<commit_before>nginx-letsencrypt-proxy
=====

nginx-letsencrypt-proxy is based on the officiel [nginx](https://registry.hub.docker.com/_/nginx/) image and includes a [docker-gen](https://hub.docker.com/r/jwilder/docker-gen/) template to generate vhosts configured to work with letsencrypt.

The idea is to have a default vhosts running on port 80 that will serve the acme-challenge files, or return a 301 to the https version of your site.

First, create a data-only container for letsencrypt certificates.
```
docker run -it \
  --name letsencrypt-data \
  --entrypoint /bin/echo \
  quay.io/letsencrypt/letsencrypt \
  "Data only container"
```

Next, start `nginx-letsencrypt-proxy` and `docker-gen`:
```
docker run -it -d \
  --name nginx \
  --restart always \
  --volumes-from letsencrypt-data \
  -p 80:80 \
  -p 443:443 \
  arnaudrebts/nginx-letsencrypt-proxy
```
```
docker run -it -d \
  --name docker-gen \
  --volumes-from nginx \
  -v /var/run/docker.sock:/tmp/docker.sock:ro \
  jwilder/docker-gen \
  --watch \
  -only-exposed \
  -notify-sighup nginx \
  /etc/nginx/conf.d/99-vhosts.conf.tmpl \
  /etc/nginx/conf.d/99-vhosts.conf
```

Next, run letsencrypt to get the initial certificate, using the webroot authentication method:
```
docker run -it --rm \
  --name letsencrypt \
  --volumes-from letsencrypt-data \
  --volumes-from nginx \
  quay.io/letsencrypt/letsencrypt \
  certonly \
  --webroot-path /var/www/letsencrypt \
  -a webroot \
  --text \
  --agree-tos \
  --renew-by-default \
  --email <EMAIL> \
  -d example.com
```

We can now start the backend containers:
```
docker run -e VIRTUAL_HOST=example.com ...
```
The containers must expose the port, using the EXPOSE directive in their Dockerfile, or using the --expose flag to `docker run` or `docker create`.
<commit_msg>Added documentation for $CERT_NAME and $PROXY_SCHEME.<commit_after>nginx-letsencrypt-proxy
=====

nginx-letsencrypt-proxy is based on the officiel [nginx](https://registry.hub.docker.com/_/nginx/) image and includes a [docker-gen](https://hub.docker.com/r/jwilder/docker-gen/) template to generate vhosts configured to work with letsencrypt.

The idea is to have a default vhosts running on port 80 that will serve the acme-challenge files, or return a 301 to the https version of your site.

### Usage

First, create a data-only container for letsencrypt certificates.

    $ docker run -it \
      --name letsencrypt-data \
      --entrypoint /bin/echo \
      quay.io/letsencrypt/letsencrypt \
      "Data only container"

Next, start `nginx-letsencrypt-proxy` and `docker-gen`:

    $ docker run -it -d \
      --name nginx \
      --volumes-from letsencrypt-data \
      -p 80:80 \
      -p 443:443 \
      arnaudrebts/nginx-letsencrypt-proxy

    $ docker run -it -d \
      --name docker-gen \
      --volumes-from nginx \
      -v /var/run/docker.sock:/tmp/docker.sock:ro \
      jwilder/docker-gen \
      --watch \
      -only-exposed \
      -notify-sighup nginx \
      /etc/nginx/conf.d/99-vhosts.conf.tmpl \
      /etc/nginx/conf.d/99-vhosts.conf


Next, run letsencrypt to get the initial certificate, using the webroot authentication method:

    $ docker run -it --rm \
      --name letsencrypt \
      --volumes-from letsencrypt-data \
      --volumes-from nginx \
      quay.io/letsencrypt/letsencrypt \
      certonly \
      --webroot-path /var/www/letsencrypt \
      -a webroot \
      --text \
      --agree-tos \
      --renew-by-default \
      --email <EMAIL> \
      -d bar.com


We can now start the backend containers:

    $ docker run -e VIRTUAL_HOST=bar.com ...

The containers must expose the port, using the EXPOSE directive in their Dockerfile, or using the --expose flag to `docker run` or `docker create`.

#### Custom letsencrypt domain name

By default, `nginx-letsencrypt-proxy` will use `VIRTUAL_HOST` to find the certificates in `/etc/letsencrypt/live`. You can override this with the `CERT_NAME` environment variable on the backend container:

    $ docker run -e VIRTUAL_HOST=foo.bar.com -e CERT_NAME=bar.com

#### SSL Backends

If your backend is using HTTPS, set `PROXY_SCHEME=https` on the backend container.

{'fraction_non_alphanumeric': 0.12088440278779139, 'fraction_numerical': 0.0091324200913242, 'mean_word_length': 2.670194003527337, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 4, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2904856', 'n_tokens_mistral': 1504, 'n_tokens_neox': 1376, 'n_words': 409}