diff --git a/.dockerignore b/.dockerignore index 3cd07fc..d5bfef9 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,4 +1,5 @@ +.* ++docs +go +test +LICENSE diff --git a/README.md b/README.md index 581db86..1c3b37f 100644 --- a/README.md +++ b/README.md @@ -4,239 +4,109 @@ [![Docker stars](https://img.shields.io/docker/stars/jrcs/letsencrypt-nginx-proxy-companion.svg)](https://hub.docker.com/r/jrcs/letsencrypt-nginx-proxy-companion "Click to view the image on Docker Hub") [![Docker pulls](https://img.shields.io/docker/pulls/jrcs/letsencrypt-nginx-proxy-companion.svg)](https://hub.docker.com/r/jrcs/letsencrypt-nginx-proxy-companion "Click to view the image on Docker Hub") -letsencrypt-nginx-proxy-companion is a lightweight companion container for the [nginx-proxy](https://github.com/jwilder/nginx-proxy). It allows the creation/renewal of Let's Encrypt certificates automatically. See [Let's Encrypt section](#lets-encrypt) for configuration details. +**letsencrypt-nginx-proxy-companion** is a lightweight companion container for [**nginx-proxy**](https://github.com/jwilder/nginx-proxy). + +It handles the automated creation, renewal and use of Let's Encrypt certificates for proxyed Docker containers. Please note that [letsencrypt-nginx-proxy-companion does not work with ACME v2 endpoints yet](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/issues/319). ### Features: -* Automatic creation/renewal of Let's Encrypt certificates using original nginx-proxy container. -* Support creation of Multi-Domain ([SAN](https://www.digicert.com/subject-alternative-name.htm)) Certificates. -* Automatic creation of a Strong Diffie-Hellman Group (for having an A+ Rate on the [Qualsys SSL Server Test](https://www.ssllabs.com/ssltest/)). -* Automatic creation of a self-signed [default certificate](https://github.com/jwilder/nginx-proxy#how-ssl-support-works) if a user-provided one can't be found. +* Automated creation/renewal of Let's Encrypt (or other ACME CAs) certificates using [**simp_le**](https://github.com/zenhack/simp_le). +* Let's Encrypt / ACME domain validation through `http-01` challenge only. +* Automated update and reload of nginx config on certificate creation/renewal. +* Support creation of Multi-Domain (SAN) Certificates. +* Creation of a Strong Diffie-Hellman Group at startup. * Work with all versions of docker. -![schema](./schema.png) +### Requirements: +* Your host **must** be publicly reachable on **both** port `80` and `443`. +* Check your firewall rules and **do not attempt to block port `80`** as that will prevent `http-01` challenges from completing. +* For the same reason, you can't use nginx-proxy's [`HTTPS_METHOD=nohttp`](https://github.com/jwilder/nginx-proxy#how-ssl-support-works). +* The (sub)domains you want to issue certificates for must correctly resolve to the host. +* Your DNS provider must [answers correctly to CAA record requests](https://letsencrypt.org/docs/caa/). +* If your (sub)domains have AAAA records set, the host must be publicly reachable over IPv6 on port `80` and `443`. -#### Usage +![schema](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/blob/master/schema.png) -To use it with original [nginx-proxy](https://github.com/jwilder/nginx-proxy) container you must declare 3 writable volumes from the [nginx-proxy](https://github.com/jwilder/nginx-proxy) container: -* `/etc/nginx/certs` to create/renew Let's Encrypt certificates -* `/etc/nginx/vhost.d` to change the configuration of vhosts (needed by Let's Encrypt) -* `/usr/share/nginx/html` to write challenge files. +## Basic usage (with the nginx-proxy container) + +Three writable volumes must be declared on the **nginx-proxy** container so that they can be shared with the **letsencrypt-nginx-proxy-companion** container: + +* `/etc/nginx/certs` to store certificates, private keys and ACME account keys (readonly for the **nginx-proxy** container). +* `/etc/nginx/vhost.d` to change the configuration of vhosts (required so the CA may access `http-01` challenge files). +* `/usr/share/nginx/html` to write `http-01` challenge files. Example of use: -* First start nginx with the 3 volumes declared: -```bash -$ docker run -d -p 80:80 -p 443:443 \ +### Step 1 - nginx-proxy + +Start **nginx-proxy** with the three additional volumes declared: + +```shell +$ docker run --detach \ --name nginx-proxy \ - -v /path/to/certs:/etc/nginx/certs:ro \ - -v /etc/nginx/vhost.d \ - -v /usr/share/nginx/html \ - -v /var/run/docker.sock:/tmp/docker.sock:ro \ - --label com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy \ + --publish 80:80 \ + --publish 443:443 \ + --volume /etc/nginx/certs \ + --volume /etc/nginx/vhost.d \ + --volume /usr/share/nginx/html \ + --volume /var/run/docker.sock:/tmp/docker.sock:ro \ jwilder/nginx-proxy ``` -The "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy" label is needed so that the letsencrypt container knows which nginx proxy container to use. -* Second start this container: -```bash -$ docker run -d \ - -v /path/to/certs:/etc/nginx/certs:rw \ - -v /var/run/docker.sock:/var/run/docker.sock:ro \ +Binding the host docker socket (`/var/run/docker.sock`) inside the container to `/tmp/docker.sock` is a requirement of **ninx-proxy**. + +### Step 2 - letsencrypt-nginx-proxy-companion + +Start the **letsencrypt-nginx-proxy-companion** container, getting the volumes from **nginx-proxy** with `--volumes-from`: + +```shell +$ docker run --detach \ + --name nginx-proxy-letsencrypt \ --volumes-from nginx-proxy \ + --volume /var/run/docker.sock:/var/run/docker.sock:ro \ jrcs/letsencrypt-nginx-proxy-companion ``` -Then start any containers you want proxied with a env var `VIRTUAL_HOST=subdomain.youdomain.com` +The host docker socket has to be bound inside this container too, this time to `/var/run/docker.sock`. - $ docker run -e "VIRTUAL_HOST=foo.bar.com" ... +### Step 3 - proxyed container(s) -The containers being proxied must [expose](https://docs.docker.com/reference/run/#expose-incoming-ports) the port to be proxied, either by using the `EXPOSE` directive in their `Dockerfile` or by using the `--expose` flag to `docker run` or `docker create`. See [nginx-proxy](https://github.com/jwilder/nginx-proxy) for more informations. To generate automatically Let's Encrypt certificates see next section. +Once both **nginx-proxy** and **letsencrypt-nginx-proxy-companion** containers are up and running, start any container you want proxyed with environment variables `VIRTUAL_HOST` and `LETSENCRYPT_HOST` both set to the domain(s) your proxyed container is going to use. -#### Separate Containers -nginx proxy can also be run as two separate containers using the [jwilder/docker-gen](https://github.com/jwilder/docker-gen) -image and the official [nginx](https://hub.docker.com/_/nginx/) image. +[`VIRTUAL_HOST`](https://github.com/jwilder/nginx-proxy#usage) control proxying by **nginx-proxy** and `LETSENCRYPT_HOST` control certificate creation and SSL enabling by **letsencrypt-nginx-proxy-companion**. -You may want to do this to prevent having the docker socket bound to a publicly exposed container service (avoid to mount the docker socket in the nginx exposed container). It's better in a security point of view. +Certificates will only be issued for containers that have both `VIRTUAL_HOST` and `LETSENCRYPT_HOST` variables set to domain(s) that correctly resolve to the host, provided the host is publicly reachable. -To run nginx proxy as a separate container you'll need: - -1) To mount the template file [nginx.tmpl](https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl) into the docker-gen container. You can get the latest official [nginx.tmpl](https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl) with a command like: -```bash -curl https://raw.githubusercontent.com/jwilder/nginx-proxy/master/nginx.tmpl > /path/to/nginx.tmpl -``` - -2) Use the `com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen` label on the docker-gen container, or explicitly set the `NGINX_DOCKER_GEN_CONTAINER` environment variable to the name or id of that container. - -Examples: - -* First start nginx (official image) with volumes: -```bash -$ docker run -d -p 80:80 -p 443:443 \ - --name nginx \ - -v /etc/nginx/conf.d \ - -v /etc/nginx/vhost.d \ - -v /usr/share/nginx/html \ - -v /path/to/certs:/etc/nginx/certs:ro \ - --label com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy \ +```shell +$ docker run --detach \ + --name your-proxyed-app + --env "VIRTUAL_HOST=subdomain.yourdomain.tld" \ + --env "LETSENCRYPT_HOST=subdomain.yourdomain.tld" \ + --env "LETSENCRYPT_EMAIL=mail@yourdomain.tld" \ nginx ``` -* Second start the docker-gen container with the shared volumes and the template file: -```bash -$ docker run -d \ - --name nginx-gen \ - --volumes-from nginx \ - -v /path/to/nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro \ - -v /var/run/docker.sock:/tmp/docker.sock:ro \ - --label com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen \ - jwilder/docker-gen \ - -notify-sighup nginx -watch -wait 5s:30s /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf +Albeit **optional**, it is **recommended** to provide a valid email address through the `LETSENCRYPT_EMAIL` environment variable, so that Let's Encrypt can warn you about expiring certificates and allow you to recover your account. + +The containers being proxied must expose the port to be proxied, either by using the `EXPOSE` directive in their Dockerfile or by using the `--expose` flag to `docker run` or `docker create`. + +If the proxyed container listen on and expose another port than the default `80`, you can force **nginx-proxy** to use this port with the [`VIRTUAL_PORT`](https://github.com/jwilder/nginx-proxy#multiple-ports) environment variable. + +Example using [Grafana](https://hub.docker.com/r/grafana/grafana/) (expose and listen on port 3000): + +```shell +$ docker run --detach \ + --name grafana + --env "VIRTUAL_HOST=othersubdomain.yourdomain.tld" \ + --env "VIRTUAL_PORT=3000" \ + --env "LETSENCRYPT_HOST=othersubdomain.yourdomain.tld" \ + --env "LETSENCRYPT_EMAIL=mail@yourdomain.tld" \ + grafana/grafana ``` -* Then start this container: -```bash -$ docker run -d \ - --name nginx-letsencrypt \ - --volumes-from nginx \ - -v /path/to/certs:/etc/nginx/certs:rw \ - -v /var/run/docker.sock:/var/run/docker.sock:ro \ - jrcs/letsencrypt-nginx-proxy-companion -``` +Repeat [Step 3](#step-3---proxyed-containers) for any other container you want to proxy. -* Then start any containers to be proxied as described previously. +## Additional documentation -Note: -If the 3 containers are using static names, both labels `com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy` on nginx container and `com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen` on the docker-gen container can be removed. - -The docker environment variables to be set on the letsencrypt container are: -* `NGINX_PROXY_CONTAINER` set to the name of the nginx container (here `nginx`) -* `NGINX_DOCKER_GEN_CONTAINER` set to the name of the docker-gen container (here `nginx-gen`) - -Example: -```bash -$ docker run -d \ - --name nginx-letsencrypt \ - --volumes-from nginx \ - -v /path/to/certs:/etc/nginx/certs:rw \ - -v /var/run/docker.sock:/var/run/docker.sock:ro \ - -e NGINX_DOCKER_GEN_CONTAINER=nginx-gen \ - -e NGINX_PROXY_CONTAINER=nginx \ - jrcs/letsencrypt-nginx-proxy-companion -``` - - -#### Let's Encrypt - -To use the Let's Encrypt service to automatically create a valid certificate for virtual host(s), declare the `LETSENCRYPT_HOST` environment variable in each to-be-proxied application containers. - -The `LETSENCRYPT_HOST` variable most likely needs to be set to the same value as the `VIRTUAL_HOST` variable and must be publicly reachable domains. Specify multiple hosts with a comma delimiter. - -##### Example: -```bash -$ docker run -d \ - --name example-app \ - -e "VIRTUAL_HOST=example.com,www.example.com,mail.example.com" \ - -e "LETSENCRYPT_HOST=example.com,www.example.com,mail.example.com" \ - -e "LETSENCRYPT_EMAIL=foo@bar.com" \ - tutum/apache-php -``` - -**Note:** the `VIRTUAL_HOST` (and `LETSENCRYPT_HOST`) must be (a) reachable domain(s) for LetEncrypt to be able to validate the challenge and provide the certificate. - -**Note on CAA**: Please ensure that your DNS provider answers correctly to CAA record requests. [If your DNS provider answer with an error, Let's Encrypt won't issue a certificate for your domain](https://letsencrypt.org/docs/caa/). Let's Encrypt do not require that you set a CAA record on your domain, just that your DNS provider answers correctly. - -**Note on IPv6**: If the domain or subdomain you want to issue certificate for has an AAAA record set, Let's Encrypt will favor challenge validation over IPv6. [There is an IPv6 to IPv4 fallback in place but Let's Encrypt cannot guarantee it'll work in every possible case](https://github.com/letsencrypt/boulder/issues/2770#issuecomment-340489871), so bottom line is **if you are not sure of both your host and your host's Docker reachability over IPv6, do not advertise an AAAA record** or LE challenge validation might fail. - -The following environment variables are optional and parameterize the way the Let's Encrypt client works. - -##### Contact address - -The `LETSENCRYPT_EMAIL` variable must be a valid email and will be used by Let's Encrypt to warn you of impeding certificate expiration (should the automated renewal fail) or for account recovery. It is strongly advised to provide a valid contact address using this variable. - -##### Private key size - -The `LETSENCRYPT_KEYSIZE` variable determines the size of the requested key (in bit, defaults to 4096). - -##### Multi-domain ([SAN](https://www.digicert.com/subject-alternative-name.htm)) certificates -If you want to create multi-domain ([SAN](https://www.digicert.com/subject-alternative-name.htm)) certificates add the base domain as the first domain of the `LETSENCRYPT_HOST` environment variable (see [the example](#example) above). - -##### Test certificates -If you want to create test certificates that don't have the 5 certs/week/domain limits define the `LETSENCRYPT_TEST` environment variable with a value of `true` (in the containers where you request certificates with `LETSENCRYPT_HOST`). If you want to do this globally for all containers, set `ACME_CA_URI` as described below. - -##### Automatic certificate renewal -Every hour (3600 seconds) the certificates are checked and per default every certificate that will expire in the next [30 days](https://github.com/zenhack/simp_le/blob/a8a8013c097910f8f3cce046f1077b41b745673b/simp_le.py#L73) (90 days / 3) is renewed. - -If you want to manually set a different minimum validity for certificates, you can set the `LETSENCRYPT_MIN_VALIDIDTY` environment variable (in each container that defines the `LETSENCRYPT_HOST` variable) to the desired period in seconds. -Note that the possible values are internally capped at an upper bound of 7603200 (88 days) and a lower bound of 7200 (2 hours) as a security margin, considering that the Let's Encrypt CA does only issues certificates with a lifetime of [90 days](https://letsencrypt.org/2015/11/09/why-90-days.html) (upper bound), the rate limits imposed on certificate renewals are [5 per week](https://letsencrypt.org/docs/rate-limits/) (upper bound), and the fact that the certificates are checked and renewed accordingly every hour (lower bound). - -##### Force certificates renewal -If needed, you can force a running letsencrypt-nginx-proxy-companion container to renew all certificates that are currently in use. Replace `nginx-letsencrypt` with the name of your letsencrypt-nginx-proxy-companion container in the following command: - -```bash -$ docker exec nginx-letsencrypt /app/force_renew -``` - -##### Restart container on certificate renewal -Per default letsencrypt-nginx-proxy-companion only reloads the nginx-proxy container when new certificates are issued or renewed. But it may be desirable to use the certificates inside the containers for other purposes than HTTPS (e.g. FTPS Server), and that would