nginx-proxy/docker-compose-letsencrypt-ssl.yml at master · Surendra-Patil/nginx-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# nginx-proxy + acme-companion (Let's Encrypt) — production setup
#
# Modernized from the deprecated images:
#   jwilder/nginx-proxy                      -> nginxproxy/nginx-proxy
#   jrcs/letsencrypt-nginx-proxy-companion   -> nginxproxy/acme-companion
# (the jwilder/jrcs images have been unmaintained since ~2021).
#
# Each application container opts in by setting these environment variables:
#   VIRTUAL_HOST=app.example.com      -> reverse-proxy routing
#   LETSENCRYPT_HOST=app.example.com  -> automatic TLS certificate
#   LETSENCRYPT_EMAIL=you@example.com -> (optional) per-app contact e-mail
#   VIRTUAL_PORT=<port>               -> (optional) if the app is not on port 80
# and must be attached to the same external network defined at the bottom.
#
# Default upload limit is 500 MB (client_max_body_size), set in the mounted
# ./nginx.tmpl. Override per-vhost with a file in vhost.d/ named after the host.
#
# Modern Compose Spec — the obsolete top-level `version:` key has been dropped.
# Bring it up with:  docker compose -f docker-compose-letsencrypt-ssl.yml up -d

services:
  nginx-proxy:
    image: nginxproxy/nginx-proxy:1.11.2
    container_name: nginx-proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      # certs is read-only here; acme-companion (below) writes the certificates.
      - /home/core/data/nginx-proxy/certs:/etc/nginx/certs:ro
      - /home/core/data/nginx-proxy/vhost.d:/etc/nginx/vhost.d:rw
      - /home/core/data/nginx-proxy/html:/usr/share/nginx/html:rw
      - /home/core/data/nginx-proxy/dhparam:/etc/nginx/dhparam:rw
      - /var/run/docker.sock:/tmp/docker.sock:ro
      # Custom nginx template mounted from disk so you can edit it without
      # rebuilding the image. It carries the default `client_max_body_size 500m`.
      # After editing ./nginx.tmpl, restart the container to regenerate the config.
      - ./nginx.tmpl:/app/nginx.tmpl:ro
    labels:
      # Lets acme-companion discover which container is the nginx proxy.
      - "com.github.nginx-proxy.nginx"

  acme-companion:
    image: nginxproxy/acme-companion:2.7.1
    container_name: nginx-proxy-acme
    restart: unless-stopped
    depends_on:
      - nginx-proxy
    environment:
      # Fallback contact e-mail used when a container omits LETSENCRYPT_EMAIL.
      - DEFAULT_EMAIL=you@example.com
      # Uncomment to test against Let's Encrypt staging before going live:
      # - ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory
    volumes:
      # certs is read-write here so the companion can write/renew certificates.
      - /home/core/data/nginx-proxy/certs:/etc/nginx/certs:rw
      - /home/core/data/nginx-proxy/vhost.d:/etc/nginx/vhost.d:rw
      - /home/core/data/nginx-proxy/html:/usr/share/nginx/html:rw
      # Persists the acme.sh account + state so certs aren't re-requested on restart.
      - /home/core/data/nginx-proxy/acme.sh:/etc/acme.sh:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro

# All proxied application containers must join this same network.
# Create it once with:  docker network create nginx-proxy-bridge-network
# (or point `name` at your existing network, e.g. "suri").
networks:
  default:
    external: true
    name: nginx-proxy-bridge-network