot
        ports:
            - 80:80/tcp
            - 443:443/tcp
        environment:
            CERTBOT_EMAIL: [email protected]
        volumes:
          - ./conf.d:/etc/nginx/user.conf.d:ro
          - letsencrypt:/etc/letsencrypt
volumes:
    letsencrypt:

Launch that docker-compose file, and you're good to go; certbot will automatically request an SSL certificate for any nginx sites that look for SSL certificates in /etc/letsencrypt/live, and will automatically renew them over time.

Note: using a server block that listens on port 80 may cause issues with renewal. This container will already handle forwarding to port 443, so they are unnecessary.

Templating

You may wish to template your configurations, e.g. passing in a hostname so as to be able to run multiple identical copies of this container; one per website. The docker container will use envsubst to template all mounted user configs with a user-provided list of environment variables. Example:

# In user.conf.d/nginx_template.conf
server {
    listen              443 ssl;
    server_name         ${FQDN};
    ssl_certificate     /etc/letsencrypt/live/${FQDN}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/${FQDN}/privkey.pem;

    ...
}

version: '3'
services:
    frontend:
        restart: unless-stopped
        image: staticfloat/nginx-certbot
        ports:
            - 80:80/tcp
            - 443:443/tcp
        environment:
            CERTBOT_EMAIL: [email protected]
            # variable names are space-separated
            ENVSUBST_VARS: FQDN
            FQDN: server.company.com
        volumes:
          - ./conf.d:/etc/nginx/user.conf.d:ro
          - letsencrypt:/etc/letsencrypt
volumes:
    letsencrypt:

Changelog

1.2

• Officially putting this repository into maintenance-only mode.

1.1

• Upgraded to Python 3 installed within the environment, various quality of life improvements around initial setup and renewal.

1.0

• Many improvements thanks to contributors from across the globe. Together, we have drastically reduced the amount of customization needed; configs can be mounted directly into a prebuilt image, and the configurations can even be templated.

0.8

• Ditch cron, it never liked me anway. Just use sleep and a while loop instead.

0.7

• Complete rewrite, build this image on top of the nginx image, and run cron/certbot alongside nginx so that we can have nginx configs dynamically enabled as we get SSL certificates.

0.6

• Add nginx_auto_enable.sh script to /etc/letsencrypt/ so that users can bring nginx up before SSL certs are actually available.

0.5

• Change the name to docker-certbot-cron, update documentation, strip out even more stuff I don't care about.

0.4

• Rip out a bunch of stuff because @staticfloat is a monster, and likes to do things his way

0.3

• Add support for webroot mode.
• Run certbot once with all domains.

0.2

• Upgraded to use certbot client
• Changed image to use alpine linux

0.1

• Initial release

docker-nginx-certbot-old's Issues

Skript mistakes "#" for certificate path

When migrating nginx config files from a vanilla certbot installation I ran into the following problem:

Every line from the previous install had a comment added "# managed by Cerbot"

It seems like the startup script mistakes the # for a (second?) certificate file and as it (predictably) fails to read/find/evaluate it, the .nokey file is never renamed/copied and thus the virtual host remains inactive. In the log:

• echo 'Couldn'''t find keyfile # for /etc/nginx/conf.d/WhatEver.conf.nokey',

I should add that removing the comment did the trick.

Move certbot poller to separate script and process

The entrypoint script in nginx-certbot invokes kill -HUP to send a SIGHUP to nginx, so that it reloads its config. This may not work in environments where the container is monitored for any signals sent and interpreted as failure (eg AWS Elastic Beanstalk, where this behaviour is observed).

To mitigate this, we propose the following:

• Modify entrypoint.sh so that the certbot poller is implemented in a separate script and run in a separate process, and;
• Introduce an optional parameter that delays starting the poller for a given number of seconds

A rough sketch of what this might look like can be found at isomerpages/isomer-redirection@07d7f13.

Add Docker Hub Tags

Could specific tags be added for each new release on Docker Hub, so that it's possible to pin to a specific image? Tracking latest can be a bit challenging for production usage, but the builds are not reproducible if the underlying image can change at any time.

Some of these concerns are outlined in this blog post: https://vsupalov.com/docker-latest-tag/

Thanks.

Containers always exit with code 0

Hi, I can't get the container to run. After docker-compose up, it spit out some trace, then exit with code 0.