require to also restart the containers using the certificates, whenever these certificates are renewed. This can be achieved by defining the `LETSENCRYPT_RESTART_CONTAINER` environment variable with a value of `true` for the containers that you want to be restarted on certificate renewal (and have the `LETSENCRYPT_HOST` variable set). - -##### Show certificates informations -To display informations about your existing certificates, use the following command: - -```bash -$ docker exec nginx-letsencrypt /app/cert_status -``` - -As for the forced renewal command, replace `nginx-letsencrypt` with the name of your letsencrypt-nginx-proxy-companion container. - -##### ACME account keys -By default the container will save the first ACME account key created for each ACME API endpoint used, and will reuse it for all subsequent authorizations and issuances requests made to this endpoint. This behavior is enabled by default to avoid running into Let's Encrypt account [rate limits](https://letsencrypt.org/docs/rate-limits/). - -For instance, when using the default Let's Encrypt production endpoint, the container will save the first account key created for this endpoint as `/etc/nginx/certs/accounts/acme-v01.api.letsencrypt.org/directory/default.json` and will reuse it for future requests made to this endpoint. - -If required, you can use multiple accounts for the same ACME API endpoint by using the `LETSENCRYPT_ACCOUNT_ALIAS` environment variable on your proxyed container. This instruct the letsencrypt_nginx_proxy_companion container to look for an account key named after the provided alias instead of `default.json`. For example, `LETSENCRYPT_ACCOUNT_ALIAS=client1` will use the key named `client1.json` in the corresponding ACME API endpoint folder for this proxyed container (or will create it if it does not exists yet). - -Please see the **One Account or Many?** paragraph on [Let's Encrypt Integration Guide](https://letsencrypt.org/docs/integration-guide/) for additional informations. - -If you want to disable the account key reutilization entirely, you can set the environment variable `REUSE_ACCOUNT_KEYS` to `false` on the letsencrypt_nginx_proxy_companion container. This creates a new ACME registration with a corresponding account key for each new certificate issuance. Note that this won't create new account keys for certs already issued before `REUSE_ACCOUNT_KEYS` is set to `false`. This is not recommended unless you have specific reasons to do so. - -#### Optional container environment variables - -Optional letsencrypt-nginx-proxy-companion container environment variables for custom configuration. - -* `ACME_CA_URI` - Directory URI for the CA ACME API endpoint (default: ``https://acme-v01.api.letsencrypt.org/directory``). If you set it's value to `https://acme-staging.api.letsencrypt.org/directory` letsencrypt will use test servers that don't have the 5 certs/week/domain limits. You can also create test certificates per container (see [let's encrypt test certificates](#test-certificates)) - -For example - -```bash -$ docker run -d \ - -e "ACME_CA_URI=https://acme-staging.api.letsencrypt.org/directory" \ - -v /path/to/certs:/etc/nginx/certs:rw \ - --volumes-from nginx-proxy \ - -v /var/run/docker.sock:/var/run/docker.sock:ro \ - jrcs/letsencrypt-nginx-proxy-companion -``` - -* `DEBUG` - Set it to `true` to enable debugging of the entrypoint script and generation of LetsEncrypt certificates, which could help you pin point any configuration issues. - -* `REUSE_ACCOUNT_KEYS` - Set it to `false` to disable the account keys reutilization (see [ACME account keys](#acme-account-keys)). - -* `REUSE_PRIVATE_KEYS` - Set it to `true` to make simp_le reuse previously generated private key for each certificate instead of creating a new one on certificate renewal. Recommended if you intend to use HPKP. - -* The `com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy` label - set this label on the nginx-proxy container to tell the docker-letsencrypt-nginx-proxy-companion container to use it as the proxy. - -* The `com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen` label - set this label on the docker-gen container to tell the docker-letsencrypt-nginx-proxy-companion container to use it as the docker-gen when it's split from nginx (separate containers). - -* `DHPARAM_BITS` - Change the size of the Diffie-Hellman key generated by the container from the default value of 2048 bits. For example `-e DHPARAM_BITS=1024` to support some older clients like Java 6 and 7. - -#### Examples: - -If you want other examples how to use this container, look at: - -* [Evert Ramos's Examples](https://github.com/evertramos/docker-compose-letsencrypt-nginx-proxy-companion) - using docker-compose version '3' -* [Karl Fathi's Examples](https://github.com/fatk/docker-letsencrypt-nginx-proxy-companion-examples) -* [More examples from Karl](https://github.com/pixelfordinner/pixelcloud-docker-apps/tree/master/nginx-proxy) -* [George Ilyes' Examples](https://github.com/gilyes/docker-nginx-letsencrypt-sample) -* [Dmitry's simple docker-compose example](https://github.com/dmitrym0/simple-lets-encrypt-docker-compose-sample) -* [Radek's docker-compose jenkins example](https://github.com/dataminelab/docker-jenkins-nginx-letsencrypt) +Please check the [docs section](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/tree/master/docs) or