Replies: 4 comments 10 replies
-
If you just prefer to use docker-compose instead of the Docker run command fpr the cron job, then use the following crontab statement: This is exactly the sense of a decoupled approach, you can individually adapt the components to your own use. The reasons for the change have already been explained here #12 (comment):
Here is a more detailed explanation of this decision: Reason 1: Reason 2:
This can now be interpreted that a cron job deeply coupled with certbot is the right approach, since both belong to the same service (certbot). Reason 3: Reason 4: Workaround: If you absolutely want to use the Docker Image v0.4 approach, there is also a very simple solution: This entire Docker Images design decision will not be reverted for this project without any other general solution for the named points. If you don't like this design decision and have other ideas to contribute to the general solution of the problem, feel free to share them. |
Beta Was this translation helpful? Give feedback.
-
|
Understood but my understanding is that the proposed command: 0 4 */8 * * docker-compose -f /docker-compose.yml up will restart the initial docker and thus will make a certonly (only) but not a renew . I do understand your decision and the good reasons behind, but I dont feel confortable with the spirit of a docker-compose (deemed to embed all the configurations) and a parallel additional external command. I will dig that with such solution for exemple Regards |
Beta Was this translation helpful? Give feedback.
-
The
So you can just restart the container with a correct docker-compose file as often as you like to renew the certificate. If you want to have everything in a docker-compose file but don't want to use the workaround or customize the base image, you can simply create another service in the docker-compose file that provides the exact cron function. |
Beta Was this translation helpful? Give feedback.
-
|
It would be fine. But take your time . Your docker is very good . |
Beta Was this translation helpful? Give feedback.
-
|
The docker image itself has no environment variable expansion, but you can use the regular docker-compose environment variable option. You can find the documentation here. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting: Processing /etc/letsencrypt/renewal/xxxxxxx.duckdns.org-0001.conf <------------ original domain was xxxxx.duckdns.org and I changed to *.xxxx.duckdns.org. so it geerated a "-0001 directory that I replace withe original one Traceback (most recent call last): Processing /etc/letsencrypt/renewal/xxxxx.duckdns.org.conf Cert not yet due for renewal The following certificates are not due for renewal yet: Additionally, the following renewal configurations were invalid: 0 renew failure(s), 1 parse failure(s) I assume I have to clean some files in the /home/docker/certs/renewal directory ! (I assume the "-0001 " one) At least it proves that the renewal can deal with several certificates Phil |
Beta Was this translation helpful? Give feedback.
-
|
The result is probably caused by how certbot handles/saves the specification of different but same root domains. For example, the creation of certificates from test.com and *.test.com. This is something I cannot answer, as it is not related to the DNS plugin. The official certbot help/documentation and github is a better place to start to solve this problem. |
Beta Was this translation helpful? Give feedback.
-
|
I don’t think it is a problem. It is normal to have 2 different directories if we ask certificates for 2 different domains. |
Beta Was this translation helpful? Give feedback.
-
|
Fantastic; it works
here is my docker-compose part:
# Define a certbot duckdns service
certbot:
image: "infinityofspace/certbot_dns_duckdns:latest"
container_name: "certbot_dns_duckdns"
command: certbot certonly
--non-interactive
--agree-tos
--email ${EMAIL_certbot}
--preferred-challenges dns
--authenticator dns-duckdns
--dns-duckdns-token ${TOKEN_duckdns}
--dns-duckdns-propagation-seconds 30
-d ${DOMAIN_certbot}
volumes:
- "/home/docker/certs:/etc/letsencrypt"
- "/home/docker/certbot:/var/log/letsencrypt"
# nota : add the following line in the cron: 0 3 */8 * * docker run --rm -v
"/home/docker/certs:/etc/letsencrypt" -v
"/home/docker/certbot:/var/log/letsencrypt"
infinityofspace/certbot_dns_duckdns:latest certbot renew
environment variables are in the .env file
Phil
Le lun. 12 avr. 2021 à 09:30, infinityofspace ***@***.***> a
écrit :
… The docker image itself has no environment variable expansion, but you can
use the regular docker-compose environment variable option. You can find
the documentation here
<https://docs.docker.com/compose/environment-variables/>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#14 (reply in thread)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AFH7TTO3YQMPGQ3NIMIPS5LTIKOR7ANCNFSM42XXCBBQ>
.
|
Beta Was this translation helpful? Give feedback.
-
|
I have now created an example of an all in one docker-compose file with cron. Please follow the instructions very carefully and adjust it to your needs. |
Beta Was this translation helpful? Give feedback.
-
Fantastic. thank you very much.
|
Beta Was this translation helpful? Give feedback.
-
|
it does not work as it wants the Dockerfile to be in the ./ directory |
Beta Was this translation helpful? Give feedback.
-
|
If you move the files to another directory, then you have to explicitly specify this in the For example you have the following folder structure (files are italic):
Now you have to adjust the build context in the docker-compose.yml: By default the build context is the current folder (signaled with the "."). |
Beta Was this translation helpful? Give feedback.
-
|
Yes thanks again. it works |
Beta Was this translation helpful? Give feedback.
-
Hi
In the last version, the docker stops at the end of the “certonly” process.
Thus it is mandatory to create a “complex” crontab line I order to renew the certificate at regular intervals.
“Complex”as the line has to be changed to be consistent with volumes of the existing docker-compose .
Why don’t you use the “renew” option with an embedded cron inside the container ( as it was in the 0.4 version) ?
The certbot manual is clear:
This command attempts to renew any previously-obtained certificates that expire in less than 30 days. The same plugin and options that were used at the time the certificate was originally issued will be used for the renewal attempt, unless you specify other plugins or options. Unlike certonly, renew acts on multiple certificates and always takes into account whether each one is near expiry. Because of this, renew is suitable (and designed) for automated use, to allow your system to automatically renew each certificate when appropriate. Since renew only renews certificates that are near expiry it can be run as frequently as you want - since it will usually take no action.
“ renew is suitable and designed for automated use”
This is not a bug but a demand more consistent with docker philosophy in my mind
Thanks by advance
Regards
PHILIPPE
Beta Was this translation helpful? Give feedback.
All reactions