jekewa/nginx-proxy repository overview

⁠Nginx Proxy

https://github.com/jekewa/nginx-proxy⁠ is a fork of https://github.com/nginx-proxy/nginx-proxy⁠ with a simple bit added to the nginx template file that allows using Let's Encrypt certificates as created and maintained by an external certbot.

This allows letting nginx-proxy to perform its tasks of identifying virtual host containers, and sharing them through both HTTP and HTTPS, with all the default features of both nginx-proxy and Let's Encrypt certificates.

This removes the need for an additional Docker container to maintain the certificates, including copying the certificates to other locations.

⁠Let's Encrypt Certificates

Let's Encrypt certificate management is outside the scope of this document.

By default, Let's Encrypt creates its certificates in the /etc/letsencrypt folder. If one uses the certbot to periodically refresh the certificates, the current certificate will be in the folder /etc/letsencrypt/live/CERTNAME, where CERTNAME is the name provided when creating the certificate (either by named parameter or defaulting to the first domain in the certificate request), containing a cert.pem, privkey.pem, and fullchain.pem, which are used by this template.

⁠Run Container

Everything is the same as running a normal nginx-proxy container, except that the /etc/letsencrypt volume needs to be mounted.

docker run --detach \
    --name nginx-proxy \
    --publish 80:80 \
    --publish 443:443 \
    --volume /var/run/docker.sock:/tmp/docker.sock:ro \
    --volume /etc/letsencrypt:/etc/letsencrypt:ro \
    jekewa/nginx-proxy

The /etc/letsencrypt volume can be mounted by any comfortable Docker means. The example above assumes the host /etc/letsencrypt volume exists. Use a network bind or other mechanism as desired.

⁠Run Virtual Host

Add the LETSENCRYPT_CERTNAME variable ton the virtual host container to name the certificate directory and trigger the necessary portion in the nginx-proxy template.

docker run --detach \
    --name your-proxied-app \
    --env VIRTUAL_HOST=foo.bar.com \
    --env LETSENCRYPT_CERTNAME=bar.com \
    nginx

In this example the assumption is that the Let's Encrypt certificate was created for the whole bar.com domain. This would lead to searching for /etc/letsencrypt/live/bar.com and using the expected files.