Public Repository

Last pushed: 7 days ago
Short Description
A Letsencrypt nginx container, brought to you by
Full Description

The team brings you another container release featuring easy user mapping and community support. Find us for support at:

  • IRC on freenode at
  • Podcast covers everything to do with getting the most from your Linux Server plus a focus on all things Docker and containerisation!


This container sets up an Nginx webserver and reverse proxy with php support and a built-in letsencrypt client that automates free SSL server certificate generation and renewal processes. It also contains fail2ban for intrusion prevention.


docker create \
  --privileged \
  --name=letsencrypt \
  -v <path to data>:/config \
  -e PGID=<gid> -e PUID=<uid>  \
  -e EMAIL=<email> \
  -e URL=<url> \
  -e SUBDOMAINS=<subdomains> \
  -p 443:443 \
  -e TZ=<timezone> \


The parameters are split into two halves, separated by a colon, the left hand side representing the host and the right the container side. For example with a port -p external:internal - what this shows is the port mapping from internal to external of the container. So -p 8080:80 would expose port 80 from inside the container to be accessible from the host's IP on port 8080 http://192.168.x.x:8080 would show you what's running INSIDE the container on port 80.

  • -p 443 - the port(s)
  • -v /config - all the config files including the webroot reside here
  • -e URL - the top url you have control over ("" if you own it, or "" if dynamic dns)
  • -e SUBDOMAINS - subdomains you'd like the cert to cover (comma separated, no spaces) ie. www,ftp,cloud
  • -e PGID for GroupID - see below for explanation
  • -e PUID for UserID - see below for explanation
  • -e TZ - timezone ie. America/New_York

Optional settings:

  • -e EMAIL - your e-mail address for cert registration and notifications
  • -e DHLEVEL - dhparams bit value (default=2048, can be set to 1024 or 4096)
  • -p 80 - Port 80 forwarding is optional (cert validation is done through 443)
  • -e ONLY_SUBDOMAINS - if you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to true
  • -e EXTRA_DOMAINS - additional fully qualified domain names (comma separated, no spaces) ie.,

It is based on alpine linux with s6 overlay, for shell access whilst the container is running do docker exec -it letsencrypt /bin/bash.

User / Group Identifiers

Sometimes when using data volumes (-v flags) permissions issues can arise between the host OS and the container. We avoid this issue by allowing you to specify the user PUID and group PGID. Ensure the data volume directory on the host is owned by the same user you specify and it will "just work" ™.

In this instance PUID=1001 and PGID=1001. To find yours use id user as below:

  $ id <dockeruser>
    uid=1001(dockeruser) gid=1001(dockergroup) groups=1001(dockergroup)

Setting up the application

  • Before running this container, make sure that the url and subdomains are properly forwarded to this container's host, and that port 443 is not being used by another service on the host (NAS gui, another webserver, etc.).
  • Port 443 on the internet side of the router should be forwarded to this container's port 443 (Required for letsencrypt validation)
  • --privileged mode is required for fail2ban to modify iptables
  • If you need a dynamic dns provider, you can use the free provider where the url will be and the subdomains can be www,ftp,cloud
  • The container detects changes to url and subdomains, revokes existing certs and generates new ones during start. It also detects changes to the DHLEVEL parameter and replaces the dhparams file.
  • If you'd like to password protect your sites, you can use htpasswd. Run the following command on your host to generate the htpasswd file docker exec -it letsencrypt htpasswd -c /config/nginx/.htpasswd <username>


  • Shell access whilst the container is running: docker exec -it letsencrypt /bin/bash
  • To monitor the logs of the container in realtime: docker logs -f letsencrypt

  • container version number

docker inspect -f '{{ index .Config.Labels "build_version" }}' letsencrypt

  • image version number

docker inspect -f '{{ index .Config.Labels "build_version" }}' linuxserver/letsencrypt


  • 14.07.2017: Enable modules dynamically in nginx.conf
  • 06.07.2017: Add support for multiple domains (thanks @oznu)
  • 22.06.2017: Add various nginx modules and enable all modules in the default nginx.conf
  • 16.06.2017: Update deprecated certbot option for https validation, make e-mail entry optional, update readme
  • 05.06.2017: Add php7-bz2
  • 27.05.2017: Rebase to alpine 3.6.
  • 03.05.2017: Fix log permissions.
  • 18.04.2017: Add php7-sockets, update fail2ban filter and action defaults
  • 27.02.2017: Add php7-dom, php7-iconv and php7-pdo_sqlite
  • 21.02.2017: Add php7-xml
  • 10.02.2017: Switch to alpine 3.5 base and php7, add php zlib module and all nginx modules
  • 13.01.2017: Add php5-ctype and php5-openssl
  • 04.01.2017: Add php5-mysqli and php5-pdo_mysql
  • 22.11.2016: Add gd and mcrypt packages
  • 21.11.2016: Add curl package
  • 07.11.2016: Initial Release
Docker Pull Command

Comments (14)
2 months ago

I would like premade scripts, for converting certificates. Like PKCS #12 for use with plex, and csr for OpenVPN

3 months ago

FYI - I noticed in the last 2 days that I had an error that kept appearing in my container log:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

This error would appear about 2x per second. The folder or file did not exist (was not a permissions issue). I created the folders and touched an "error.log" file in there, and re-ran the container with no more error. I did not notice this at all when I first installed this image last week, so I don't know what might have changed.

3 months ago

Does this have the stream module built in?

It can be useful to have nginx pass on VPN traffic to say OpenVPN

5 months ago

Thanks. I found a copy in the end. Does anyone know the correct nginx server directive to reverse proxy the linux| plex docker container? My plex container is running with host networking, letsencrypt is running with bridge encoding. I have the following config (interpreted from tutorials on, but it doesn't seem to be working on my local LAN, only on the docker host itself.

# Plex Reverse proxy config
        location ^~ /web/ {
                proxy_redirect http://$host:32400/ /web/;
                proxy_set_header Host $host;


        location ^~ /plex/ {
5 months ago

@wassy fastcgi_params is usually a conf file containing directives for fastcgi, you're telling it to look in your nginx directory for a file called "fastcgi_params" and it's failing because that file doesn't exist.

5 months ago

Thanks for the info. I always like to understand more about what's going on under the hood.

Turns out my error is because the nginx process hadn't actually started because of an error with the default sites config file

I'm trying to proxy the official nextcloud:11-fpm container (served using php-fpm) with NGINX and the example nginx config to achieve this has the line
"include fastcgi_params" which isn't in the nginx doesn't like. It just exits with the error /config/nginx/fastcgi_params no such file or directory. If anyone has any ideas i'd appreciate it.

I know this is not really the place for it, next stop StackOverflow

5 months ago

To be honest, restarting the container is easier than restarting nginx. But if you really want it to reload, use the following command: docker exec [containername] s6-svc -h /var/run/s6/services/nginx because nginx is run/managed by the s6 supervisor

5 months ago

No your explanation was fine, I understand that, my container is called 'letsencrypt' so i ran:
docker exec letsencrypt nginx -s reload
and that is the error message that I get

5 months ago

I'm sorry, I should have been more clear in my response. Replace {container} with the name or ID of your nginx container.

6 months ago

@bdelcamp : I tried running the command you mentioned: docker exec {container} nginx -s reload
but I just got the error
nginx: [error] open() "/run/nginx/" failed (2: No such file or directory)
Looking in the container it looks like the pid file is just located in /run, not /run/nginx
Is this a container build issue or am I just doing something wrong?