# Letsencrypt

EasyHAProxy can issue a letsencrypt certificate. Follow the steps below:

## Setting up EasyHAProxy

Run the EasyHAProxy container:

```bash
docker run \
    ... \
    -e EASYHAPROXY_LETSENCRYPT_EMAIL=john@doe.com \
    -p 80:80 \
    -p 443:443 \
    -v /path/to/guest/lestencrypt/certs:/certs/letsencrypt \
    ... \
    byjg/easy-haproxy
```

Notes:

- If you don't setup `EASYHAPROXY_LETSENCRYPT_EMAIL` environment variable, EasyHAProxy will fail silently and **will not request** a certificate.
- The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/)

Be aware of Letsencrypt issue rate limits:
 
- https://letsencrypt.org/docs/duplicate-certificate-limit/
- https://letsencrypt.org/docs/rate-limits/

In order to avoid several certificate issuing, 
**It is required you to persist the container folder `/certs/letsencrypt` outside the container.**
You cannot delete or change it contents. 
If you do not persist, or change/delete the contents, Let's encrypt will not work properly. 


## Setting up your container to use Let's Encrypt

```bash
docker run \
    ... \
    --label easyhaproxy.express.port=80 \
    --label easyhaproxy.express.localport=3000 \
    --label easyhaproxy.express.host=example.org \
    --label easyhaproxy.express.letsencrypt=true \
    ... \
    some/myimage
```

Requirements:

- Your container **must** listen to port 80. Letsencrypt will not issue the certificate if `easyhaproxy.<definition>.port` is in another port, and EasyHAProxy will fail silently.
- You cannot set port 443 for the container with the Letsencrypt because EasyHAProxy will create this port automatically once the certificate is issued.

----
[Open source ByJG](http://opensource.byjg.com)