The traces:

nginx_1     | templating scripts from /etc/nginx/user.conf.d to /etc/nginx/conf.d
nginx_1     | Substituting variables 
nginx_1     |  -> /etc/nginx/user.conf.d/app.conf
nginx_1     | Done with startup
nginx_1     | Run certbot
nginx_1     | ++ parse_domains
nginx_1     | ++ for conf_file in /etc/nginx/conf.d/*.conf*
nginx_1     | ++ sed -n -r -e 's&^\s*ssl_certificate_key\s*\/etc/letsencrypt/live/(.*)/privkey.pem;\s*(#.*)?$&\1&p' /etc/nginx/conf.d/app.conf
nginx_1     | ++ xargs echo
nginx_1     | ++ for conf_file in /etc/nginx/conf.d/*.conf*
nginx_1     | ++ sed -n -r -e 's&^\s*ssl_certificate_key\s*\/etc/letsencrypt/live/(.*)/privkey.pem;\s*(#.*)?$&\1&p' /etc/nginx/conf.d/certbot.conf
nginx_1     | ++ xargs echo
nginx_1     | + for domain in $(parse_domains)
nginx_1     | + is_renewal_required service.domain.com
nginx_1     | + last_renewal_file=/etc/letsencrypt/live/service.domain.com/privkey.pem
nginx_1     | + '[' '!' -e /etc/letsencrypt/live/service.domain.com/privkey.pem ']'
nginx_1     | + one_week_sec=604800
nginx_1     | ++ date -d now +%s
nginx_1     | + now_sec=1602608722
nginx_1     | ++ stat -c %Y /etc/letsencrypt/live/service.domain.com/privkey.pem
nginx_1     | + last_renewal_sec=1602607046
nginx_1     | + last_renewal_delta_sec=1676
nginx_1     | + is_finshed_week_sec=603124
nginx_1     | + '[' 603124 -lt 0 ']'
nginx_1     | + echo 'Not run certbot for service.domain.com; last renewal happened just recently.'
nginx_1     | Not run certbot for service.domain.com; last renewal happened just recently.
nginx_1     | + auto_enable_configs
nginx_1     | + for conf_file in /etc/nginx/conf.d/*.conf*
nginx_1     | + keyfiles_exist /etc/nginx/conf.d/app.conf
nginx_1     | ++ parse_keyfiles /etc/nginx/conf.d/app.conf
nginx_1     | ++ sed -n -e 's&^\s*ssl_certificate_key\s*\(.*\);&\1&p' /etc/nginx/conf.d/app.conf
nginx_1     | + for keyfile in $(parse_keyfiles $1)
nginx_1     | + currentfile=/etc/letsencrypt/live/service.domain.com/privkey.pem
nginx_1     | + '[' '!' -f /etc/letsencrypt/live/service.domain.com/privkey.pem ']'
nginx_1     | + return 0
nginx_1     | + '[' conf = nokey ']'
nginx_1     | + for conf_file in /etc/nginx/conf.d/*.conf*
nginx_1     | + keyfiles_exist /etc/nginx/conf.d/certbot.conf
nginx_1     | ++ parse_keyfiles /etc/nginx/conf.d/certbot.conf
nginx_1     | ++ sed -n -e 's&^\s*ssl_certificate_key\s*\(.*\);&\1&p' /etc/nginx/conf.d/certbot.conf
nginx_1     | + return 0
nginx_1     | + '[' conf = nokey ']'
nginx_1     | + set +x
nginx_1     | /scripts/entrypoint.sh: line 48:    17 Hangup                  nginx -g "daemon off;"
srv_nginx_1 exited with code 0

My setup:

Docker-compose.yml:

version: "3.8"
services:
    nginx:
        image: staticfloat/nginx-certbot
        ports:
            - "80:80/tcp"
            - "443:443/tcp"
        environment:
            CERTBOT_EMAIL: [email protected]
        volumes:
            - "./app.conf:/etc/nginx/user.conf.d/app.conf:ro"
            - "letsencrypt:/etc/letsencrypt"
        links:
            - "http-container"

    http-container:
        # ...

volumes:
    letsencrypt:

app.conf:

server {
    listen 443 ssl;
    server_name service.domain.net;
    ssl_certificate /etc/letsencrypt/live/service.domain.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/service.domain.net/privkey.pem;

    location / {
        proxy_pass http://http-container:8080;
    }
}

✅ No ISP restriction on port 80 or 443
✅ Port 80 and 443 are opened and forwarded correctly
My DNS is NoIP (A DDNS provider)

Everything seems in order, then where's the issue?

(Also is it possible to make the trace less verbose? It seems to print out every line of code it's executing, and I don't need that in my logs.)

Thanks

CVE-2020-1971: Push out a new Docker build for libssl 1.1.1i

Official docker images have been released to address the abovementioned CVE (discussion at nginxinc/docker-nginx#480). I would like to request a new build of nginx-certbot that picks up the fix.

