Should nginx be reloaded after a certificat has been renewed?

[victor-lund]

Hello,

I am using a docker setup with the following images:

• nginx
• jwilder/docker-gen
• jrcs/letsencrypt-nginx-proxy-companion

...and I'm facing issues with renewed certificates. I believe that my certificates are getting renewed properly but I don't think nginx is restarted when a certificat has been renewed.

When using a non-docker setup, I would typically use certbot together with a cron job that looks something like this:

30 2 * * * /usr/bin/certbot renew --noninteractive --renew-hook "/bin/systemctl reload nginx" >> /var/log/le-renew.log

...which reloads nginx when a certificate has been renewed.

I suspect that this functionality either isn't implemented in my setup or alternatively that it is not working properly.

Anyone out there having similar experiences or ideas how I could track down what is causing my certificates / nginx issues?

[buchdag]

Are you using a recent enough version of jrcs/letsencrypt-nginx-proxy-companion ?

#199 was a similar issue fixed by #165 on May, 28.

[MichaelBorde]

Latest release (1.5) seems to be on May, 18. Do you suggest we use lastest tag when pulling your image ?

[buchdag]

Yes, better use latest, the project maintainer seems to be very busy and only shows up once in a while to merge some simple PRs.

[victor-lund]

I do use the :latest tag, and the image i'm using was created in september 2017.

I can confirm that the certificates are getting updated properly but that the nginx service is not reloaded as it needs to be after a certificate has been renewed. Im surprised that not everyone is encountering this issue...

[buchdag]

Are you sure all your containers are properly setup with the right labels or env variable ?

[victor-lund]

@buchdag Well, Everything is working except for the nginx service not reloading. I can't swear on the fact that all settings are properly made. Which variables are needed to restart nginx after a certificate has been successfully renewed?

[buchdag]

Preferably the com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy label set on the nginx / nginx-proxy container or alternatively if your nginx / nginx-proxy container has a static name, the NGINX_PROXY_CONTAINER env variable set to this name on the letsencrypt-nginx-proxy-companion container.

[buchdag]

I just forced the renewal of one of my certificate from inside the letsencrypt-nginx-proxy-companion, the nginx container was correctly restarted as stated by the last line:

Creating/renewal app.example.com certificates... (app.example.com )
2017-11-01 14:19:51,658:INFO:simp_le:1306: app.example.com was successfully self-verified
2017-11-01 14:19:51,879:INFO:simp_le:1314: Generating new certificate private key
2017-11-01 14:19:53,500:INFO:simp_le:393: Saving key.pem
2017-11-01 14:19:53,504:INFO:simp_le:393: Saving fullchain.pem
2017-11-01 14:19:53,505:INFO:simp_le:393: Saving cert.pem
Reloading nginx docker-gen (using separate container 7dd2fcadc5e2756e070e9f2688611419870c8c663eccf4f17f269e12779d89e6)...
Reloading nginx (using separate container 39cb4f97bfc0f723260fdd0d427f20ab72ab3887be7dd3a889187be013195942)...

And it served the renewed certificate for this webapp (expiring on january 30 2018), so I confirm that with a correctly configured stack renewal work as it should.

[jasonchi38]

buchdag, can you post your working compose stack file examples? thanks in advance.

[victor-lund]

@buchdag Can you clearify how you forced the renewal of a given certificate? I've been looking for this feature before with no success.

I'd also like to see a working compose stack file example, as requesten by @jasonchi38

[buchdag]

Okay, turns out there seems to be an issue with the com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy label on a test VM that I never encountered on my production VMs. Suspected an issue with the docker version but both are current (either 17.09 or 17.10), so no idea where it comes from. I'll have a look into this.

Here is a working compose stack for nginx-proxy + letsencrypt. Just remember that you have to manually create the nginx-proxy network before starting the compose stack with docker network create nginx-proxy.

version: '3'

services:
  nginx:
    image: nginx:1.13.5-alpine
    container_name: nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - conf:/etc/nginx/conf.d
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - certs:/etc/nginx/certs:ro

  dockergen:
    image: jwilder/docker-gen:0.7.3
    command: -notify-sighup nginx-proxy -watch -wait 5s:30s /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
    container_name: nginx-proxy-gen
    volumes:
      - conf:/etc/nginx/conf.d
      - vhost:/etc/nginx/vhost.d
      - certs:/etc/nginx/certs:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl

  letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: nginx-proxy-le
    volumes:
      - conf:/etc/nginx/conf.d
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - certs:/etc/nginx/certs:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      NGINX_PROXY_CONTAINER: nginx-proxy
      NGINX_DOCKER_GEN_CONTAINER: nginx-proxy-gen

volumes:
  conf:
  vhost:
  html:
  certs:

networks:
  default:
    external: 
      name: nginx-proxy

Pining the version of nginx and docker-gen is not required, that's just my habit with compose stacks.

And an example proxyed app (a simple nginx serving static content):

version: '3'

services:
  web:
    image: nginx:alpine
    volumes:
      - ./www:/usr/share/nginx/html:ro
    expose:
      - "80"
    environment:
      VIRTUAL_HOST: nginxproxyle.duuu.ch
      LETSENCRYPT_HOST: nginxproxyle.duuu.ch
      LETSENCRYPT_EMAIL: whatever@email.tld

networks:
  default:
    external:
      name: nginx-proxy

You can access it at https://nginxproxyle.duuu.ch, there is nothing else running on this vm than those two docker compose files.

First cert generated at container launch: https://storage.googleapis.com/dl.duuu.ch/cert1.png

Forced a renewal, refreshed the page, renewed certificate is correctly served by nginx: https://storage.googleapis.com/dl.duuu.ch/cert2.png

(sorry for the french UI)

Can you clearify how you forced the renewal of a given certificate? I've been looking for this feature before with no success.

docker exec NAME_OF_YOUR_LE_CONTAINER /app/force_renew but turns out there is an issue with that too and it's only renewing the first domain it finds, not all of them as it should. I'm the one who added this feature so I'll have a look at it immediately.

[victor-lund]

@buchdag thanks for your very detailed answers! I will take a closer look later this week and investigate if they solve my problems. Please let me know when the force renew works as expected - this is principally a very handy feature.

[buchdag]

I'm pretty sure I already know why it does not work as intended, very basic and stupid mistake on my behalf.