Nginx Proxy

version: '3.2'
services:
  proxy:
    image: jwilder/nginx-proxy:alpine
    restart: always
    # The proxy will be the only container running on port 80 and 443. This is
    # to ensure that we can access any service via the browser without having
    # to specify any ports.
    ports:
      - '80:80'
      - '443:443'
    volumes:
      # Add custom nginx config to the ./nginx/proxy.conf file. This is useful
      # for disabling version numbers or increasing the maximum file size for
      # uploading files.
      - './nginx/proxy.conf:/etc/nginx/conf.d/proxy.conf:ro'

      # This is where the magic happens. The proxy container watches the
      # docker socket for any changes to containers and inspects their
      # environment variable to set up vhost entries for. Make sure this is a
      # read only mount.
      - '/var/run/docker.sock:/tmp/docker.sock:ro'

      # The following 3 mounts allow the nginx process read and set up vhost
      # entries that the Let's Encrypt companion container has generated for us.
      # In the next service definition we see how this hooks up.
      - './nginx/vhost.d:/etc/nginx/vhost.d'
      - './nginx/html:/usr/share/nginx/html'
      - './nginx/certs:/etc/nginx/certs'
    # This label is required as the Let's Encrypt companion container needs to
    # identify which container the nginx proxy is running in.
    labels:
      - com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy

  proxy_letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: always
    # When setting up new SSL enabled domains, it's useful to have a testing
    # environment before rolling out fully fledged SSL certificates for your
    # service. Setting the `ACME_CA_URI` environment variable to the below URL
    # allows for multiple attempts at certificate generation. Once this
    # container is generating certificates, comment this line out and recreate
    # the container.
    environment:
      ACME_CA_URI: https://acme-staging.api.letsencrypt.org/directory
    volumes:
      # Similar to the main proxy container, this one also needs to watch the
      # docker socker to know when certification generation should occur. Make
      # sure this is a read only mount.
      - '/var/run/docker.sock:/var/run/docker.sock:ro'

      # As noted above, these mounts should be the same as the main nginx
      # container. This is where Let's Encrypt certificates are saved so the
      # main container can read and configure the vhosts appropriately.
      - './nginx/vhost.d:/etc/nginx/vhost.d'
      - './nginx/html:/usr/share/nginx/html'
      - './nginx/certs:/etc/nginx/certs'

    # This is more of a convenience configuration to make sure that the proxy
    # container is running when starting up the Let's Encrypt one.
    depends_on: ['proxy']

version: '3.2'
services:
  proxy:
  # ...snip...

  my_new_service:
    # ...snip...
    environment:
      # The `VIRTUAL_HOST` environment variable specified the vhost names to be
      # generated by the proxy. Here we're telling the proxy to forward both
      # my.service.home and my.domain.com to the my_new_service container
      VIRTUAL_HOST: my.service.home,my.domain.com

      # Sometimes containers may not specify (EXPOSE) which port their software
      # is running on. If necessary, use `VIRTUAL_PORT` to amend this.
      VIRTUAL_PORT: 8080

      # The following 2 environment variables are required for the generation of
      # Let's Encrypt SSL certificates. Note that the `LETSENCRYPT_HOST`
      # **must** be specified in the `VIRTUAL_HOST` environment variable for
      # forwarding to be successful.
      # It's also worth noting that the current version of this container must
      # be accessible over the internet on both port 80 and 443. So check with
      # your ISP and router settings that these ports are unblocked and open.
      LETSENCRYPT_HOST: my.domain.com
      LETSENCRYPT_EMAIL: [email protected]