the [project's wiki](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/wiki). diff --git a/docs/Advanced-usage.md b/docs/Advanced-usage.md new file mode 100644 index 0000000..0bac3af --- /dev/null +++ b/docs/Advanced-usage.md @@ -0,0 +1,81 @@ +## Advanced usage (with the nginx and docker-gen containers) + +**nginx-proxy** can also be run as two separate containers using the [jwilder/**docker-gen**](https://github.com/jwilder/docker-gen) image and the official [**nginx**](https://hub.docker.com/_/nginx/) image. You may want to do this to prevent having the docker socket bound to a publicly exposed container service (ie avoid mounting the docker socket in the nginx exposed container). + +**NOTE**: The first time this container is launched in a three container setup, it will generates a new 2048 bits Diffie-Hellman parameters file. This process can take up to several minutes to complete on lower end hosts, and certificates creation won't start before that (be patient). + +Please read and try [basic usage](./Basic-usage.md) before using the three containers setup. In addition to the steps described there, running **nginx-proxy** as two separate containers with **letsencrypt-nginx-proxy-companion** requires the following: + +1) Download and mount the template file [nginx.tmpl](https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl) into the **docker-gen** container. You can get the nginx.tmpl file with a command like: + +``` +curl https://raw.githubusercontent.com/jwilder/nginx-proxy/master/nginx.tmpl > /path/to/nginx.tmpl +``` + +2) Use the `com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen` label on the **docker-gen** container, or explicitly set the `NGINX_DOCKER_GEN_CONTAINER` environment variable on the **letsencrypt-nginx-proxy-companion** container to the name or id of the **docker-gen** container (we'll use the later method in the example). + +3) Declare `/etc/nginx/conf.d` as a volume on the nginx container so that it can be shared with the **docker-gen** container. + +Example: + +### Step 1 - nginx + +* Start nginx [(official image)](https://hub.docker.com/_/nginx/) with the required volumes: + +```shell +$ docker run --detach \ + --name nginx-proxy \ + --publish 80:80 \ + --publish 443:443 \ + --name nginx \ + --volume /etc/nginx/conf.d \ + --volume /etc/nginx/vhost.d \ + --volume /usr/share/nginx/html \ + --volume /etc/nginx/certs \ + nginx +``` + +### Step 2 - docker-gen + +* Start the **docker-gen** container with the shared volumes (with `--volume-from`), the template file and the docker socket: + +```shell +$ docker run --detach \ + --name nginx-proxy-gen \ + --volumes-from nginx-proxy \ + --volume /path/to/nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro \ + --volume /var/run/docker.sock:/tmp/docker.sock:ro \ + jwilder/docker-gen \ + -notify-sighup nginx-proxy -watch -wait 5s:30s /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf +``` + +Note that you must pass the exact name of the **nginx** container to **docker-gen** `-notify-sighup` argument (here `nginx-proxy`). + + +### Step 3 - letsencrypt-nginx-proxy-companion + +* Start the **letsencrypt-nginx-proxy-companion** container with the `NGINX_DOCKER_GEN_CONTAINER` environment variable correctly set: + +```shell +$ docker run --detach \ + --name nginx-proxy-letsencrypt \ + --volumes-from nginx-proxy \ + --volume /var/run/docker.sock:/var/run/docker.sock:ro \ + --env "NGINX_DOCKER_GEN_CONTAINER=nginx-proxy-gen" \ + jrcs/letsencrypt-nginx-proxy-companion +``` + +### Step 4 - proxyed container(s) + +* Once the three containers are up, start any containers to be proxied as described in [basic usage](./Basic-usage.md). + +```shell +$ docker run --detach \ + --name your-proxyed-app + --env "VIRTUAL_HOST=subdomain.yourdomain.tld" \ + --env "LETSENCRYPT_HOST=subdomain.yourdomain.tld" \ + --env "LETSENCRYPT_EMAIL=mail@yourdomain.tld" \ + nginx +``` + +If you are experiencing issues with this setup, fall back to the [basic setup](./Basic-usage.md). The advanced setup is not meant to be obligatory. diff --git a/docs/Basic-usage.md b/docs/Basic-usage.md new file mode 100644 index 0000000..3b7543f --- /dev/null +++ b/docs/Basic-usage.md @@ -0,0 +1,78 @@ +## Basic usage (with the nginx-proxy container) + +Three writable volumes must be declared on the **nginx-proxy** container so that they can be shared with the **letsencrypt-nginx-proxy-companion** container: + +* `/etc/nginx/certs` to store certificates, private keys and ACME account keys (readonly for the **nginx-proxy** container). +* `/etc/nginx/vhost.d` to change the configuration of vhosts (required so the CA may access `http-01` challenge files). +* `/usr/share/nginx/html` to write `http-01` challenge files. + +Example of use: + +### Step 1 - nginx-proxy + +Start **nginx-proxy** with the three additional volumes declared: + +```shell +$ docker run --detach \ + --name nginx-proxy \ + --publish 80:80 \ + --publish 443:443 \ + --volume /etc/nginx/certs \ + --volume /etc/nginx/vhost.d \ + --volume /usr/share/nginx/html \ + --volume /var/run/docker.sock:/tmp/docker.sock:ro \ + jwilder/nginx-proxy +``` + +Binding the host docker socket (`/var/run/docker.sock`) inside the container to `/tmp/docker.sock` is a requirement of **ninx-proxy**. + +### Step 2 - letsencrypt-nginx-proxy-companion + +Start the **letsencrypt-nginx-proxy-companion** container, getting the volumes from **nginx-proxy** with `--volumes-from`: + +```shell +$ docker run --detach \ + --name nginx-proxy-letsencrypt \ + --volumes-from nginx-proxy \ + --volume /var/run/docker.sock:/var/run/docker.sock:ro \ + jrcs/letsencrypt-nginx-proxy-companion +``` + +The host docker socket has to be bound inside this container too, this time to `/var/run/docker.sock`. + +### Step 3 - proxyed container(s) + +Once both **nginx-proxy** and **letsencrypt-nginx-proxy-companion** containers are up and running, start any container you want proxyed with environment variables `VIRTUAL_HOST` and `LETSENCRYPT_HOST` both set to the domain(s) your proxyed container is going to use. + +[`VIRTUAL_HOST`](https://github.com/jwilder/nginx-proxy#usage) control proxying by **nginx-proxy** and `LETSENCRYPT_HOST` control certificate creation and SSL enabling by **letsencrypt-nginx-proxy-companion**. + +Certificates will only be issued for containers that have both `VIRTUAL_HOST` and `LETSENCRYPT_HOST` variables set to domain(s) that correctly resolve to the host, provided the host is publicly reachable. + +```shell +$ docker run --detach \ + --name your-proxyed-app + --env "VIRTUAL_HOST=subdomain.yourdomain.tld" \ + --env "LETSENCRYPT_HOST=subdomain.yourdomain.tld" \ + --env "LETSENCRYPT_EMAIL=mail@yourdomain.tld" \ + nginx +``` + +Albeit **optional**, it is **recommended** to provide a valid email address through the `LETSENCRYPT_EMAIL` environment variable, so that Let's Encrypt can warn you about expiring certificates and allow you to recover your account. + +The containers being proxied must expose the port to be proxied, either by using the `EXPOSE` directive in their Dockerfile or by using the `--expose` flag to `docker run` or `docker create`. + +If the proxyed container listen on and expose another port than the default `80`, you can force **nginx-proxy** to use this port with the [`VIRTUAL_PORT`](https://github.com/jwilder/nginx-proxy#multiple-ports) environment variable. + +Example using [Grafana](https://hub.docker.com/r/grafana/grafana/) (expose and listen on port 3000): + +```shell +$ docker run --detach \ + --name grafana + --env "VIRTUAL_HOST=othersubdomain.yourdomain.tld" \ + --env "VIRTUAL_PORT=3000" \ + --env "LETSENCRYPT_HOST=othersubdomain.yourdomain.tld" \ + --env "LETSENCRYPT_EMAIL=mail@yourdomain.tld" \ + grafana/grafana +``` + +Repeat [Step 3](#step-3---proxyed-containers) for any other container you want to proxy. \ No newline at end of file diff --git a/docs/Container-configuration.md b/docs/Container-configuration.md new file mode 100644 index 0000000..af4e339 --- /dev/null +++ b/docs/Container-configuration.md @@ -0,0 +1,26 @@ +## Optional container environment variables for custom configuration. + +* `ACME_CA_URI` - Directory URI for the CA ACME API endpoint (defaults to ``https://acme-v01.api.letsencrypt.org/directory``). + +If you set this environment variable value to `https://acme-staging.api.letsencrypt.org/directory` the container will obtain its certificates from Let's Encrypt test API endpoint that don't have the [5 certs/week/domain limit](https://letsencrypt.org/docs/rate-limits/) (but are not trusted by browsers). + +For example + +```bash +$ docker run --detach \ + --name nginx-proxy-letsencrypt \ + --volumes-from nginx-proxy \ + --volume /path/to/certs:/etc/nginx/certs:rw \ + --volume /var/run/docker.sock:/var/run/docker.sock:ro \ + --env "ACME_CA_URI=https://acme-staging.api.letsencrypt.org/directory" \ + jrcs/letsencrypt-nginx-proxy-companion +``` +You can also create test certificates per container (see [Test certificates](./Let's-Encrypt-and-ACME.md#test-certificates)) + +* `DEBUG` - Set it to `true` to enable debugging output one the container logs, which could help you troubleshoot configuration issues. + +* `REUSE_ACCOUNT_KEYS` - Set it to `false` to disable the account keys reutilization (see [ACME account keys](./Let's-Encrypt-and-ACME.md#acme-account-keys)). + +* `REUSE_PRIVATE_KEYS` - Set it to `true` to make `simp_le` reuse previously generated private key for each certificate instead of creating a new one on certificate renewal. Recommended if you intend to use [HPKP](https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning) (please not however that HPKP has been deprecated by Google's Chrome and that its use is therefore not recommended). + +* `DHPARAM_BITS` - Change the size of the Diffie-Hellman key generated by the container from the default value of 2048 bits. For example `--env DHPARAM_BITS=1024` to support some older clients like Java 6 and 7. diff --git a/docs/Container-utilities.md b/docs/Container-utilities.md new file mode 100644 index 0000000..18414c6 --- /dev/null +++ b/docs/Container-utilities.md @@ -0,0 +1,23 @@ +The container provide the following utilities (replace `nginx-letsencrypt` with the name or ID of your **letsencrypt-nginx-proxy-companion** container when executing the commands): + +### Force certificates renewal +If needed, you can force a running **letsencrypt-nginx-proxy-companion** container to renew all certificates that are currently in use with the following command: + +```bash +$ docker exec nginx-letsencrypt /app/force_renew +``` + +### Manually trigger the service loop +You can trigger the execution of the service loop before the hourly execution with: + +```bash +$ docker exec nginx-letsencrypt /app/signal_le_service +``` +Unlike the previous command, this won't force renewal of certificates that don't need to be renewed. + +### Show certificates informations +To display informations about your existing certificates, use the following command: + +```bash +$ docker exec nginx-letsencrypt /app/cert_status +``` \ No newline at end of file diff --git a/docs/Docker-Compose.md b/docs/Docker-Compose.md new file mode 100644 index 0000000..57a5297 --- /dev/null +++ b/docs/Docker-Compose.md @@ -0,0 +1,117 @@ +## Usage with Docker Compose + +As stated by its repository, [Docker Compose](https://github.com/docker/compose) is a tool for defining and running multi-container Docker applications using a single _Compose file_. This Wiki page is not meant to be a definitive reference on how to run **nginx-proxy** and **letsencrypt-nginx-proxy-companion** with Docker Compose, as the number of possible setups is quite extensive and they can't be all covered. + +### Before your start + +Be sure to be familiar with both the [basic](./Basic-usage.md) and [avanced](./Advanced-usage.md) non compose setups, and Docker Compose usage. + +Please read [getting container IDs](./Getting-containers-IDs.md) and be aware that the `--volumes-from method` is **only** available on compose file version 2. + +The following examples are minimal, clean starting points using compose file version 2. Again they are not intended as a definitive reference. + +The use of named containers and volume is not required but helps keeping everything clear and organized. + +### Two containers example + +```yaml +version: '2' + +services: + nginx-proxy: + image: jwilder/nginx-proxy + container_name: nginx-proxy + ports: + - "80:80" + - "443:443" + volumes: + - conf:/etc/nginx/conf.d + - vhost:/etc/nginx/vhost.d + - html:/usr/share/nginx/html + - dhparam:/etc/nginx/dhparam + - certs:/etc/nginx/certs:ro + - /var/run/docker.sock:/tmp/docker.sock:ro + network_mode: bridge + + letsencrypt: + image: jrcs/letsencrypt-nginx-proxy-companion + container_name: nginx-proxy-le + volumes_from: + - nginx-proxy + volumes: + - certs:/etc/nginx/certs:rw + - /var/run/docker.sock:/var/run/docker.sock:ro + network_mode: bridge + +volumes: + conf: + vhost: + html: + dhparam: + certs: +``` + +**Note:** **nginx-proxy** Dockerfile [create a volume for `/etc/nginx/dhparam`](https://github.com/jwilder/nginx-proxy/blob/e80fc0b304bcbcf703d86392394c1a5adb823e3c/Dockerfile#L34), so this compose file include it as a named volume instead of letting it be created anyway as an anonymous volume. + +### Three containers example + +```yaml +version: '2' + +services: + nginx-proxy: + image: nginx:alpine + container_name: nginx-proxy + ports: + - "80:80" + - "443:443" + volumes: + - conf:/etc/nginx/conf.d + - vhost:/etc/nginx/vhost.d + - html:/usr/share/nginx/html + - certs:/etc/nginx/certs:ro + network_mode: bridge + + docker-gen: + image: jwilder/docker-gen + container_name: nginx-proxy-gen + command: -notify-sighup nginx-proxy -watch /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf + volumes_from: + - nginx-proxy + volumes: + - /path/to/nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl:ro + - /var/run/docker.sock:/tmp/docker.sock:ro + labels: + - "com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen" + network_mode: bridge + + letsencrypt: + image: jrcs/letsencrypt-nginx-proxy-companion + container_name: nginx-proxy-le + volumes_from: + - nginx-proxy + volumes: + - certs:/etc/nginx/certs:rw + - /var/run/docker.sock:/var/run/docker.sock:ro + network_mode: bridge + +volumes: + conf: + vhost: + html: + certs: +``` + +**Note:** don't forget to replace `/path/to/nginx.tmpl` with the actual path to the [`nginx.tmpl`](https://raw.githubusercontent.com/jwilder/nginx-proxy/master/nginx.tmpl) file you downloaded. + +### Other (external) examples + +If you want other examples how to use this container with Docker Compose, look at: + +* [Nicolas Duchon's Examples](https://github.com/buchdag/letsencrypt-nginx-proxy-companion-compose) - with automated testing +* [Evert Ramos's Examples](https://github.com/evertramos/docker-compose-letsencrypt-nginx-proxy-companion) - using docker-compose version '3' +* [Karl Fathi's Examples](https://github.com/fatk/docker-letsencrypt-nginx-proxy-companion-examples) +* [More examples from Karl](https://github.com/pixelfordinner/pixelcloud-docker-apps/tree/master/nginx-proxy) +* [George Ilyes' Examples](https://github.com/gilyes/docker-nginx-letsencrypt-sample) +* [Dmitry's simple docker-compose example](https://github.com/dmitrym0/simple-lets-encrypt-docker-compose-sample) +* [Radek's docker-compose jenkins example](https://github.com/dataminelab/docker-jenkins-nginx-letsencrypt) diff --git a/docs/Getting-containers-IDs.md b/docs/Getting-containers-IDs.md new file mode 100644 index 0000000..e6c752b --- /dev/null +++ b/docs/Getting-containers-IDs.md @@ -0,0 +1,96 @@ +## Getting nginx-proxy/nginx/docker-gen containers IDs + +For **letsencrypt-nginx-proxy-companion** to work properly, it needs to know the ID of the **nginx**/**nginx-proxy** container (in both [two](./Basic-usage.md) and [three](./Advanced-usage.md) containers setups), plus the ID of the **docker-gen** container in a [three container setup](./Advanced-usage.md). + +There are three methods to inform the **letsencrypt-nginx-proxy-companion** container