my CoreOS fleet files

cert.service

[Unit]
Description=SSL cert
After=docker.service
Requires=docker.service

[Service]
User=core
ExecStartPre=-/usr/bin/docker kill ssl-cert
ExecStartPre=-/usr/bin/docker rm ssl-cert
ExecStartPre=/usr/bin/docker pull pierrezemb/ssl-cert
ExecStart=/usr/bin/docker run -v /etc/nginx/certs --name ssl-cert pierrezemb/ssl-cert true
ExecStop=/usr/bin/docker stop ssl-cert

cloud-config.yaml

#cloud-config

coreos:
  etcd2:
    # generate a new token for each unique cluster from https://discovery.etcd.io/new?size=3
    # specify the initial size of your cluster with ?size=X
    discovery: https://discovery.etcd.io/1234
    # multi-region and multi-cloud deployments need to use $public_ipv4
    advertise-client-urls: http://$private_ipv4:2379,http://$private_ipv4:4001
    initial-advertise-peer-urls: http://$private_ipv4:2380
    # listen on both the official ports and the legacy ports
    # legacy ports can be omitted if your application doesn't depend on them
    listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
    listen-peer-urls: http://$private_ipv4:2380
  units:
    - name: etcd2.service
      command: start
    - name: fleet.service
      command: start
ssh_authorized_keys:
  # include one or more SSH public keys
  - ssh-rsa yolo

deploy.sh

#!/bin/bash

set -e;

nova boot \
 --user-data ./cloud-config.yaml \
 --image e77c3cdd-d2bb-4f36-ac0e-95415005d81a \
 --key-name rMBP-CoreOS \
 --flavor faa2002f-9057-4fe1-8401-fed7edb34059 \
 --num-instances 1 \
 --security-groups default coreos

portfolio.service

[Unit]
Description=Portfolio web server
After=proxy.service
Requires=docker.service

[Service]
user=core
TimeoutStartSec=0
ExecStartPre=-/usr/bin/docker kill portfolio
ExecStartPre=-/usr/bin/docker rm portfolio
ExecStartPre=/usr/bin/docker pull pierrezemb/portfolio:latest
ExecStart=/usr/bin/docker run -e VIRTUAL_HOST=pierrezemb.fr,www.pierrezemb.fr -p 8043:8043 --name portfolio pierrezemb/portfolio --forceHTTP
ExecStop=/usr/bin/docker stop portfolio

proxy.service

[Unit]
Description=Proxy
After=cert.service
Requires=cert.service

[Service]
TimeoutStartSec=0
ExecStartPre=-/usr/bin/docker kill proxy
ExecStartPre=-/usr/bin/docker rm proxy
ExecStartPre=/usr/bin/docker pull jwilder/nginx-proxy:latest
ExecStart=/usr/bin/docker run --name proxy -p 80:80 -p 443:443 --volumes-from ssl-cert -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy
ExecStop=/usr/bin/docker stop proxy