docker compose file with multiple domains/subdomains

[lravelo]

Currently I'm using https://github.com/wallarm/docker-wallarm-node as a reverse proxy (this runs nginx) and I have several conf files each with their own config for the domains example.tld, www.example.tld, and mail.example.tld I'm trying to automate the management of said certificates. for now I've just been using the certbot/certbot container but it's modified and the renewal is triggered via a cron job. I would love to see if there was a way to have an acme.sh container manage this and reload the nginx process running inside of the wallarm/node container

[neilpang]

You don't need acme.sh inside the wallarm/nginx container -- use acme.sh's built-in docker deploy hook. Run the official neilpang/acme.sh container with the docker socket mounted; it finds your nginx container by a label, copies the cert in, and runs a reload command inside it.

Label the target container (in your compose), e.g.:

  wallarm-node:
    labels:
      sh.acme.autoload.domain: example.tld

Run the acme.sh container with the socket:

  acme:
    image: neilpang/acme.sh
    command: daemon
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./acme:/acme.sh

Issue (DNS or webroot), then deploy -- once per cert:

docker exec acme \
  acme.sh --deploy -d example.tld --deploy-hook docker

with these set on the deploy:

export DEPLOY_DOCKER_CONTAINER_LABEL="sh.acme.autoload.domain=example.tld"
export DEPLOY_DOCKER_CONTAINER_KEY_FILE="/etc/nginx/ssl/example.tld/key.pem"
export DEPLOY_DOCKER_CONTAINER_CERT_FILE="/etc/nginx/ssl/example.tld/cert.pem"
export DEPLOY_DOCKER_CONTAINER_CA_FILE="/etc/nginx/ssl/example.tld/ca.pem"
export DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE="/etc/nginx/ssl/example.tld/full.pem"
export DEPLOY_DOCKER_CONTAINER_RELOAD_CMD="nginx -s reload"

For www.example.tld / mail.example.tld, either add them as SANs on one cert, or repeat with their own label + paths. The values are saved per-domain, so cron renewals redeploy and reload automatically. See the wiki: Deploy-to-Docker-containers.