Let's Encrypt for RouterOS Webserver/API
1.3K
This Docker container automatically renews certificates from Let's Encrypt, copies them to a MikroTik device running RouterOS, and activates them in the web server, API and OpenVPN server.
There are two approaches:
Docker Hub: schwitzd/routeros-letsencrypt
| Name | Default | Description |
|---|---|---|
ROUTEROS_USER | (none) | User with policies ssh, write, ftp, read |
ROUTEROS_HOST | (none) | RouterOS IP or Hostname |
ROUTEROS_SSH_PORT | 22 | RouterOS SSH Port |
ROUTEROS_PRIVATE_KEY | (none) | Private Key file to connect to RouterOS (set permissions to 0400!) |
ROUTEROS_DOMAIN | (none) | Domainname for catch up certs from LEGO Client. Usually the first Domain you set in the LEGO_DOMAINS variable |
LEGO_STAGING | 1 | Whether to use production or staging LetsEncrypt endpoint. 0 for production, 1 for staging |
LEGO_KEY_TYPE | ec384 | Type of key |
LEGO_DOMAINS | (none) | Domains (delimited by ';' ) |
LEGO_EMAIL_ADDRESS | (none) | Email used for registration and recovery contact. |
LEGO_PROVIDER | (none) | Valid values for DNS providers can be found in the official LEGO documentation: https://go-acme.github.io/lego/dns/ |
LEGO_DNS_TIMEOUT | 10 | Set the DNS timeout value to a specific value in seconds |
LEGO_ARGS | (none) | Send arguments directly to lego, e.g. "--dns.disable-cp" or "--dns.resolvers 1.1.1.1" |
<KEY/TOKEN_FROM_PROVIDER> | (none) | See Configuration of DNS Providers |
SET_ON_WEB | true | Set the new certificate on the WebServer |
SET_ON_API | true | Set the new certificate on the API |
SET_ON_OVPN | false | Set the new certificate on the OpenVPN Server |
SET_ON_HOTSPOT | false | Set the new certificate for the HotSpot/CaptivePortal |
SET_ON_REVERSE_PROXY | false | Set the new certificate for the Reverse Proxy |
REVERSE_PROXY_DOMAINS | (none) | A comma-separated list of Reverse Proxy domains (SNI) to which the certificate will apply |
HOTSPOT_PROFILE_NAME | (none) | HotSpot/CaptivePortal profile name |
# Add environment variables
/container/envs/add name=lego_envs key=LEGO_STAGING value="0"
/container/envs/add name=lego_envs key=LEGO_PROVIDER value="cloudflare"
/container/envs/add name=lego_envs key=LEGO_DOMAINS value="mydomain.tld"
/container/envs/add name=lego_envs key=LEGO_EMAIL_ADDRESS value="[email protected]"
/container/envs/add name=lego_envs key=CLOUDFLARE_DNS_API_TOKEN value="<TOKEN>"
/container/envs/add name=lego_envs key=ROUTEROS_USER value="letsencrypt"
/container/envs/add name=lego_envs key=ROUTEROS_HOST value="router.mydomain.tld"
/container/envs/add name=lego_envs key=ROUTEROS_PRIVATE_KEY value="/ssh/id_ed25519"
/container/envs/add name=lego_envs key=ROUTEROS_DOMAIN value="mydomain.tld"
# Create mount points
/container/mounts/add name=lego-ssh src=/usb1/containers/lego/ssh dst=/ssh
/container/mounts/add name=lego-letsencrypt src=/usb1/containers/lego/data dst=/letsencrypt
# Create container
/container/add remote-image=schwitzd/routeros-letsencrypt:latest interface=veth1 root-dir=usb1/containers/lego/root mounts=lego-ssh,lego-letsencrypt envlist=lego_envs dns=<dns_server> logging=yes start-on-boot=yes
services:
app:
image: foorschtbar/routeros-letsencrypt
environment:
- LEGO_STAGING=0
- LEGO_PROVIDER=cloudflare
- LEGO_DOMAINS=mydomain.tld # or *.mydomain.tld for a wildcard cert.
- [email protected]
- CLOUDFLARE_DNS_API_TOKEN=<TOKEN>
- ROUTEROS_USER=letsencrypt
- ROUTEROS_HOST=router.mydomain.tld
- ROUTEROS_PRIVATE_KEY=/ssh/id_ed25519
- ROUTEROS_DOMAIN=mydomain.tld # or *.mydomain.tld for a wildcard cert.
volumes:
- ./data:/letsencrypt # To store Let's Encrypt authorization
- ./ssh/ssh # To store RouterOS ssh private key
restart: unless-stopped
TO DO: use docker compose secrets
Inspired & forked from routeros-letsencrypt-docker
Content type
Image
Digest
sha256:06d904aa6…
Size
34.9 MB
Last updated
2 months ago
docker pull schwitzd/routeros-letsencrypt