55 lines
1.7 KiB
Markdown
55 lines
1.7 KiB
Markdown
# Letsencrypt
|
|
|
|
EasyHAProxy can issue a letsencrypt certificate. Follow the steps below:
|
|
|
|
## Setting up EasyHAProxy
|
|
|
|
Run the EasyHAProxy container:
|
|
|
|
```bash
|
|
docker run \
|
|
... \
|
|
-e EASYHAPROXY_CERTBOT_EMAIL=john@doe.com \
|
|
-p 80:80 \
|
|
-p 443:443 \
|
|
-v /path/to/guest/certbot/certs:/certs/certbot \
|
|
... \
|
|
byjg/easy-haproxy
|
|
```
|
|
|
|
Notes:
|
|
|
|
- If you don't setup `EASYHAPROXY_CERTBOT_EMAIL` environment variable, EasyHAProxy will fail silently and **will not request** a certificate.
|
|
- The ports 80 and 443 needs to accessible through the internet as [Let's Encrypt requirement](https://letsencrypt.org/docs/allow-port-80/)
|
|
|
|
Be aware of Letsencrypt issue rate limits:
|
|
|
|
- https://letsencrypt.org/docs/duplicate-certificate-limit/
|
|
- https://letsencrypt.org/docs/rate-limits/
|
|
|
|
In order to avoid several certificate issuing,
|
|
**It is required you to persist the container folder `/certs/certbot` outside the container.**
|
|
You cannot delete or change it contents.
|
|
If you do not persist, or change/delete the contents, Let's encrypt will not work properly.
|
|
|
|
|
|
## Setting up your container to use Let's Encrypt
|
|
|
|
```bash
|
|
docker run \
|
|
... \
|
|
--label easyhaproxy.express.port=80 \
|
|
--label easyhaproxy.express.localport=3000 \
|
|
--label easyhaproxy.express.host=example.org \
|
|
--label easyhaproxy.express.certbot=true \
|
|
... \
|
|
some/myimage
|
|
```
|
|
|
|
Requirements:
|
|
|
|
- Your container **must** listen to port 80. Letsencrypt will not issue the certificate if `easyhaproxy.<definition>.port` is in another port, and EasyHAProxy will fail silently.
|
|
- You cannot set port 443 for the container with the Letsencrypt because EasyHAProxy will create this port automatically once the certificate is issued.
|
|
|
|
----
|
|
[Open source ByJG](http://opensource.byjg.com)
|