Score:0

Auto renew LetsEncrypt cert with nginx under Docker

sk flag

I'm having troubles setting up a auto renew for LetsEncrypt certificates.

I run nginx under Docker container that serves Django application.

Here is my docker-compose file:

version: '3.8'

services:
  app:
    image: registry.myimage.app
    restart: always
    build:
      context: .
      dockerfile: ./app/Dockerfile
    ports:
      - "8000:8000"
    command: /start
    expose:
      - 8000
    env_file:
      - .env

  nginx:
    image: registry.myimage.nginx:latest
    build: .app/nginx
    restart: unless-stopped
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - app
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"

  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt
    command: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

volumes:
  app:

and my nginx.conf file:

upstream django {
    server app:8000;
}

server {
    listen 80;
    listen [::]:80;
    server_name www.mywebsite.com mywebsite.com;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mywebsite.com www.mywebsite.com;

    # SSL
    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem;

    ssl_session_cache shared:le_nginx_SSL:10m;
    ssl_session_timeout 1440m;
    ssl_session_tickets off;

    client_max_body_size 4G;
    keepalive_timeout 5;

    location = /favicon.ico { access_log off; log_not_found off; }
    location / {
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header Host $http_host;
          proxy_redirect off;
          proxy_pass http://django;
        }

    location /static/ {
        alias /vol/web/static/;
    }

    location /media/ {
        alias /vol/web/media/;
    }
}

server {
    if ($host = www.mywebsite.com) {
        return 301 https://mywebsite.com$request_uri;
    }


    if ($host = mywebsite.com) {
        return 301 https://mywebsite.com$request_uri;
    }


    listen 80;
    server_name mywebsite.com www.mywebsite.com;
    return 404;

}

server {
    listen 443 ssl default_server;

    # SSL
    ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem;

    server_name _;
    return 444;
}

What's wrong with my configuration and why it does not automatically renew my certificates?

PS: Please note that I'm very new to nginx configuation and there might be some trivial errors.

in flag
Certbot needs access to the document root of the webserver to be able to renew certificates.
popcorn avatar
sk flag
@GeraldSchneider I'm not really sure what that means. What should I change in my config?
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.