Dockerized Lego with cron. Caters to DNS ACME challenge; other challenges can be worked out using LEGO_ARGS.
Environment variables are used to control various steps of the automation process.
| Name | Default value | Description | Corresponds to lego argument |
|---|---|---|---|
STAGING |
0 |
Whether to use production or staging LetsEncrypt endpoint. 0 for production, 1 for staging | |
KEY_TYPE |
ec384 |
Type of key. | --key-type |
DOMAINS |
"" |
Domains (delimited by ';' ) | --domains, -d |
EMAIL_ADDRESS |
"" |
Email used for registration and recovery contact. | --email, -m |
PROVIDER |
"" |
DNS Provider. Valid values are:onecloudru,com35,dns51,abion,active24,edgedns,alidns,aliesa,allinkl,alwaysdata,lightsail,route53,anexia,safedns,artfiles,arvancloud,auroradns,autodns,axelname,azion,azuredns,baiducloud,beget,binarylane,bindman,bluecat,bluecatv2,bookmyname,bunny,checkdomain,civo,cloudru,clouddns,cloudflare,cloudns,connbyte,conoha,conohav3,constellix,corenetworks,cpanel,curanet,czechia,dandomain,ddnss,derak,desec,designate,digitalocean,dinahosting,directadmin,dnsmadeeasy,dnsupdate,dnsla,dnsservices,dnscale,dnsexit,dnshomede,dnsimple,dode,domeneshop,dreamhost,duckdns,dyn,dynadot,dyndnsfree,dynu,easydns,edgecenter,efficientip,epik,eurodns,euserv,excedo,exoscale,exec,f5xc,fornex,freemyip,namesurfer,gcore,gandi,gandiv5,gehirn,gigahostno,glesys,gname,godaddy,gcloud,gravity,hetzner,hostingde,hostingnl,hostinger,hosttech,hostup,httpreq,httpnet,huaweicloud,hurricane,hyperone,ibmcloud,iijdpf,infoblox,infomaniak,internetbs,inwx,ionos,ionoscloud,ipv64,ispconfig,ispconfigddns,jdcloud,joker,acmedns,katapult,keyhelp,leaseweb,liara,limacity,linode,liquidweb,loopia,luadns,mailinabox,manageengine,manual,metaname,metaregistrar,mijnhost,mittwald,myaddr,mydnsjp,mythicbeasts,namedotcom,namecheap,namesilo,nearlyfreespeech,nederhost,neodigit,netcup,netlify,netnod,ngenix,nicmanager,nifcloud,njalla,nodion,ns1,octenium,omglol,onlinenet,otc,openprovider,opusdns,oraclecloud,ovh,plesk,pointdns,porkbun,poweradmin,pdns,rackspace,rage4,rainyun,rcodezero,regru,regfish,rimuhosting,nicru,sakuracloud,scaleway,scannet,selectel,selectelv2,selfhostde,servercow,shellrent,simply,sonic,spaceship,stackpath,syse,technitium,tele3,tencentcloud,edgeone,timewebcloud,todaynic,transip,ucloud,ultradns,uniteddomains,variomedia,veesp,vegadns,vercel,versio,vinyldns,virtualname,vkcloud,volcengine,vscale,vultr,wannafind,webnamesca,webnamesru,websupport,wedos,westcn,xinnet,yandex360,yandexcloud,yandex,zilore,zoneee,zoneedit,zonomi |
--dns |
DNS_TIMEOUT |
10 |
Set the DNS timeout value to a specific value in seconds. | --dns-timeout. |
LEGO_ARGS |
"" |
Send arguments directly to lego, e.g. "--dns.propagation.wait" or "--dns.resolvers 1.1.1.1" |
Important
Starting from version v5, this image uses supercronic instead of the standard crond. This allows for better signal handling and the ability to run as a non-root user.
This image defaults to root to ensure backward compatibility and ease of use with volume mounts. However, it uses supercronic which allows it to run as any UID.
To run as a non-root user, simply set the user in your docker-compose or docker run command. You must ensure the mounted volume (e.g. ./letsencrypt) is writable by the UID you choose.
services:
lego:
image: brahmadev/acme-lego-cron:latest
user: "1000:1000"
# ...# Before running as UID 1000
chown -R 1000:1000 ./letsencryptYou can mount a shell script to /app/hook.sh to run whenever a cert is issued. This image comes with bash/curl/wget/jq preinstalled.
This example get one certificate for *.example.com and example.com using cloudflare dns :
- Use staging endpoint during development.
services:
lego:
image: brahmadev/acme-lego-cron:latest
environment:
STAGING: 1
DOMAINS: "example.com;*.example.com"
EMAIL_ADDRESS: user@example.com
CLOUDFLARE_DNS_API_TOKEN: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
PROVIDER: cloudflare
LEGO_ARGS: "--dns.propagation.wait 90s --dns.resolvers 1.1.1.1"
volumes:
- ./letsencrypt:/letsencryptWith hook: Check hook.sh for an example.
services:
nginx:
container_name: nginx01
image: nginx:alpine
ports:
- mode: host
published: 443
target: 443
- mode: host
published: 80
target: 80
volumes:
- ./html/:/var/www/html
- ./nginx-example.conf:/etc/nginx/conf.d/default.conf
- "./letsencrypt:/letsencrypt"
lego:
image: brahmadev/acme-lego-cron:latest
environment:
STAGING: 1
DOMAINS: "example.com;*.example.com"
EMAIL_ADDRESS: user@example.com
CLOUDFLARE_DNS_API_TOKEN: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
PROVIDER: cloudflare
LEGO_ARGS: "--dns.propagation.wait 90s --dns.resolvers 1.1.1.1"
volumes:
- ./hook.sh:/app/hook.sh
- /var/run/docker.sock:/var/run/docker.sock
- ./letsencrypt:/letsencrypt