I’ve been self hosting traditionally in debian, but I would like to be able to add services easier using docker. As such, I’m looking to move to a container based architecture.
One place I struggle is that I can’t seem to find a good container where the default image supports ACME to support Let’s encrypt for automatic cert renewal.
For Nginx, I would have you build my container. HAproxy ACME support seems to be a shell script.
Any suggestions?
You must log in or # to comment.
It’s not Let’s Encrypt, but I’ve been happy with this Cloudflare-flavored ACME through Caddy.
https://github.com/CaddyBuilds/caddy-cloudflare
I really only use it for my local-hosted stuff that I don’t expose to the web. So, when I’m at home, https://radarr/.[mydomain].com resolves to 192.168.1.145:7878. That sort of thing…
I didn’t understand, why not use nginx? It has built in support for let’s encrypt by default, you just have to activate it in the nginx config. https://nginx.org/en/docs/http/ngx_http_acme_module.html
You might check docker swag. It’s got built in certbot client and has preconfigured support for a couple hundred common self-hosted services.
I second SWAG. nginx, let’s encrypt, plenty of ready-to-go configs, it’s pretty great
I use Caddy and it’s great. ACME is very easy to configure, as is everything else. I haven’t tried running it in a container tho but they have official images published so it should work without issues.
I don’t think running Caddy in a container is needed. All my apps are docker images and Caddy is a system app. I treated as an important OS app.
Agreed
I run it in a container without problems. All you have you do is bind it to port 80 and 443. I prefer the container to running it directly within the host OS for ease of portability.
Also strongly recommend building it with support for DNS based validation. Using DNS validation you can have multiple instances running across the different servers you have to easily switch to or provide better local routing. For example please. I run one caddy frontend on a VPS that routes my traffic most of the time, but when I’m at home my DNS points me at a caddy instance that is running on my server on my home network avoiding the path of out to the internet and back home. Using http based validation would require me to sync certs around.
This is usually where something like Traefik comes in. It will reverse proxy the docker instance and it can be configured to handle let’s encrypt. The are also other options I like nginx proxy manager and I think Caddy also can do this, by I don’t have experience with that.
Yep I use caddy for all that. Bonus is caddy has a docker compose proxy plugin where all your domain/port/cert config can be part of your each application’s compose file, rather than needing to make adjustments in caddy centrally. Works great for my purposes.
thanks for mentioning the Caddy-Docker-Proxy plugin.
If you want to be able to manage it via a web page instead of config files, nginx proxy manager works well, and can be run via docker/docker compose.
Can confirm running Nginx Proxy Manager with 30 configurations. Been running solid for years.
I’ve been having constant issues for over a year where it’s not able to auto update any of my certs. It has been erroring when I even try to do a manual update, but the second it’s deleted and reset up it’s fine (for the time being).
I recently installed on a new system, and it took of lot of tries with nondescript errors to get new certs fetched
Weird. With port 80/443 it should have no issues updating.
I’ve only used it on 80/443 but this issue has been happening on numerous different VMs enough to the point I’ve just stopped using it for new installs.
That sucks. Can’t say I’ve ever had that issue and I used it for years before switching to the evil Cloudflare Tunnels/Zero Trust.
I’m considering moving to Talos, so I imagine Traefik would work better in k8s right?
Traefik also supports running on K8s, yes.
On that note, if you’re moving to K8s, I recommend looking into K8s Gateway API, it’s the successor to the old Ingress API. There are other, more complete, implementations of it than Traefik. See https://gateway-api.sigs.k8s.io/
Which gateway implementations would you recommend?
I’m looking to support HTTPS and Webdav
I’m using istio (in ambient mode, so it doesn’t put its sidecar into every pod I create), and Nextcloud behind it, works flawlessly. It does consume a bit of time to set up properly though.
TLS certificates are handled via cert-manager, which works with both Ingress and Gateway API, independent of which implementation you choose.
I’ve also tried envoy gateway (had issues with uploading larger files via Nextcloud Web UI and Gradle publish to maven repo).
Cilium (a CNI) also has an integrated Gateway and Ingress API implementation, works fine, but lacks some of the most recent stable features, and quite some experimental features. But if you just need a HTTPS gateway without much fuss, it’s rock-solid. Setup time is also minimal for the Ingress/Gateway controller part. Cilium CNI on the other hand takes a lot of time to understand and configure, if you’re unfamiliar with networking in general.
Traefik’s featureset is comparable with Cilium’s Gateway API implementation, also works, simple to setup, and might be better suited, if you’re already familiar with it using docker, as it’s the same concepts, just slightly different config (docker labels vs. Ingress/Gateway API with Traefik specific annotations).
I use Zoraxy and it is great if you like GUIs.
Traefik and caddy were mentioned, the third in the game is usually nginxproxymanager.
I’m using both traefik and nginx in two different setups. The nginxproxymanager can be configured via UI natively which makes checking configurations a bit easier.
Traefik on the other hand is configured easily within the compose itself and you have everything in one place.
This turned out to be tiresome though if you don’t have a monolithic compose file - that’s actually even hr history why I switched to npm in the first place.
I don’t have any experience with caddy so can’t provide anecdotal insights there.
Don’t know if this fits for your use case but I am in love with pangolin.
I use traefik since I’m hosting stuff in docker and it works great. I think, Caddy is another popular pick, but I haven’t tried it and cannot tell you anything about it.
I use:
- Apache with Letsencrypt client for single host reverse proxies or those with more complex needs. Not the easiest but when you understand it, it’s fine. Lightweight, solid and very flexible.
- NPM (Nginx Proxy Manager), either service or docker, where there’s a lot of proxies on one host. Very simple, very reliable, baked in authentication.
- Traefik, when building or deploying services, especially with docker swarm. Tags make it very smooth once you’ve got things set up and in your workflow.
All are good choices, but each has a specialism that make it a little bit better than the others.
Take a look at Zoraxy or NPM.
Yeah, I switched to Zoraxy from NPM and it’s been great.
I find some of the workflows in it a bit strange, like not having an Add button on the list of host proxies, it’s a separate menu item on the left which weird. And the way you request a SSL cert by hitting OK and then you get a popup asking if you want a cert, and you’d better have already set your options for how you want the cert, but if you create a host without a cert you have to go through all the options again and check them because it doesn’t keep track of your preference.
IDK, in any case it fixed a bunch of problems I was having with NPM so it has that going for it, which is nice.
I have the same issues you listed. I only have one wildcard domain so it was only an issue once but I do think a UI change/workflow would help.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL VPS Virtual Private Server (opposed to shared hosting) k8s Kubernetes container management package nginx Popular HTTP server
7 acronyms in this thread; the most compressed thread commented on today has 12 acronyms.
[Thread #122 for this comm, first seen 28th Feb 2026, 06:40] [FAQ] [Full list] [Contact] [Source code]
I use docker to host all kinds of containers - I use unbuntu but that doesn’t matter. I use Let’s encrypt for the certs. Then I use a nginx container to proxy all of that. It’s super easy. Any shell scripts are small and easily understood. I’m not sure why you struggle. I can give you samples that have you up in minutes.
