acme-companion

I also prefer to run Nginx as vanilla as possible, but having automatic renewal of certificates is something which is really nice. I looked around at some of the more popular solutions, but didn't like the mounting of the docker socket required by [acme-companion][1], or the lack of bootstrapping capability of [nginx-certbot][2], so I made [something][3] that solved both of those issues. A self contained Docker container that is able to populate the certificate request form what you write in your Nginx configuration files. Please check it out if you have time, and I will gladly take any feedback if you have any! [1]: https://github.com/nginx-proxy/acme-companion [2]: https://github.com/wmnnd/nginx-certbot [3]: https://github.com/JonasAlfredsson/docker-nginx-certbot

The biggest difference/issue is that podman doesn't provide a daemon of events on its own. It's docker-compose compatibility is tied up in essentially re-implementing/emulating that, which partially defeats the purpose. My main need for the daemon component is https://github.com/nginx-proxy/acme-companion which listens to docker events to know when a new service is available to proxy.

If you want to hack up a quick setup, you could use: https://github.com/nginx-proxy/nginx-proxy I've used it for local development setups and deployed internal apps using it, so no FAANG scale traffic, but it's quite simple to drop it in and then manage routing traffic using the `VIRTUAL_HOST` env variable on your containers. It supports custom configration if you mount a file in the right location. Also it has automatic letsencrypt with: https://github.com/nginx-proxy/docker-letsencrypt-nginx-prox....

These are all extremely valid points! I guess I should've clarified how things work a bit (which I am currently in the process of documenting how it works and how to deploy it). Ingress management is done with the very useful nginx-proxy[0] service that loads virtual host definitions directly from the docker daemon and sets virtual hosts based on env vars set on the container. Configuration changes are loaded using an nginx reload, so even if there was an error in the configuration (which I personally have never run into though is likely possible), it wouldn't take effect. LE is then handled using the nginx-proxy-letsencrypt-companion[1]. My goal was to abstract away reverse proxy+cert management and I think any solution (traefik, caddy, etc) would work here and I'm more than happy to change it. More or less just went with nginx since it

I've been using https://github.com/jwilder/nginx-proxy and https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... to achieve this for a year or two now. I prefer it because the domain configuration is set on the backend site, rather than the proxy image itself, which means you don't have to worry about cleaning anything up when you remove an image.

This is where it comes from and that's probably why it isn't explained in the post: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... It seems like if the author(s) of docker-letsencrypt-nginx-proxy-companion had assumed something like docker compose or kubernetes that neatly handles sharing volumes between containers, they probably wouldn't have made the mistake of giving a docker container access to docker for such a trivial use. I disagree that there's never a good reason to do this though. A docker control panel, or a CI or FaaS that spawns docker containers, can be a good reason to do this. https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d... BTW there's no escaping the container when you're doing this intentionally.

Used to manage it all manually, set up https://mailcow.email/ after a server move a couple years ago. It's been great, running inside docker now via docker-compose alongside https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... for automatic letsencrypt for the web interface along with my additional web services hosted on the same server. I had one minor hiccup when upgrading wherein I had to restart all docker containers, that's about it in terms of maintenance.

Automated with Docker, https://github.com/jwilder/nginx-proxy and https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

If you are deploying with Docker there's this rather simple letsencrypt setup that I literally just got working: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... Just add the environment variables for your container, and the docker compose file from [1] and you're proxying with Let Encrypt SSL support. I encountered a few gotchas so feel free to email if you get stuck. It really does do some interesting magic but so far seems to work great! [1] Docker compose file and nginx.tpml here: https://github.com/evertramos/docker-compose-letsencrypt-ngi...

Why not? There are even docker containers that will do everything for you, all you have to do is tag your application containers: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

Alternately https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

I like using this: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... Works like a charm

I just recently re-created my personal wiki: https://wiki.jradd.com using: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... This dockerfile/repo made this incredibly easy to scale with nginx/ssl/docker. Simply add the desired domain name as environment variable when starting your container, and letsencrypt will register your cert, and re-register it at an interval. I haven't yet tried the other methods posted in this thread, but not sure I will want to, since this was so easy.

I use 2 containers to accomplish this: https://github.com/jwilder/nginx-proxy https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... Since both are long running processes, it makes sense to keep them in separate containers.