nginx and letsencrypt dns-01

compose.yml

services:
  nginx:
    image: nginx:mainline-alpine
    restart: always
    command: nginx -g "daemon off;"
    labels:
      - 'nginx-container'
    ports:
      - '80:80'
      - '443:443/tcp'
      - '443:443/udp'
    volumes:
      - "/opt/nginx/certs:/etc/nginx/certs:ro"

  certbot:
    image: certbot/dns-cloudflare:latest
    entrypoint: ["certbot", "certonly", "--dns-cloudflare", "--dns-cloudflare-credentials", "/opt/certbot/credentials/config.ini"]
    volumes:
      - "/opt/nginx/certs:/etc/letsencrypt"
      - "/opt/nginx/credentials:/opt/certbot/credentials"
    deploy:
      replicas: 0

  autorenew:
    image: certbot/dns-cloudflare:latest
    entrypoint: ["sleep", "infinity"]
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "certbot renew 1>>/tmp/renew-healthcheck.log 2>>/tmp/renew-healthcheck.err"]
      interval: 24h
      timeout: 5m
      retries: 3
      start_period: 30s
    volumes:
      - "/opt/nginx/certs:/etc/letsencrypt"
      - "/opt/nginx/credentials:/opt/certbot/credentials"

  autoreload:
    image: docker:cli
    entrypoint: ["sleep", "infinity"]
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "docker kill --signal=HUP $(docker container ls -f 'label=nginx-container' --format '{{.ID}}')"]
      interval: 24h
      timeout: 20s
      retries: 1
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"