Public Repository

Last pushed: 7 months ago
Short Description
Short description is empty for this repo.
Full Description

The team brings you another container release featuring easy user mapping and community support. Find us for support at:

  • IRC on freenode at
  • Podcast covers everything to do with getting the most from your Linux Server plus a focus on all things Docker and containerisation!


This docker image, forked from our letsencrypt image, was developed by the team specfically for use by and is not recommended for use by the general public.


Validator server

docker create \
  --privileged \
  --name=fanartstatic \
  -v <path to data>:/config \
  -e PGID=<gid> -e PUID=<uid>  \
  -e EMAIL=<email> \
  -e URL=<url> \
  -p 80:80 -p 443:443 \
  -e TZ=<timezone> \
  -e VALIDATOR=<true> \
  -e SLAVEIPS=<IPs,comma,separated> \

Slave Server

docker create \
  --privileged \
  --name=fanartstatic \
  -v <path to data>:/config \
  -e PGID=<gid> -e PUID=<uid>  \
  -e URL=<url> \
  -p 80:80 -p 443:443 \
  -e TZ=<timezone> \
  -e VALIDATOR=<false> \
  -e VALIDATORIP=<ipaddress> \


The parameters are split into two halves, separated by a colon, the left hand side representing the host and the right the container side. For example with a port -p external:internal - what this shows is the port mapping from internal to external of the container. So -p 8080:80 would expose port 80 from inside the container to be accessible from the host's IP on port 8080 http://192.168.x.x:8080 would show you what's running INSIDE the container on port 80.

  • -p 80 -p 443 - the port(s)
  • -v /config - all the config files including the webroot reside here
  • -e URL - the url for server
  • -e PGID for GroupID - see below for explanation
  • -e PUID for UserID - see below for explanation
  • -e TZ - timezone ie. America/New_York
  • -e VALIDATOR - determines whether the server should run letsencrypt
  • -e VALIDATORIP - mandatory for slave servers
  • -e SLAVEIPS - IPs for cert distribution, comma separated, no spaces. Required for cert distribution to slaves. Leave out in a single server scenario.

Optional settings:

  • -e EMAIL - your e-mail address for cert registration and notifications
  • -e DHLEVEL - dhparams bit value (default=2048, can be set to 1024 or 4096)

It is based on alpine linux with s6 overlay, for shell access whilst the container is running do docker exec -it letsencrypt /bin/bash.

Multiple server setup instructions

Adding a new slave

  • Create the slave container and start it.
  • The container will stop after generating the DH parameter due to not existing cert.
  • Add the public ssh key to new slave's authorized_keys
  • On the validator, create a new folder for the slave info and copy the sample.conf cp -R /config-folder-path/distribute/XX.XX.XX.XX /config-folder-path/distribute/<new.slave.ip.address>
  • Edit the sample.conf with the new slave details
  • Copy the private ssh key into the folder with the name private (no password)
  • Recreate the validator container with the new slave's IP address added into the SLAVEIPS variable
  • Restart the new slave
  • Add the new slave to the round robin dns

Removing a slave

  • Remove the slave from the round robin DNS
  • Remove the slave container
  • Recreate the validator with the slave's IP removed from the SLAVEIPS variable

Switching the validator to a different server

  • Recreate all other slaves with the VALIDATORIP changed to reflect the new validator server
  • Remove the old validator from the round robin DNS
  • Add the new validator to round robin DNS
  • Create the new validator container (initially with no SLAVEIPS defined so folders are created)
  • Create the slave IP named folders under /config/distribute for each slave, with their sample.conf and private ssh keys (as described above)
  • Recreate the new validator with the slave IPs defined
Docker Pull Command