Docker + Nginx reverse proxy + LetsEncrypt + Chisel

crontab.md

Cron entry

0 0 * * 0 docker compose -f /opt/docker/nginx/docker-compose-le.yaml up && docker exec nginx-service nginx -s reload

docker-compose-le.yaml

version: '3.8'

services:
  letsencrypt:
    container_name: certbot-service
    image: certbot/certbot:latest
    command: 'sh -c "certbot certonly --expand --webroot -w /tmp/acme_challenge -d <DOMAIN_NAME> --text --agree-tos --email <EMAIL> --rsa-key-size 4096 --verbose --keep-until-expiring --preferred-challenges=http"'
    entrypoint: ''
    volumes:
      - type: bind
        source: /opt/docker/nginx/le
        target: /etc/letsencrypt
        read_only: false
      - type: bind
        source: /opt/docker/nginx/tmp/acme_challenge
        target: /tmp/acme_challenge
        read_only: false
    environment:
      - TERM=xterm

docker-compose.yaml

version: '3.8'

services:
  nginx:
    container_name: nginx-service
    image: nginx:latest
    restart: unless-stopped
    volumes:
      - type: bind
        source: /opt/docker/nginx/conf/nginx.conf
        target: /etc/nginx/nginx.conf
        read_only: true
      - type: bind
        source: /opt/docker/nginx/conf/conf.d
        target: /etc/nginx/conf.d
        read_only: true
      - type: bind
        source: /opt/docker/nginx/le
        target: /etc/letsencrypt
        read_only: true
      - type: bind
        source: /opt/docker/nginx/certs
        target: /etc/nginx/certs
        read_only: true
      - type: bind
        source: /opt/docker/nginx/tmp/acme_challenge
        target: /tmp/acme_challenge
        read_only: true
    networks:
      - chisel
    ports:
      - 80:80
      - 443:443
    environment: []

  chisel:
    container_name: chisel-service
    image: jpillora/chisel
    restart: unless-stopped
    volumes:
      - type: bind
        source: /opt/docker/nginx/chisel/data
        target: /data
        read_only: true
      - type: bind
        source: /opt/docker/nginx/chisel/.cache
        target: /.cache
        read_only: false
    networks:
      - chisel
    ports:
      - 2334:2334
    environment:
      - CHISEL_LE_CACHE=/.cache
    command:
      - 'server'
      - '--keyfile=/data/key'
      - '--authfile=/data/users.json'
      - '--port=2334'
      - '--reverse'

networks:
  chisel:
    driver: bridge