Building too often results in rate limit

While developing on top of the sample docker-compose.yml file found in the example directory, I hit the rate limit for Certbot after using docker-compose up too often:

acme.messages.Error: urn:ietf:params:acme:error:rateLimited :: There were too many requests of a given type :: Error creating new order :: too many certificates already issued for exact set of domains: mqtt.autofarm.app: see https://letsencrypt.org/docs/rate-limits/

Is there a way to check if the certifications have been made before running the renewal script?

Thank you for this repo!

How to use webroot auth for certbot?

multiple domain with single public ip use case

Can I use your docker certbot for my case? if possible this is the case:

• I have one public IP and want to serve using your docker-compose.
• I have two container, each located on difference server, serving example.com website and example.org website
• example.com DNS A Record will be pointed to that public IP.
• example.org DNS A Record also will be pointed to that same public IP.

Is it possible? By using something like this config, and put it inside conf.d?:

# In conf.d/examplecom.conf
server {
    listen              443 ssl;
    server_name         example.com;
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        proxy_pass http://192.168.11.2:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# In conf.d/exampleorg.conf
server {
    listen              443 ssl;
    server_name         example.org;
    ssl_certificate     /etc/letsencrypt/live/example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem;

    location / {
        proxy_pass http://192.168.12.2:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Not really working anything. Can't connect to my proxy pass

Im testing without domain first to see if it works..

• http://localhost:80

frontend_1 | 1xx.18.0.1 - -"GET / HTTP/1.1" 301 169 "-" "Wget/1.14 (linux-gnu)" "-"
frontend_1 | [info] 29#29: *4 client 1xx.18.0.1 closed keepalive connection

So it's doing something..

• wget http://localhost:443 gives me: Connecting to localhost (localhost)|127.0.0.1|:443... connected. HTTP request sent, awaiting response... Read error (Connection reset by peer) in headers. Retrying.
• Nothing happens in logs

.conf

server {
    listen              443 ssl;
    server_name         *.aaa.com;
    ssl_certificate     /etc/letsencrypt/live/aaa.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/aaa.com/privkey.pem;

    location /1/ {
        proxy_pass http://127.0.0.1:8081;
    }
    location /2/ {
        proxy_pass http://127.0.0.1:8443;
    }
    location /3/ {
        proxy_pass https://google.com;
    }
}

Also we should poin the root to this ip or the www version of the website or doesnt matter?

add ARM support

It would be great if an ARM23/64 image would be available.

Add cron job back with supercronic

Hi there this dockerfile really saved me. I like the simplicity and the functionality is pretty much exactly what I needed. It works great for multiple server blocks as well.

I recently found and used https://github.com/aptible/supercronic to do cron inside a docker container. It's build specifically for running cron jobs in containers. I needed mine for a php schedule. But I think it can solve your case as well.

Subdomains routed wrong

I don't know if this is a nginx problem or a container problem, but here is the issue I'm facing: I have created a conf template for my static subdomains:

server {
    listen              443 ssl;
    server_name         [sub].domain;
    ssl_certificate     /etc/letsencrypt/live/domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain/privkey.pem;
    

    root /var/www/[sub].domain;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

The problem is that some subdomains redirect to other sites I have configured (in particular the first in alphabetical order, eg. aa.com)

What could be this issue caused by? I've tried running nginx -t but all the configurations I'm running are fine.
Permissions are fine too (for testing purposes I've even tried chmod 777 without any luck).

More robust cert age check

Thanks for this very useful image!
One caveat I encountered while moving my cert files around is that their timestamp had changed which broke the is_renewal_required() check.
So instead of checking the cert age by looking at privkey.pem last modify timestamp with:
last_renewal_sec=$(stat -c %Y "$last_renewal_file")
Wouldn't it be better and more logical to check the cert.pem true start date with openssl this way?:
last_renewal_sec=$(date --date="$(openssl x509 -startdate -noout -in $last_renewal_file | cut -d= -f 2)" '+%s')

Possible disk leak

Today my system stopped because container staticfloat/nginx-certbot consumed all available disk space. I was unable to do extended diagnostic because I needed to bring the system up as soon as possible, so I just dropped the container and restarted it. It was working for at least 5-6 months, maybe even more, so there's no immediate danger for every system using this image. I will monitor the situation and let know if I found out something.

In the mean time, if anybody seeng this and has a staticfloat/nginx-certbot container with serious uptime - please check it and look where the space is consumed, if any.

Image ID of my image is c31307a8123e, sha256 - 113300163d871119a261738964d7d8f24a478a605d56888a82e9f45fb353698d.

Domain not working without www

If I follow the instructions and create my .conf like this

server_name         www.devenv.ai devenv.ai;
ssl_certificate     /etc/letsencrypt/live/www.devenv.ai/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.devenv.ai/privkey.pem;

my website only works with www. How can I get it to work for devenv.ai alone too?