Restart Nginx or reload certificate cache on cert change

user_13056369 0
Viewed 5279

Background:

I am running an app inside Docker, that will be managed by random users that do often not have any knowledge about Docker itself. I am building the app to be as much configurable from the webserver itself as possible.

It runs 3 non-root containers:

  • Container 1: Gunicorn,Django,Certbot
  • Container 2: Nginx
  • Container 3: Postgresql

I am able to let the Django app run certbot via the website itself to get a certificate and copy the certificate into the volume that nginx is using. But the old or self-signed certificate seems to be cached by nginx on startup and so the new certificate is not used until a restart of nginx.

And here is the problem, I must now restart nginx or somehow reload the certificates automatically. Either by triggering the restart from the Django container to the Nginx Container maybe via a curl or something. Or I can use something like watchdog to watch the files for a file change.

Question:

What is the best approach to reload nginx automatically if a certificate changes? Or can I purge the certificate cache of the certificates even without restarting the server? What is your suggestion here?

Thanks for your help in advance!

docker nginx ssl django
1 Answers

A reload should be enough to load new certs.

Some options:

  • Use host cron to reload nginx

0 */6 * * * docker exec <nginx_container_name> nginx -s reload

  • Use certbot deploy hook (you need to run certbot in the nginx container or think of a way to make this deploy hook remote)
/etc/letsencrypt/cli.ini:
deploy-hook = nginx -s reload
user_58677220
Related