Letsencrypt Run in Docker

1. 部署 docker

services:
  nginx:
    container_name: nginx
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - $HOME/etc/nginx/conf.d:/etc/nginx/conf.d:ro
      - $HOME/etc/nginx/html:/usr/share/nginx/html:ro
      - $HOME/etc/certbot/conf:/etc/letsencrypt:ro
      - $HOME/etc/certbot/www:/var/www/certbot:ro
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  certbot:
    container_name: certbot
    image: certbot/certbot:nightly
    volumes:
      - $HOME/etc/certbot/conf:/etc/letsencrypt
      - $HOME/etc/certbot/www:/var/www/certbot
      - $HOME/log/letsencrypt:/var/log/letsencrypt
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

2. 配置 nginx 基础配置

server {
    listen 80;
    server_name www.example.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name www.example.com;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;

    location / {
        root /usr/share/nginx/html/newsite;
        index index.html;
    }
}

3. 启动容器，申请证书，自动续签

# 1. 启动 Nginx（仅 HTTP）
docker compose -f compose/nginx.yml up -d nginx
docker compose -f compose/nginx.yml up -d certbot

# 2. 申请证书（替换域名和邮箱）
docker exec certbot certbot certonly --webroot \
    --webroot-path=/var/www/certbot \
    -d www.example.com \
    --email huangmin86@foxmail.com \
    --agree-tos --no-eff-email \
    --verbose
  # 验证续期
docker exec certbot certbot renew --dry-run

# 3. 修改 Nginx 配置，启用 HTTPS（在 sites/newsite.conf 中添加 443 的 server 块）
/etc/letsencrypt/live/www.example.com/

# 4. 再次重载 Nginx
docker exec -it nginx nginx -t
docker exec -it nginx nginx -s reload

# 5. 移除证书，并且删除续签配置
docker exec -it certbot certbot delete --cert-name www.example.com