of the **nginx**/**nginx-proxy** container ID: + +* `label` method: add the label `com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy` to the **nginx**/**nginx-proxy** container. + +* `environment variable` method: assign a fixed name to the **nginx**/**nginx-proxy** container with `container_name:` and set the environment variable `NGINX_PROXY_CONTAINER` to this name on the **letsencrypt-nginx-proxy-companion** container. + +* `volumes_from` method. Using this method, the **letsencrypt-nginx-proxy-companion** container will get the **nginx**/**nginx-proxy** container ID from the volumes it got using the `volumes_from` option. + +And two methods to inform the **letsencrypt-nginx-proxy-companion** container of the **docker-gen** container ID: + +* `label` method: add the label `com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen` to the **docker-gen** container. + +* `environment variable` method: assign a fixed name to the **docker-gen** container with `container_name:` and set the environment variable `NGINX_DOCKER_GEN_CONTAINER` to this name on the **letsencrypt-nginx-proxy-companion** container. + +The methods for each container are sorted by order of precedence, meaning that if you use both the label and the volumes_from method, the ID of the **nginx**/**nginx-proxy** container that will be used will be the one found using the label. **There is no point in using more than one method at a time for either the nginx/nginx-proxy or docker-gen container beside potentially confusing yourself**. + +The advantage the `label` methods have over the `environment variable` (and `volumes_from`) methods is enabling the use of the **letsencrypt-nginx-proxy-companion** in environments where containers names are dynamic, like in Swarm Mode or in Docker Cloud. Howhever if you intend to do so, as upstream **docker-gen** lacks the ability to identify containers from labels, you'll need both to either use the two containers setup or to replace jwilder/docker-gen with a fork that has this ability like [herlderco/docker-gen](https://github.com/helderco/docker-gen). Be advised that for now, this works to a very limited extent [(everything has to be on the same node)](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/pull/231#issuecomment-330624331). + +#### Examples with three containers setups: + +`label` method. +``` +$ docker run --detach \ + [...] + --label com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy \ + nginx + +$ docker run --detach \ + [...] + --label com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen \ + jwilder/docker-gen + +$ docker run --detach \ + [...] + jrcs/letsencrypt-nginx-proxy-companion +``` + +`environment variable` method +``` +$ docker run --detach \ + [...] + --name unique-container-name \ + nginx + +$ docker run --detach \ + [...] + --name another-unique-container-name \ + jwilder/docker-gen + +$ docker run --detach \ + [...] + --env NGINX_PROXY_CONTAINER=unique-container-name \ + --env NGINX_DOCKER_GEN_CONTAINER=another-unique-container-name \ + jrcs/letsencrypt-nginx-proxy-companion +``` + +`volumes_from` (**nginx**) + `label` (**docker-gen**) method +``` +$ docker run --detach \ + [...] + --name unique-container-name \ + nginx + +$ docker run --detach \ + [...] + --label com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen \ + jwilder/docker-gen + +$ docker run --detach \ + [...] + --volumes-from unique-container-name \ + jrcs/letsencrypt-nginx-proxy-companion +``` + +`volumes_from` (**nginx**) + `environment variable` (**docker-gen**) method +``` +$ docker run --detach \ + [...] + --name unique-container-name \ + nginx + +$ docker run --detach \ + [...] + --name another-unique-container-name \ + jwilder/docker-gen + +$ docker run --detach \ + [...] + --volumes-from unique-container-name \ + --env NGINX_DOCKER_GEN_CONTAINER=another-unique-container-name \ + jrcs/letsencrypt-nginx-proxy-companion +``` diff --git a/docs/Invalid-authorizations.md b/docs/Invalid-authorizations.md new file mode 100644 index 0000000..7a14c12 --- /dev/null +++ b/docs/Invalid-authorizations.md @@ -0,0 +1,74 @@ +## Troubleshooting failing authorizations + +The first two things to do in case of failing authorization are to run the **letsencrypt-nginx-proxy-companion** container with the environment variable `DEBUG=true` to enable the more detailed error messages, and to [request test certificates](./Let's-Encrypt-and-ACME.md#test-certificates) while troubleshooting the issue. + +Common causes of of failing authorizations: + +#### port `80` or `443` on your host are closed / filtered from the outside, possibly because of a misconfigured firewall. + +Check your host `80` and `443` ports **from the outside** (as in from a host having a different public IP) with `nmap` or a similar tool. + +#### your domain name does not resolve to your host IPv4 and/or IPv6. + +Check that your domain name A (and AAAA, if present) records points to the correct adresses using `drill`, `dig` or `nslookup`. + +#### your domain name advertise an AAAA (IPv6) record, but your host or your host's docker isn't actually reachable over IPv6. + +Create a test nginx container on your host and try to reach it over both IPv4 and IPv6. + +```bash +you@remotedockerhost$ docker run -d -p 80:80 nginx:alpine + +you@localcomputer$ curl http://your.domain.tld + + +
+