You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
sudo dokku letsencrypt:cron-job --add # <- To enable auto-renew
13
14
```
14
15
15
16
### Upgrading from previous versions
@@ -135,30 +136,26 @@ For a more in-depth explanation, see [this blog post](https://blog.semicolonsoft
135
136
136
137
## Dockerfile and Image-based Deploys
137
138
138
-
When securing Dockerfile and Image-based deploys with dokku-letsencrypt, be aware of the [proxy mechanism for dokku 0.6+](https://dokku.com/docs/networking/proxy-management/#proxy-port-mapping).
139
+
When securing Dockerfile and Image-based deploys with dokku-letsencrypt, be aware of the [proxy mechanism for dokku 0.6+](https://dokku.com/docs/networking/port-management/#dockerfile).
139
140
140
-
For Dockerfile deploys - as well as those via `git:from-image` - Dokku will determine which ports a container exposes and proxies all those exposed ports in the Docker container by listening on the same port numbers on the host. This means that **both the proxies for HTTP port 80 and HTTPS port 443 to the app's container need to be manually configured** using the `dokku proxy:ports-*` commands in order for certificate validation and browsing to the app via HTTPS to work.
141
+
For Dockerfile deploys - as well as those via `git:from-image` - Dokku will determine which ports a container exposes (using `EXPOSE`) and will proxy them on the same port numbers on the host. If the Dockerfile exposes another port than 443, then HTTPS port 443 **needs to be manually configured** using the `dokku ports:*` commands in order for certificate validation and browsing to the app via HTTPS to work.
141
142
142
-
A full workflow for creating a new Dockerfile/Image-based deployment (where the app is listening on port 5555) with dokku-letsencrypt would be:
143
+
A full workflow for creating a new Dockerfile/Image-based deployment (assuming the app is listening/exposed on port 5555) with `dokku-letsencrypt` would be:
143
144
144
-
1. Create a new app `myapp` in dokku and push to the `dokku@myhost.com` remote. This guide assumes that the Docker container will be listening for connections on port 5555 so replace container port numbers accordingly if necessary.
145
-
2. On the dokku host, use `dokku ports:add myapp http:80:5555` to proxy HTTP port 80 to port 5555 on the Docker image
146
-
3. On the dokku host, use `dokku letsencrypt:enable myapp` to retrieve HTTPS certificates.
147
-
4. On the dokku host, use `dokku ports:add myapp https:443:5555` to proxy HTTPS port 443 to port 5555 on the Docker image
148
-
5. (optional) On the dokku host, use `dokku ports:remove myapp http:5555:5555` to remove a potential leftover proxy that was automatically configured on first deploy.
145
+
1. Create a new app `myapp` in dokku and push to the `dokku@myhost.com` remote.
146
+
2. On the dokku host, use `dokku letsencrypt:enable myapp` to retrieve HTTPS certificates.
147
+
3. On the dokku host, use `dokku ports:add myapp https:443:5555` to proxy HTTPS port 443 to port 5555 on the Docker image
149
148
150
-
After these steps, the output of `dokku ports:list myapp` should look like this:
149
+
After these steps, the output of `dokku ports:report myapp` should look like this:
151
150
152
151
```
153
-
-----> Port mappings for myapp
154
-
-----> schemehost port container port
155
-
https443 5555
152
+
=====> myapp ports information
153
+
Ports map:https:443:5555
154
+
Ports map detected:https:5555:5555
156
155
```
157
156
158
157
Replace the container port (`5555` in the above example) with the port your app is listening on.
159
158
160
-
**Note:** Step 2 and step 4 cannot be joined together since a configured HTTPS proxy will include a `ssl_certificate` line in the app's nginx config that will cause nginx config validation to fail because no valid HTTPS certificate is available until step 3 is completed.
161
-
162
159
## Dealing with rate limit
163
160
164
161
Be aware that Let's Encrypt is subject to [rate limiting](https://letsencrypt.org/docs/rate-limits/). The limit about the number of certificates you can add on a domain per week is a concern for dokku because of the default domain added to your new applications, named like `<app>.<dokku-domain>`: using `dokku-letsencrypt` on all your applications would create a certificate for each application subdomain on `<dokku-domain>`.
0 commit comments