FilesExpand file tree

master

/

docker-compose-letsencrypt-ssl.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

70 lines (67 loc) · 3.2 KB

master

/

docker-compose-letsencrypt-ssl.yml

Copy path

Top

File metadata and controls

• Code
• Blame

70 lines (67 loc) · 3.2 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

# nginx-proxy + acme-companion (Let's Encrypt) — production setup

#

# Modernized from the deprecated images:

# jwilder/nginx-proxy -> nginxproxy/nginx-proxy

# jrcs/letsencrypt-nginx-proxy-companion -> nginxproxy/acme-companion

# (the jwilder/jrcs images have been unmaintained since ~2021).

#

# Each application container opts in by setting these environment variables:

# VIRTUAL_HOST=app.example.com -> reverse-proxy routing

# LETSENCRYPT_HOST=app.example.com -> automatic TLS certificate

# LETSENCRYPT_EMAIL=you@example.com -> (optional) per-app contact e-mail

# VIRTUAL_PORT=<port> -> (optional) if the app is not on port 80

# and must be attached to the same external network defined at the bottom.

#

# Default upload limit is 500 MB (client_max_body_size), set in the mounted

# ./nginx.tmpl. Override per-vhost with a file in vhost.d/ named after the host.

#

# Modern Compose Spec — the obsolete top-level `version:` key has been dropped.

# Bring it up with: docker compose -f docker-compose-letsencrypt-ssl.yml up -d

services:

nginx-proxy:

image: nginxproxy/nginx-proxy:1.11.2

container_name: nginx-proxy

restart: unless-stopped

ports:

- "80:80"

- "443:443"

volumes:

# certs is read-only here; acme-companion (below) writes the certificates.

- /home/core/data/nginx-proxy/certs:/etc/nginx/certs:ro

- /home/core/data/nginx-proxy/vhost.d:/etc/nginx/vhost.d:rw

- /home/core/data/nginx-proxy/html:/usr/share/nginx/html:rw

- /home/core/data/nginx-proxy/dhparam:/etc/nginx/dhparam:rw

- /var/run/docker.sock:/tmp/docker.sock:ro

# Custom nginx template mounted from disk so you can edit it without

# rebuilding the image. It carries the default `client_max_body_size 500m`.

# After editing ./nginx.tmpl, restart the container to regenerate the config.

- ./nginx.tmpl:/app/nginx.tmpl:ro

labels:

# Lets acme-companion discover which container is the nginx proxy.

- "com.github.nginx-proxy.nginx"

acme-companion:

image: nginxproxy/acme-companion:2.7.1

container_name: nginx-proxy-acme

restart: unless-stopped

depends_on:

- nginx-proxy

environment:

# Fallback contact e-mail used when a container omits LETSENCRYPT_EMAIL.

- DEFAULT_EMAIL=you@example.com

# Uncomment to test against Let's Encrypt staging before going live:

# - ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory

volumes:

# certs is read-write here so the companion can write/renew certificates.

- /home/core/data/nginx-proxy/certs:/etc/nginx/certs:rw

- /home/core/data/nginx-proxy/vhost.d:/etc/nginx/vhost.d:rw

- /home/core/data/nginx-proxy/html:/usr/share/nginx/html:rw

# Persists the acme.sh account + state so certs aren't re-requested on restart.

- /home/core/data/nginx-proxy/acme.sh:/etc/acme.sh:rw

- /var/run/docker.sock:/var/run/docker.sock:ro

# All proxied application containers must join this same network.

# Create it once with: docker network create nginx-proxy-bridge-network

# (or point `name` at your existing network, e.g. "suri").

networks:

default:

external: true

name: nginx-proxy-bridge-network