krumware/docker-letsencrypt repository overview

⁠docker-letsencrypt

This image is Krumware's extension of https://github.com/cnadeau/letsencrypt-dockercloud-haproxy

⁠Overview

Letsencrypt is a service that allows to get free certificates signed by an authority for 90 days after which it has to be renewed. The images we are using will automatically renew the certificate before expiration. HAproxy is used for front end load balancing which allows to use different our project accessable on different ports in a round robin fashion.

⁠How we use it

letsencrypt:
  environment:
    - DOMAINS=<your-domains>
    - LOAD_BALANCER_SERVICE_NAME=<your-haproxy/nginx-container>
    - OPTIONS=--staging
  expose:
    - '80'
  image: 'krumware/docker-letsencrypt:latest'

⁠Things to look out for

Letsencrypt service will require a front end load balancing service to be started first (either HAproxt or nginx) then it start serving on the exposed port. It requires three environment variables

   [email protected]
   LOAD_BALANCER_SERVICE_NAME=<your-haproxy/nginx-container>
   OPTIONS=--staging/--production

--staging flag is very important during production to avoid 5 certificates per domain restriction

⁠Final Configuration

In your project container in docker-compose you should add the following code

  environment:
    - FORCE_SSL=yes
    - 'VIRTUAL_HOST=http://*,https://*'
    

⁠Tips:

If it seems that haproxy isn't properly redirecting to the service on time, a la:

2018-01-03T01:20:27.707171660Z    Domain: ...krum.i
2018-01-03T01:20:27.707174606Z    Type:   unauthorized
2018-01-03T01:20:27.707177403Z    Detail: Invalid response from
2018-01-03T01:20:27.707180458Z    http://../.well-known/acme-challenge/A8Hjo_iJ-n0jMs_evL-i5E6Rr0mlgboUyg-miI3z4ts
2018-01-03T01:20:27.707183493Z    [54.84.217.230]: 503

Then try running from inside the container manually: /opt/letsencrypt/bin - ./update-certs.sh