Nginx Reverse Proxy + SSL Automation (Certbot)

Nginx reverse-proxies two containerized backend services, each on its own domain, with Let's Encrypt certificates auto-renewed via Certbot.

Stack

• Nginx (reverse proxy + TLS termination)
• Certbot (issues + auto-renews Let's Encrypt certs)
• Two sample Flask backend services

How it works

• Each domain (service-a.example.com, service-b.example.com) has an HTTP block that redirects to HTTPS, and an HTTPS block that proxies to its backend container.
• Certbot runs as a sidecar container that checks for renewal every 12 hours (certbot renew), writing certs to a shared volume Nginx also mounts.

Setup

Replace service-a.example.com / service-b.example.com with real domains pointed at your server, and the email in init-certs.sh.

# 1. start nginx + backends (SSL blocks will fail until certs exist — that's expected)
docker compose up -d nginx service-a service-b

# 2. issue the first certificates
./init-certs.sh

# 3. reload nginx to pick up the new certs
docker compose exec nginx nginx -s reload

# 4. start the renewal sidecar
docker compose up -d certbot

Verifying renewal works

docker compose run --rm certbot renew --dry-run

Notes

• For local testing without real domains, point /etc/hosts at 127.0.0.1 and use a self-signed cert instead of Certbot (Let's Encrypt won't issue certs for non-public domains).